What is the CVSS score of EUVD-2026-42583?

EUVD-2026-42583 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.6%.

Which versions of Xerte Online Tools are affected by EUVD-2026-42583?

Xerte Online Tools versions below 3.14.6 and 3.15.5 are vulnerable to unauthenticated remote code execution through an exposed installer endpoint, allowing attackers to seize complete control of the…. A patch is available.

How to fix or mitigate EUVD-2026-42583?

Within 24 hours: Audit all Xerte Online Tools instances to identify which are running versions below 3.14.6 (3.14.x branch) or 3.15.5 (3.15.x branch); implement firewall or WAF rules to restrict external access to the /setup/ endpoint. Within 7 days: Deploy vendor patch by upgrading affected instances to version 3.14.6 or 3.15.5 or later as applicable. Within 30 days: Review application and database logs for exploitation attempts targeting /setup/; audit credentials, user accounts, and configuration changes for evidence of unauthorized access during the vulnerable window.

Xerte Online Tools EUVD-2026-42583

| CVE-2026-14261 CRITICAL

2026-07-09 certcc

GHSA-3g88-3v3g-pch4

Authentication Bypass RCE Xerte Online Tools Xerte

9.1

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.8 CRITICAL

Unauthenticated network access to the reachable /setup/ installer (PR:N/AC:L/AV:N) yields full application takeover; reinstalling against an attacker DB compromises confidentiality, integrity and availability of the instance.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 16:50 vuln.today

Severity Changed

Jul 09, 2026 - 16:22 NVD

HIGH CRITICAL

CVSS changed

Jul 09, 2026 - 16:22 NVD

7.5 (HIGH) 9.1 (CRITICAL)

Patch available

Jul 09, 2026 - 15:01 EUVD

CVE Published

Jul 09, 2026 - 12:37 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to reinstall the service to a remote database they control.

AnalysisAI

Authentication bypass leading to remote code execution in Xerte Online Tools (all versions below 3.14.6 and below 3.15.5) lets unauthenticated remote attackers reach the exposed /setup/ installer and re-run the installation, pointing the application at a database they control and thereby seizing full control of the toolkit. The flaw scores CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) and is tagged Authentication Bypass and RCE; a vendor patch exists but there is no public exploit identified at time of analysis. CISA's SSVC framework rates it not-exploited but automatable with partial technical impact.

Technical ContextAI

Xerte Online Tools is an open-source, PHP-based e-learning content authoring and delivery framework (CPE cpe:2.3:a:xerte:xerte_online_tools) widely used in the education sector to build interactive learning objects. The vulnerability lives in the /setup/ installer directory, which on a hardened deployment should be removed or blocked after initial installation but here remains reachable and callable without authentication. Reachable installer logic is a classic exposed-setup / improper-access-control weakness (no CWE was assigned in the source data): the installer re-initializes application configuration - including the backend database connection - so an attacker who can invoke it can redirect the instance to an external database of their choosing, which in turn enables code execution paths and full application compromise. The fix is delivered in commit 8fec6602e80c5d35903d65e65b65b794297d8e90.

RemediationAI

Vendor-released patch: upgrade to Xerte Online Tools 3.15.5 (for 3.15.x deployments) or 3.14.6 (for 3.14.x deployments), which contain the fix from commit 8fec6602e80c5d35903d65e65b65b794297d8e90; follow the official guidance at https://www.xerte.org.uk/index.php/en/news/blog/80-news/364-xerte-3-14-and-3-15-important-security-update. Where immediate patching is not possible, delete or rename the /setup/ directory on production instances after installation, or block/deny web access to the /setup/ path at the web server or reverse-proxy layer (e.g. an nginx/Apache location deny rule) and restrict it to trusted admin source IPs - the trade-off is that legitimate reinstallation or upgrade steps will then require temporarily restoring that access. As defense in depth, ensure the application database credentials are not writable by the web process and monitor for unexpected changes to the database configuration.