What is the CVSS score of CVE-2026-59506?

CVE-2026-59506 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Which versions of Priority ERP are affected by CVE-2026-59506?

Portal Generator Addon for Priority ERP contains a critical authentication bypass (CVE-2026-59506) allowing unauthenticated remote access to sensitive ERP data.

How to fix or mitigate CVE-2026-59506?

Within 24 hours: Inventory all Priority ERP installations with the Portal Generator Addon enabled and assess network exposure; immediately restrict network access to the affected systems using firewalls or network segmentation. Within 7 days: Contact Soft Solutions for emergency security guidance, patch timeline, and interim mitigation options; implement intrusion detection rules to monitor for exploitation attempts targeting the vulnerable endpoint. Within 30 days: Deploy compensating controls (WAF rules, IP whitelisting, network isolation) and plan migration to a patched version once available from the vendor; conduct forensic review of access logs to detect any prior unauthorized access.

Priority ERP CVE-2026-59506

EUVD-2026-57773 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-13 INCD

GHSA-pvm5-r2q8-332c

Authentication Bypass Priority Portal Generator Addon To Priority Erp Developed By Soft Solutions

9.3

CVSS 3.1 · Vendor: INCD

Severity by source

Vendor (INCD) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

9.3 CRITICAL

Missing authentication on a network-reachable critical function gives unauthenticated network access (AV:N/AC:L/PR:N/UI:N); it exposes ERP-backend data across a trust boundary (S:C, C:H) with limited integrity and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (INCD).

CVSS VectorVendor: INCD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 10:17 vuln.today

CVE Published

Aug 13, 2026 - 09:41 cve.org

CRITICAL 9.3

DescriptionCVE.org

CWE-306: Missing Authentication for Critical Function

AnalysisAI

Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauthenticated attackers to invoke a critical function that should be gated behind authentication, exposing sensitive ERP data. Rated CVSS 9.3 with a scope change, the flaw stems from a missing authentication check (CWE-306) on a network-reachable function. It was reported by Israel's National Cyber Directorate (INCD); no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a third-party 'Portal Generator' add-on that extends Priority ERP - a business/enterprise resource planning platform - by generating web-facing portals. The single CPE identifies the vulnerable software as 'priority portal_generator_addon_to_priority_erp (developed by soft solutions)'. The root cause is CWE-306 (Missing Authentication for Critical Function): a function or endpoint that performs a security-relevant action is reachable over the network without any authentication or session check. Because the CVSS scope is marked Changed (S:C), the vulnerable add-on can act on resources belonging to the underlying ERP's security authority - i.e., bypassing the add-on's auth exposes data managed by the ERP backend rather than only the add-on itself.

RemediationAI

No vendor-released patched version is identified in the available data; the only reference is the INCD advisory listing (https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing), so administrators should contact Soft Solutions / their Priority ERP integrator directly for a fixed build and apply it as the primary fix. As compensating controls until a patch is confirmed: restrict network reachability of the portal-generator endpoints to trusted networks or place them behind a VPN/reverse proxy that enforces authentication (side effect: legitimate external portal users lose direct access and must authenticate at the proxy); if the portal functionality is not in active use, disable or unpublish the Portal Generator Addon entirely (side effect: any generated portals go offline); and monitor web logs for anonymous requests to portal-generator functions as a detection stopgap. Avoid exposing the add-on to the public internet while the fix is pending.