PT-2026-56797 · Unknown · Xerte Online Toolkits

Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-14261

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Xerte Online Tools (affected versions not specified)

Description An authentication bypass and remote code execution issue exists via the /setup/ folder. This allows attackers to reinstall the service and connect it to a remote database under their control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-14261

Affected Products

Xerte Online Toolkits

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-14261 · Security Note
• https://github.com/thexerteproject/xerteonlinetoolkits/commit/8fec6602e80c5d35903d65e65b65b794297d8e90 · Note
• https://github.com/thexerteproject/xerteonlinetoolkits/issues/1532 · Note
• https://reddit.com/r/SecOpsDaily/comments/1urprj7/vu734812_xerte_online_toolkit_contains_an · Reddit Post
• https://xerte.org.uk/index.php/en/news/blog/80-news/364-xerte-3-14-and-3-15-important-security-update · Note
• https://twitter.com/infoflowcloud/status/2075230089751498907 · Twitter Post
• https://twitter.com/CVEnew/status/2075229337742102669 · Twitter Post