Stel Order CVE-2026-5798

Apply vendor-released security patches when available by consulting the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-stel-order for specific fix versions and update instructions. The advisory title indicates 'multiple vulnerabilities' suggesting a comprehensive security update may address this and related issues. Until patches are deployed, implement these compensating controls: (1) Restrict access to the /app/FrontController endpoint using web application firewall rules to only authorized IP ranges or networks, understanding this reduces remote access functionality. (2) Implement additional session-based access control middleware that validates employeeID parameters against the authenticated user's authorized scope before processing requests - this requires custom development but provides defense-in-depth. (3) Enable comprehensive logging of all requests to /app/FrontController with employeeID parameters to detect enumeration attempts (multiple sequential requests with incrementing IDs), though this is detective rather than preventive. (4) Apply principle of least privilege by auditing user accounts and removing unnecessary low-privilege access to the application. Monitor the INCIBE advisory for official patching guidance and consider engaging directly with Stel Order support for remediation timelines.