Skip to main content

Priority Portal Generator CVE-2026-59507

| EUVDEUVD-2026-57774 CRITICAL
Use of Hard-coded Credentials (CWE-798)
2026-08-13 INCD GHSA-rvcg-vrwp-2mh2
Authentication Bypass Portal Generator Addon To Priority Erp Developed By Soft Solutions
9.3
CVSS 3.1 · Vendor: INCD
Share

Severity by source

Vendor (INCD) PRIMARY
9.3 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
vuln.today AI
9.3 CRITICAL

Hard-coded credentials grant unauthenticated remote access (AV:N/AC:L/PR:N/UI:N); scope changes to the ERP (S:C) with high confidentiality and limited integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (INCD).

CVSS VectorVendor: INCD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 13, 2026 - 10:19 vuln.today
CVE Published
Aug 13, 2026 - 09:44 cve.org
CRITICAL 9.3

DescriptionCVE.org

CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control

AnalysisAI

Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solutions) allows remote, unauthenticated attackers to access the portal and read sensitive information belonging to other users or the underlying ERP. Reported by the Israel National Cyber Directorate (INCD) and rated CVSS 9.3, the flaw combines embedded static credentials (CWE-798), sensitive-information exposure (CWE-200), and improper access control (CWE-284). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network reachability to a deployed Priority ERP instance running the Soft Solutions Portal Generator add-on with its web portal exposed; the attacker must know or recover the hard-coded credentials embedded in the product. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, base 9.3) describes a remotely reachable, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality impact, limited integrity impact, and no availability impact - consistent with an unauthenticated authentication bypass whose primary consequence is data exposure rather than full system compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch or fixed version has been identified at time of analysis; consult the Israeli government advisory listing (https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing) and contact Soft Solutions directly for a patched build of the Portal Generator add-on. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, immediately disable or isolate the Portal Generator add-on from internet-facing access and audit authentication logs to identify any prior unauthorized access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Portal Generator Addon To Priority Erp Developed By Soft Solutions

View all
CVE-2026-59500 CRITICAL
10.0 Aug 13

Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote
CVE-2026-59506 CRITICAL
9.3 Aug 13

Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauth
CVE-2026-59504 CRITICAL
9.1 Aug 13

Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allo
CVE-2026-59503 CRITICAL
9.1 Aug 13

Unauthenticated sensitive information disclosure in the Portal Generator Addon to Priority ERP (developed by Soft Soluti
CVE-2026-59505 HIGH
8.6 Aug 13

Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows
CVE-2026-59499 HIGH
8.6 Aug 13

Unauthenticated remote information disclosure in the Portal Generator Addon for Priority ERP (developed by Soft Solution
CVE-2026-59501 HIGH
8.2 Aug 13

Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions
CVE-2026-59502 MEDIUM
5.3 Aug 13

Observable discrepancy exposure in the Priority Portal Generator Addon to Priority ERP (developed by Soft Solutions) ena

Same weakness CWE-798 – Use of Hard-coded Credentials

View all
CVE-2016-1560 CRITICAL POC
9.8
CVE-2017-14143 CRITICAL POC
9.8
CVE-2026-22769 CRITICAL
10.0
CVE-2016-5678 CRITICAL POC
9.8
CVE-2017-6558 CRITICAL POC
9.8
CVE-2015-7246 CRITICAL POC
9.8
CVE-2015-4667 CRITICAL POC
9.8
CVE-2016-10177 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-59507 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy