What is the CVSS score of CVE-2026-59505?

CVE-2026-59505 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Priority ERP Portal are affected by CVE-2026-59505?

The Portal Generator Addon for Priority ERP contains an unauthenticated authentication bypass (CVE-2026-59505, CVSS 8.6) allowing remote attackers to access confidential business data-financial…

How to fix or mitigate CVE-2026-59505?

Within 24 hours: contact Soft Solutions to confirm patch status and immediately implement network access controls (firewall rules, VPN-only access) restricting the Portal Generator component. Within 7 days: either apply a vendor-released patch when available or deploy interim compensating controls including network segmentation isolating the Portal Generator, comprehensive access logging with alerting on data queries, and temporary addon disablement if business operations permit. Within 30 days: achieve full remediation either through patch application or architectural redesign eliminating unauthenticated backend access.

Priority ERP Portal CVE-2026-59505

EUVD-2026-57772 HIGH

Improper Access Control (CWE-284)

2026-08-13 INCD

GHSA-mjh9-vwm5-6mxf

Authentication Bypass Priority Portal Generator Addon To Priority Erp Developed By Soft Solutions

8.6

CVSS 3.1 · Vendor: INCD

Severity by source

Vendor (INCD) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Network-accessible portal with authentication bypass yields PR:N and AV:N; scope change reflects ERP backend trust boundary; C:H for ERP data read; I:N and A:N as description implies read-only unauthorized access.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (INCD).

CVSS VectorVendor: INCD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 10:17 vuln.today

CVE Published

Aug 13, 2026 - 09:36 cve.org

HIGH 8.6

DescriptionCVE.org

CWE-284: Improper Access Control

AnalysisAI

Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers with no credentials to access confidential ERP data across a scope boundary. Carrying a CVSS 3.1 score of 8.6 with Scope Changed and High Confidentiality impact, the flaw exposes the underlying Priority ERP backend through the portal layer - meaning business-critical records such as financial data, customer information, or operational records may be readable without any authentication. No public exploit code and no CISA KEV listing exist at time of analysis, but the attack profile (AV:N/AC:L/PR:N/UI:N) means exploitation requires minimal sophistication from any network position.

Technical ContextAI

The affected product is the Portal Generator Addon to Priority ERP, a web portal generation component built by Soft Solutions on top of the Priority ERP platform (CPE: cpe:2.3:a:priority:portal_generator_addon_to_priority_erp_(developed_by_soft_solutions):*:*:*:*:*:*:*:*). Priority ERP is an enterprise resource planning suite with significant market presence in Israel and the Middle East. CWE-284 (Improper Access Control) indicates the portal component fails to enforce proper authentication or authorization checks at an access boundary - categorized explicitly under the 'Authentication Bypass' tag. The CVSS Scope Change (S:C) reflects that the portal addon acts as a trusted gateway to the ERP backend: bypassing the portal's access controls propagates unauthorized access into the broader ERP system, affecting a security domain beyond the addon itself.

RemediationAI

No specific patched version was identified in the available data - affected version scope spans all known versions per the CPE wildcard. Organizations should contact Soft Solutions directly for a patched release and monitor the INCD advisory listing at https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 for an updated advisory. As an immediate compensating control, restrict network access to the portal to trusted IP ranges or VPN-only paths - this directly counters the AV:N/PR:N attack vector, though it will reduce external user accessibility to the portal. If the portal addon is not operationally critical, temporarily disabling it eliminates the attack surface entirely until a patch is confirmed. Additionally, audit recent portal access logs for unauthenticated or anomalous requests that may indicate prior exploitation. Vendor-released patch status is not independently confirmed at time of analysis.