What is the CVSS score of EUVD-2026-57770?

EUVD-2026-57770 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Portal Generator Addon are affected by EUVD-2026-57770?

Priority ERP's Portal Generator Addon (Soft Solutions) contains a critical unauthenticated remote vulnerability (CVE-2026-59503, CVSS 9.1) enabling unrestricted access to sensitive personal and…

How to fix or mitigate EUVD-2026-57770?

Within 24 hours, identify all systems running Priority ERP with Portal Generator Addon, assess network exposure, and offline affected portals or restrict access to internal networks only. Within 7 days, contact Soft Solutions directly for security guidance and hotfix status, document current deployment counts and data scope, and implement network segmentation blocking unauthenticated external access to portal components. Within 30 days, evaluate vendor-released security updates if available, establish timeline for patching or replacement if no patch emerges, and conduct access log forensics to detect unauthorized retrieval attempts dating back to deployment.

Portal Generator Addon EUVD-2026-57770

| CVE-2026-59503 CRITICAL

Information Exposure (CWE-200)

2026-08-13 INCD

GHSA-w88w-7hjf-77f6

Information Disclosure Priority Portal Generator Addon To Priority Erp Developed By Soft Solutions

9.1

CVSS 3.1 · Vendor: INCD

Severity by source

Vendor (INCD) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote, low-complexity data exposure justifies AV:N/AC:L/PR:N/C:H; integrity set to N because CWE-200/359 describe read-only disclosure, contradicting the input's I:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (INCD).

CVSS VectorVendor: INCD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 10:15 vuln.today

CVE Published

Aug 13, 2026 - 09:30 cve.org

CRITICAL 9.1

DescriptionCVE.org

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

AnalysisAI

Unauthenticated sensitive information disclosure in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve private personal and business data without credentials or user interaction. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) and reported by Israel's National Cyber Directorate (INCD), the flaw combines CWE-200 and CWE-359 exposure classes. No public exploit identified at time of analysis, and the product has a primarily Israeli deployment footprint.

Technical ContextAI

The affected component is the Portal Generator Addon, an extension that builds web-facing customer/vendor portals on top of Priority ERP (a widely used Israeli enterprise resource planning platform), developed by third-party integrator Soft Solutions. The single affected CPE is cpe:2.3:a:priority:portal_generator_addon_to_priority_erp_(developed_by_soft_solutions). The root-cause class, CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) refined by CWE-359 (Exposure of Private Personal Information), indicates the portal serves protected data - likely PII drawn from ERP records such as customer, HR, or financial tables - to actors who should not have access. Because portal generators expose ERP data through customizable web endpoints, such flaws typically stem from missing authorization checks, direct object references, or endpoints returning more data than the authenticated context should permit.

RemediationAI

No vendor-released patch or fixed version was identified in the available data, so a specific upgrade target cannot yet be cited - monitor Soft Solutions and the INCD advisory listing (https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing) for the fixed release and apply it once published. As compensating controls until a patch is available: restrict network exposure of the portal by placing it behind a VPN or IP allowlist so it is not reachable by anonymous internet clients (trade-off: breaks self-service access for external customers/vendors); enforce authentication and authorization at a reverse proxy or WAF in front of the portal endpoints, blocking unauthenticated requests to data-returning URLs (trade-off: may require mapping legitimate anonymous paths); and audit web/application logs for anomalous bulk data retrieval from portal endpoints. Contact Soft Solutions or your Priority ERP integrator directly to confirm affected versions and remediation, given the third-party addon nature of the component.