Authentication Bypass Vulnerability in NoviGest Desktop App by Tactis
CVE-2026-112197

9.4CRITICAL

Key Information:

Vendor

Tactis

Status
Novigest Desktop App
Vendor
CVE Published:
28 October 2026

What is CVE-2026-112197?

The NoviGest Desktop App features a significant vulnerability arising from inadequate authentication in its Java RMI service. This flaw allows attackers with network access to remotely invoke critical methods without proper authentication, leading to unauthorized access to sensitive credentials. Additionally, this breach enables the execution of arbitrary SQL queries on PostgreSQL databases. As a result, attackers can exploit elevated database privileges to carry out further malicious actions, including executing operating system commands, thereby jeopardizing the confidentiality, integrity, and availability of the server.

Affected Version(s)

NoviGest Desktop App NoviGest Desktop App prior to version 8.0.0-300

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pablo Jordán Lucia
Marina Jiali Villalta Cerezo
.