What is the CVSS score of CVE-2026-59500?

CVE-2026-59500 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Priority Portal Generator are affected by CVE-2026-59500?

Priority ERP users deploying the Priority Portal Generator add-on face critical risk of unauthorized access to protected business data.

How to fix or mitigate CVE-2026-59500?

Within 24 hours, identify all systems running Priority Portal Generator add-on and immediately restrict network access via firewall rules to trusted internal networks only; disable public internet access if operationally feasible. Within 7 days, contact Soft Solutions for patch availability and security advisory details, audit access logs from the past 30 days for suspicious portal access activity, and implement Web Application Firewall (WAF) rules to block authentication bypass attempts if available in your infrastructure. Within 30 days, complete a full security audit of all ERP data flows through the add-on, evaluate alternative products or architectural changes to isolate this risk, and establish a firm timeline with Soft Solutions for patch release or determine if permanent decommissioning of the add-on is necessary.

Priority Portal Generator CVE-2026-59500

EUVD-2026-57761 CRITICAL

Improper Authentication (CWE-287)

2026-08-13 INCD

GHSA-92r7-4vj2-gcc6

Authentication Bypass Priority Portal Generator Addon To Priority Erp Developed By Soft Solutions

10.0

CVSS 3.1 · Vendor: INCD

Severity by source

Vendor (INCD) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

10.0 CRITICAL

Improper authentication on an internet-facing portal gives unauthenticated network access (AV:N/PR:N/UI:N/AC:L); the portal fronts the ERP data plane, justifying scope change with high C/I and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (INCD).

CVSS VectorVendor: INCD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 09:51 vuln.today

CVE Published

Aug 13, 2026 - 09:18 cve.org

CRITICAL 10.0

DescriptionCVE.org

CWE-287: Improper Authentication

AnalysisAI

Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote unauthenticated attackers reach protected portal functionality and, because of a scope change, the underlying ERP data it fronts. The maximum CVSS 10.0 rating reflects network reach, no privileges, and high confidentiality and integrity impact. Reported to Israel's INCD; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.

Technical ContextAI

The affected component is a Portal Generator add-on that builds customer/vendor/employee web portals on top of Priority ERP, an ERP platform widely used in the Israeli market. The root cause is classed as CWE-287 (Improper Authentication), meaning the portal's authentication logic can be satisfied or circumvented by an actor who should not pass it - for example missing verification of a session, token, or identity claim. Because portals generated by this add-on expose ERP records and transactions to the internet, a flaw in the authentication gate directly translates to exposure of the ERP data plane. The single CPE provided (cpe:2.3:a:priority:portal_generator_addon_to_priority_erp_...) identifies the add-on itself as the vulnerable software rather than the Priority ERP core.

RemediationAI

No vendor-released patch identified at time of analysis and no fix version is present in the provided data, so verify the current advisory directly with Soft Solutions and via the INCD listing at https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 before deploying. As compensating controls until a patch is confirmed: restrict the generated portals to trusted networks or place them behind a VPN or IP allow-list (trade-off: breaks legitimate external portal users such as customers/vendors), put a WAF or reverse proxy in front to enforce authentication and monitor for anomalous access to portal endpoints (trade-off: WAF rules for an auth-bypass are hard to write precisely and may miss the exact bypass path), and disable or take offline any portals that are not strictly required to reduce the exposed attack surface (trade-off: loss of self-service functionality). Do not invent a version number - cite the exact fixed release only once Soft Solutions publishes it.