Live › vulnerability › CVE-2026-112197
Go to dashboardThe NoviGest Desktop App exposes a Java RMI service whose critical methods require no authentication. An attacker on the network can read stored credentials, run arbitrary SQL on PostgreSQL, and chain that into operating system command execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Teams running the NoviGest Desktop App where its Java RMI service is reachable over the network, especially with a PostgreSQL account that has elevated privileges. Installations where the RMI service is only reachable on localhost or behind a firewall are less exposed, but the sources do not state the exact exposure conditions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.
This page as .md · .json · in your agent: get_signal("CVE-2026-112197")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.