Priority Portal Generator CVE-2026-59507

Exploitation requires network reachability to a deployed Priority ERP instance running the Soft Solutions Portal Generator add-on with its web portal exposed; the attacker must know or recover the hard-coded credentials embedded in the product. Per the CVSS vector (PR:N/UI:N/AC:L), no prior authentication, no user interaction, and no elevated privileges are needed once those credentials are known. Exploitation is limited by the narrow deployment of this specific add-on and by whether the portal is externally reachable - installations restricted to internal networks or behind a VPN substantially reduce exposure. Impact is primarily confidentiality (C:H) with only limited integrity effect (I:L) and no availability impact.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, base 9.3) describes a remotely reachable, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality impact, limited integrity impact, and no availability impact - consistent with an unauthenticated authentication bypass whose primary consequence is data exposure rather than full system compromise. Hard-coded credentials are typically trivially and reliably exploitable once disclosed, so the low attack complexity is credible. However, no EPSS score, no SSVC decision, no POC, and no CISA KEV entry were provided, so there is no evidence of active or automatable exploitation at this time; the high base score reflects potential impact and ease of use, not confirmed in-the-wild activity. Real-world risk is therefore gated more by the product's limited deployment footprint (a niche Israeli ERP add-on) than by exploit difficulty - high impact where deployed, but narrow exposure overall.

A remote attacker who obtains the embedded static credentials - through reverse engineering, documentation, or reuse across installations - sends a normal authentication request to an internet-exposed Priority portal and is granted access without any legitimate account. With low attack complexity and no user interaction required, they then browse and exfiltrate sensitive ERP-managed data such as customer, supplier, or business records exposed through the portal. No public exploit code has been identified at time of analysis.