What is the CVSS score of EUVD-2026-57774?

EUVD-2026-57774 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Priority Portal Generator are affected by EUVD-2026-57774?

The Portal Generator add-on for Priority ERP contains hard-coded embedded credentials allowing unauthenticated remote attackers to bypass authentication and access sensitive business data across…

How to fix or mitigate EUVD-2026-57774?

Within 24 hours, immediately disable or isolate the Portal Generator add-on from internet-facing access and audit authentication logs to identify any prior unauthorized access. Within 7 days, if disabling is operationally infeasible, restrict network access to the add-on via mandatory VPN and IP whitelisting, deploy web application firewall rules to block suspicious access patterns, and establish real-time alerting on authentication anomalies. Within 30 days, confirm with Soft Solutions that no vendor-released patch is available, complete a comprehensive data-access audit to determine if any breach occurred, and execute a migration plan to either replace the add-on with a properly-authenticated portal solution or maintain permanent network-layer access controls if business-critical.

Priority Portal Generator EUVD-2026-57774

| CVE-2026-59507 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-08-13 INCD

GHSA-rvcg-vrwp-2mh2

Authentication Bypass Priority Portal Generator Addon To Priority Erp Developed By Soft Solutions

9.3

CVSS 3.1 · Vendor: INCD

Severity by source

Vendor (INCD) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

9.3 CRITICAL

Hard-coded credentials grant unauthenticated remote access (AV:N/AC:L/PR:N/UI:N); scope changes to the ERP (S:C) with high confidentiality and limited integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (INCD).

CVSS VectorVendor: INCD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 10:19 vuln.today

CVE Published

Aug 13, 2026 - 09:44 cve.org

CRITICAL 9.3

DescriptionCVE.org

CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control

AnalysisAI

Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solutions) allows remote, unauthenticated attackers to access the portal and read sensitive information belonging to other users or the underlying ERP. Reported by the Israel National Cyber Directorate (INCD) and rated CVSS 9.3, the flaw combines embedded static credentials (CWE-798), sensitive-information exposure (CWE-200), and improper access control (CWE-284). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the Portal Generator add-on that extends Priority ERP, a business/ERP platform, by exposing web portal functionality (customer, supplier, or employee portals). The root cause class is CWE-798 (Use of Hard-coded Credentials): credentials embedded in the product let anyone who knows or recovers them authenticate, which in turn drives the CWE-284 improper access control and CWE-200 information exposure. Because the CVSS scope is Changed (S:C), the vulnerable portal component can be leveraged to reach data or resources managed by the broader ERP beyond the add-on's own security authority. The only affected product identified is cpe:2.3:a:priority:portal_generator_addon_to_priority_erp_(developed_by_soft_solutions), with no version boundaries published in the CPE.

RemediationAI

No vendor-released patch or fixed version has been identified at time of analysis; consult the Israeli government advisory listing (https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing) and contact Soft Solutions directly for a patched build of the Portal Generator add-on. Because the flaw stems from hard-coded credentials, prioritize rotating or disabling any static or default accounts if the vendor exposes a mechanism to do so. As compensating controls until a fix is available, restrict network access to the portal by placing it behind a VPN or IP allow-list and blocking direct internet exposure of the portal endpoint (trade-off: this reduces legitimate external customer or supplier access), and monitor portal authentication logs for logins using unexpected or shared accounts. Where the Portal Generator functionality is not in use, disable the add-on entirely to remove the exposure.