CVE-2024-14037 -- CVSS 9.8 Vulnerability Briefing

CVE-2024-14037 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2024-14037 is an arbitrary file upload vulnerability in Redsea Cloud eHR, a cloud-based human resources management platform, exposed through the unauthenticated PtFjk.mob servlet endpoint.

Technical Detail

The flaw exists in the PtFjk.mob servlet, which accepts file uploads without requiring authentication and without enforcing adequate file type or content validation. An unauthenticated remote attacker can upload a malicious file, such as a web shell or server-side executable, to a location accessible on the server. Successful exploitation results in unauthenticated remote code execution (RCE) under the privileges of the application server process, granting the attacker full control of the underlying host.

Exploitation Status

No known exploit code has been publicly observed or confirmed as of July 9, 2026. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No proof-of-concept or operational exploit has been documented at this time, though the low attack complexity and lack of authentication requirement make this a high-priority candidate for exploitation if details become more widely known.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with exploitation of this vulnerability.

What To Do

Organizations running Redsea Cloud eHR should contact the vendor immediately to obtain a patched version or security advisory, as no public patch details are confirmed available at this time. As an interim measure, restrict network access to the PtFjk.mob servlet endpoint at the perimeter firewall or web application firewall (WAF) level, blocking unauthenticated external requests to that path. Monitor web server and application logs for unexpected POST requests to the PtFjk.mob endpoint, particularly those uploading executable file types. Given the critical CVSS score of 9.8 and the unauthenticated RCE impact, this should be treated as a high-priority remediation item regardless of current exploitation status.