CVE-2026-14261

9.1 Critical

A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to reinstall the service to a remote database they control.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

1.03%Up 0.5 points since Jul 10, 2026

What each source reports

CVE List Score used 9.1

CVE-2026-14261

Record: CVE-2026-14261
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

EUVDEUVD-2026-42583 9.1

Record: EUVD-2026-42583
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3g88-3v3g-pch4 9.1

A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code...

Record: GHSA-3g88-3v3g-pch4
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

NVD 9.1

Record: CVE-2026-14261
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSV 9.1

CVE-2026-14261

Record: CVE-2026-14261
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

Affected products

xerte online tools

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-14261 is a critical vulnerability (CVSS 9.1) in Xerte Online Tools, published July 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 64th percentile. No source names a fixed version.