Wolvox9 ERP CVE-2026-15585

No special configuration or authentication is required - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against default deployments of AKINSOFT Wolvox9 ERP KontrolPanel.exe when the service is network-accessible. The sole limiting factor is network exposure: if KontrolPanel.exe is bound only to localhost or shielded behind a perimeter firewall blocking external access, external attackers cannot reach the endpoint. Exploitation is further constrained to the affected version window (s26.02.17 to before 26.02.22) and the Windows platform. The attack is read-only in scope - the CVSS I:N/A:N confirms that this vector does not enable file modification or service disruption through this path alone.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High) signals a network-exploitable, zero-prerequisite vulnerability with high confidentiality impact - the most favorable attack profile an opportunistic threat actor could encounter. The impact is read-only (I:N, A:N), constraining direct damage to information disclosure; however, ERP file exfiltration frequently enables secondary attacks (credential reuse, database compromise). No EPSS data was provided in the source intelligence, preventing probabilistic comparison. The CVE is not listed in CISA KEV and no POC code has been identified, indicating no confirmed active exploitation at time of analysis - yet the trivial exploitation profile (no auth, no complexity) means the window between vulnerability disclosure and attempted scanning is typically very short. For organizations running this software, the risk priority is high: the fix is available and the attack barrier is effectively zero for any network-adjacent adversary.

An unauthenticated attacker with network access to the KontrolPanel.exe service sends a crafted HTTP request embedding path traversal sequences (e.g., ../../windows/system32/drivers/etc/hosts or ../../inetpub/wwwroot/web.config) to escape the intended file-serving directory. The service processes the path without sanitization and returns the contents of the requested file. The attacker iterates this technique to harvest database connection strings, application configuration files, or other ERP-resident credentials, potentially enabling secondary compromise of the underlying database. No public POC code has been identified, but the AC:L/PR:N CVSS profile means exploitation requires no specialized tooling beyond a basic HTTP client.