NoviGest Desktop App EUVD-2026-111991

The attacker needs network reachability to the NoviGest Desktop App's Java RMI service port. Per the description, the critical RMI methods lack authentication, so no credentials are required to invoke them and obtain stored credentials; however, the supplied CVSS 4.0 vector asserts PR:L, so the authentication requirement is not confirmed from the available data and should be verified with the vendor. Full impact (OS command execution) depends on the described deployment reality that the PostgreSQL account used by the application holds elevated privileges - if the database account were restricted, the SQL-to-OS-command escalation would be limited. Exploitation requires no user interaction (UI:N) and no special attack conditions (AT:N). The main limiting factor is exposure: the RMI service must be network-accessible to the attacker rather than bound to localhost or firewalled.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The vuln.today decision label is act_now, the CVSS 4.0 base score is 9.4, and the mechanism - a Java RMI service exposing critical functions with no authentication (CWE-306) - is directly stated in the description, not merely inferred from metrics. The CVSS 4.0 vector is AV:N/AC:L/AT:N, meaning network-reachable, low-complexity exploitation with no special attack requirements, and all six impact metrics (VC/VI/VA and subsequent-system SC/SI/SA) are High, reflecting the described chain from credential disclosure to arbitrary SQL to OS command execution on the server. There is a notable conflict to verify: the supplied CVSS vector sets PR:L (implying some privilege/authentication), yet the description explicitly states the attacker can 'invoke remote methods without authentication' - the vector and the description disagree on privilege requirements, and the description's PR:N reading would raise real risk further; verify with INCIBE/vendor. No EPSS score is provided, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public exploit is referenced, so there is no evidence of active exploitation; the elevated priority rests on the act_now decision label and the severity/mechanism, not on observed in-the-wild use.

An attacker with network access to the NoviGest Desktop App's Java RMI endpoint invokes exposed remote methods without authentication to retrieve stored credentials, then uses those credentials to run arbitrary SQL against the PostgreSQL backend. Because the database account is over-privileged, the attacker chains SQL execution into operating-system command execution on the server, fully compromising it. No public exploit code is identified at time of analysis, but the described steps require no special tooling.