What is the CVSS score of CVE-2026-59499?

CVE-2026-59499 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Priority ERP Portal Generator are affected by CVE-2026-59499?

The Portal Generator Addon for Priority ERP (developed by Soft Solutions) contains an unauthenticated remote vulnerability that exposes sensitive business data to external attackers without requiring…

How to fix or mitigate CVE-2026-59499?

Within 24 hours: Identify and inventory all Priority ERP instances running Portal Generator Addon; immediately isolate affected systems from internet-facing networks and restrict access to trusted internal IP ranges only. Within 7 days: Implement Web Application Firewall (WAF) rules and strict IP whitelisting on Portal Generator endpoints; conduct comprehensive audit log review for unauthorized access attempts or data extraction. Within 30 days: Establish communication with Soft Solutions (Soft Solutions) for patch timeline and availability; evaluate architectural alternatives to eliminate direct ERP data exposure through Portal Generator; document and continuously monitor compensating controls.

Priority ERP Portal Generator CVE-2026-59499

EUVD-2026-57760 HIGH

Information Exposure (CWE-200)

2026-08-13 INCD

GHSA-7c5m-fjw2-jw76

Information Disclosure Priority Portal Generator Addon To Priority Erp Developed By Soft Solutions

8.6

CVSS 3.1 · Vendor: INCD

Severity by source

Vendor (INCD) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Network-reachable portal with no authentication gate (PR:N, AV:N); scope change to ERP backend (S:C) drives high confidentiality with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (INCD).

CVSS VectorVendor: INCD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 09:51 vuln.today

CVE Published

Aug 13, 2026 - 09:12 cve.org

HIGH 8.6

DescriptionCVE.org

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

AnalysisAI

Unauthenticated remote information disclosure in the Portal Generator Addon for Priority ERP (developed by Soft Solutions) exposes sensitive ERP data to unauthorized network actors. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) confirms that exploitation requires no credentials, no user interaction, and no special network position, yet achieves high confidentiality impact with a scope change that extends beyond the portal component into the underlying Priority ERP system. Reported by the Israel National Cyber Directorate (INCD), no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Priority ERP is an enterprise resource planning platform primarily deployed in Israel and regional markets, and the Portal Generator Addon (developed by Soft Solutions) provides a web-facing layer that generates external-access portals surfacing ERP data and business logic to end users or partners. The CPE string (cpe:2.3:a:priority:portal_generator_addon_to_priority_erp_(developed_by_soft_solutions).:*:*:*:*:*:*:*:*) covers all versions with no upper-bound constraint, suggesting the affected version range has not been formally bounded by the vendor at publication time. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as an access-control failure - the portal layer does not sufficiently gate access to ERP-sourced data, allowing unauthenticated HTTP requests to retrieve information intended only for authenticated sessions or internal components. The S:C (scope change) metric confirms the impact propagates from the vulnerable portal addon into the broader Priority ERP environment.

RemediationAI

Contact Priority Software and Soft Solutions directly to obtain a patched version of the Portal Generator Addon, as no explicit fixed version number was included in the available intelligence. Until a patch is applied, restrict external network access to Portal Generator endpoints at the perimeter firewall or WAF - blocking or rate-limiting unauthenticated requests to portal-generated URLs is the most impactful immediate compensating control, with the trade-off of disrupting legitimate external portal users. If the portal is not required to be internet-facing, place it behind a VPN or require pre-authentication at the reverse-proxy layer. Review portal access logs immediately for anomalous unauthenticated requests to sensitive data endpoints, as the attack leaves a detectable network footprint. Consult the INCD advisory listing at https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 for any updated guidance from the reporting authority.