Which versions of ERP App are affected by CVE-2026-14807?

PROG MIS ERP App contains hard-coded authentication credentials that allow unauthenticated remote attackers to log in and extract application source code and database credentials.

How to fix or mitigate CVE-2026-14807?

Within 24 hours: Audit network inventory to identify all PROG MIS ERP instances and map internet exposure; disable remote access or place behind VPN if feasible. Within 7 days: Implement network segmentation to restrict ERP tier access, review database access logs for unauthorized activity, establish incident response plan. Within 30 days: Contact vendor for patched version release timeline; if unavailable, evaluate migration to alternative ERP platform or request extended vendor support with compensating controls.

ERP App CVE-2026-14807

Q: What is the CVSS score of CVE-2026-14807?

CVE-2026-14807 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41816 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-07-06 twcert

GHSA-8xw6-3xrm-fqhg

Authentication Bypass Erp App Prog Mis

9.3

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated (hard-coded credential = PR:N) network login with low complexity; code and database-credential disclosure enable full read/write to the vulnerable system, so C/I/A all High, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 07:51 vuln.today

DescriptionCVE.org

ERP App developed by PROG MIS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to view application code and obtain the database account and password.

AnalysisAI

Credential exposure and authentication bypass in PROG MIS's ERP App lets unauthenticated remote attackers log in using hard-coded credentials, then read application source code and extract the backing database account and password. Because the leaked database credentials grant direct access to the data tier, a single successful login can escalate into full compromise of the application's stored data. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.3 (Critical) and the CWE-798 root cause make this a high-priority fix for any organization running this Taiwanese ERP product.

Technical ContextAI

The affected component is PROG MIS's ERP App, an enterprise resource planning web application (CPE cpe:2.3:a:prog_mis:erp_app). The root cause is CWE-798 (Use of Hard-coded Credentials): a static, shipped-in username/password pair (or equivalent embedded secret) is compiled or configured into the application, so it is identical across every deployment and cannot be changed by the operator without vendor support. Once authenticated with that constant credential, the attacker gains access to functionality that discloses application code, and that code in turn embeds or references the database connection account and password - a classic chained secrets-exposure pattern where one hard-coded secret leads to a second, more powerful set of database credentials.

RemediationAI

Apply the vendor's fixed release as directed in the TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11024-c5c1a-2.html and https://www.twcert.org.tw/tw/cp-132-11023-3abe8-1.html); no exact fixed version number is provided in the available data, so contact PROG MIS to obtain the patched build and confirm the version. Because the flaw stems from hard-coded credentials, patching alone may not rotate secrets - after updating, immediately change the exposed database account password and any other credentials the application code may have revealed, and audit database logs for prior unauthorized access. As compensating controls until patched: restrict network access to the ERP App to trusted management networks or VPN only (side effect: legitimate remote users lose direct access and need VPN), place the application behind a reverse proxy or WAF that blocks the specific login path used with the default/hard-coded account, and enforce database-side access controls (allow the DB account to connect only from the application host, not arbitrary sources) to blunt the value of leaked database credentials. Monitor for logins using the hard-coded credential as a high-fidelity indicator of exploitation attempts.