Priority ERP Portal CVE-2026-59501

The Portal Generator Addon for Priority ERP must be installed, enabled, and network-accessible - either internet-facing or reachable from an attacker-controlled network position. The CVSS vector PR:N/UI:N/AV:N/AC:L confirms no authentication is required and no victim interaction is needed, meaning exploitation is possible against default-accessible deployments of this addon without any special victim-side configuration. Limiting factors include: the addon must actually be deployed (it is a separately developed third-party component, not the core Priority ERP product), and the portal must be reachable by the attacker over the network. Organizations that have not installed this specific addon, or that have it deployed only on isolated internal segments without external exposure, are not directly at risk from remote exploitation.

The CVSS 3.1 base score of 8.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N presents several compounding risk factors: network accessibility with no authentication requirement and low attack complexity collectively indicate a straightforward, automatable attack. The confidentiality impact is rated High, which for an ERP system could mean exposure of financially sensitive, operational, or personally identifiable business records. Integrity impact is Low, suggesting some level of unauthorized data modification is possible but not unconstrained. No EPSS score was provided in the input, limiting probabilistic exploitation forecasting. The vulnerability is NOT in CISA KEV, and no POC availability is noted in the provided data. Despite the absence of confirmed exploitation evidence, the combination of PR:N, AV:N, AC:L, and the ERP context (which typically holds high-value business data) makes this a genuine priority for organizations running Priority ERP with this addon exposed to the internet or internal network. EPSS and KEV absence reduces urgency compared to actively exploited peers, but should not be taken as absence of attacker interest in ERP authentication bypasses, which are historically targeted.

An unauthenticated remote attacker with network access to the Priority ERP portal identifies the web-accessible Portal Generator Addon endpoint and sends crafted HTTP requests that bypass authentication or access control checks. The attacker gains unauthorized read access to ERP business records - such as financial data, customer records, or operational logs - and may perform limited unauthorized writes. No POC code has been identified in the provided data, but the low attack complexity (AC:L) implies exploitation does not require advanced tooling or specialized knowledge.