CVE-2026-112197 Missing Authentication for Critical Function in Tactis' NoviGest Desktop App
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-112197?
CVE-2026-112197 is a critical vulnerability in Tactis NoviGest Desktop App, published on 28 Oct 2026.
Official description
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.
Weakness: CWE-306
Which versions are affected by CVE-2026-112197?
How do I fix CVE-2026-112197?
No fix has been published for CVE-2026-112197 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-112197 being exploited?
There is no known exploitation of CVE-2026-112197 in the wild and no public exploit code.
Sources
Also known as GHSA-hmpj-9p3q-vvc4.