Manacle ERP CVE-2026-84147

Exploitation requires network reachability to the ERP application's file-upload API endpoint and that the upload target directory be web-accessible with script execution enabled - both are the default/design condition described in the CVE. No authentication, credentials, or user interaction are needed (PR:N/UI:N/AC:L), so any attacker who can reach the endpoint over the network can exploit it. The principal limiting factor is exposure and deployment scale rather than technical prerequisites: the product is a niche multi-tenant ERP, so realistic risk depends on whether a given instance is internet-facing or reachable from an attacker-controlled network segment, and on the underlying web stack correctly executing the uploaded file type.

Every signal that is present points to top-tier priority: the CVSS 4.0 base is 10.0 with AV:N/AC:L/AT:N/PR:N/UI:N and full high impact to both the vulnerable and subsequent systems (VC/VI/VA and SC/SI/SA all High), meaning network-reachable, low-complexity, unauthenticated exploitation with no user interaction and a scope-crossing impact. CWE-434 pre-auth file upload leading to RCE is historically among the most reliably weaponized bug classes and is well suited to automation. Counterbalancing signals are simply absent rather than reassuring: no EPSS probability, no CISA KEV entry, and no POC were provided, so 'no public exploit identified at time of analysis' - this reflects missing data, not confirmed low risk. There is no conflict between the CVSS vector and the description; both agree on unauthenticated remote access. The main uncertainty is real-world exposure: this is a niche vendor product, so mass exploitation is less likely than targeted attacks against known deployments, but any internet-exposed instance should be treated as critical.

An attacker scans for internet-exposed Manacle ERP instances and sends an unauthenticated HTTP POST to the file-upload API, submitting a server-executable web shell with no valid credentials. Because the endpoint neither checks authentication nor validates file type, the shell lands in a web-accessible directory; the attacker then requests its URL to execute commands and take over the server. No public POC is referenced, but the attack requires only a standard HTTP client and low skill given the CVSS AC:L rating.