What is the CVSS score of EUVD-2026-57768?

EUVD-2026-57768 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Priority ERP Portal are affected by EUVD-2026-57768?

The Portal Generator Addon for Priority ERP contains an unauthenticated remote access control bypass (CVE-2026-59501, CVSS 8.2) that allows attackers to circumvent authentication and access sensitive…

How to fix or mitigate EUVD-2026-57768?

Within 24 hours, inventory all Priority ERP instances running the Portal Generator Addon and assess network accessibility; immediately restrict Portal Generator portal endpoints to internal-only access via trusted IP ranges and disable any public internet routing to these URLs. Within 7 days, deploy enhanced monitoring including comprehensive logging of all authentication attempts and access events to the Portal Generator Addon, implement network segmentation to isolate Priority ERP systems from critical business networks, and contact Soft Solutions directly for patch timeline and interim recommendations. Within 30 days, coordinate with Soft Solutions for patch release, conduct forensic review of access logs to detect any unauthorized access during the vulnerability exposure period, and execute expedited testing and deployment of the vendor patch once available.

Priority ERP Portal EUVD-2026-57768

| CVE-2026-59501 HIGH

Improper Access Control (CWE-284)

2026-08-13 INCD

GHSA-6jj4-v58m-mhvw

Authentication Bypass Priority Portal Generator Addon To Priority Erp Developed By Soft Solutions

8.2

CVSS 3.1 · Vendor: INCD

Severity by source

Vendor (INCD) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Network-accessible authentication bypass with no privileges or interaction needed; high confidentiality exposure of ERP data, limited integrity, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (INCD).

CVSS VectorVendor: INCD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 10:15 vuln.today

CVE Published

Aug 13, 2026 - 09:24 cve.org

HIGH 8.2

DescriptionCVE.org

CWE-284: Improper Access Control

AnalysisAI

Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions) enables network-accessible exploitation with no authentication or user interaction required. The flaw, classified as CWE-284 Improper Access Control and tagged explicitly as an Authentication Bypass, allows attackers to circumvent access restrictions, resulting in high-impact confidentiality exposure and limited data integrity impact against affected ERP portal deployments. Reported by the Israel National Cyber Directorate (INCD), no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Technical ContextAI

The affected component is the Portal Generator Addon for Priority ERP, a business enterprise resource planning platform, with the addon developed by a third party named Soft Solutions. The CPE identifier cpe:2.3:a:priority:portal_generator_addon_to_priority_erp_(developed_by_soft_solutions):*:*:*:*:*:*:*:* covers all versions with no bounded version range, indicating a broad scope of affected releases. CWE-284 (Improper Access Control) describes a class of flaws where the software does not restrict or incorrectly restricts access to a resource from an unauthorized actor - in the context of a web-facing ERP portal, this typically manifests as missing or bypassable authentication gates on portal endpoints, allowing API or page-level access without valid session credentials. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the vulnerability is exploitable remotely over the network with low complexity and no privileges, consistent with an authentication bypass on a web-accessible portal front end.

RemediationAI

Consult the INCD advisory at https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 for official guidance; no specific patched version number was confirmed in the available input data, and a patch version cannot be independently cited without vendor release information. As an immediate compensating control, organizations should restrict network access to the Portal Generator Addon endpoints using firewall rules or reverse-proxy ACLs, limiting exposure to trusted IP ranges only - this directly reduces the AV:N attack surface to a more bounded population. If the portal functionality is not operationally required, disabling or undeploying the addon eliminates the attack surface entirely. For environments where the portal must remain active, enabling additional authentication at the web application layer (e.g., WAF-enforced authentication, VPN-gating the portal URL) can compensate until a vendor patch is applied. Contact Soft Solutions directly for a patched release, as no fix version is confirmed by the available intelligence.