Vulnerability · Published Oct 28, 2026 · Assigned by INCIBE
CVE-2026-112197Missing Authentication for Critical Function in Tactis' NoviGest Desktop App
Critical 9.4
In plain English
A critical-severity missing authentication in NoviGest Desktop App from Tactis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tactis | NoviGest Desktop App | NoviGest Desktop App prior to version 8.0.0-300 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H