CVE-2026-14807 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-14807 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-14807 is a hard-coded credentials vulnerability in the ERP application developed by PROG MIS, allowing unauthenticated remote attackers to access the application and its underlying database without valid user-supplied credentials.

Technical Detail

The PROG MIS ERP application contains static, embedded credentials that are compiled into the application code and cannot be changed through normal configuration. An unauthenticated remote attacker can use these hard-coded credentials to log in to the application, view application source code, and retrieve database account credentials, including passwords. Successful exploitation provides an attacker with direct access to sensitive business data stored in the backend database and may enable further lateral movement or full database compromise depending on the database account privileges associated with the exposed credentials.

Exploitation Status

No known exploit code has been publicly observed or documented at this time. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Despite the absence of confirmed exploitation, the nature of hard-coded credentials requires no specialized tooling or prior access, meaning the barrier to exploitation is effectively zero for any attacker who identifies the target system.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this CVE in available intelligence sources.

What To Do

Contact PROG MIS immediately to obtain a patched version of the ERP application that removes or replaces the hard-coded credentials. If a patch is not yet available, restrict network access to the ERP application to trusted IP ranges only, and place the application behind a VPN or network access control layer to prevent unauthenticated internet-facing exposure. Audit all database accounts accessible from the ERP application and rotate any credentials that may have been exposed. Review application and database access logs for any unauthorized login activity, particularly from unfamiliar source addresses or at unusual times. Given the CVSS score of 9.8 and the trivial exploitation path, this should be treated as a high-priority remediation item regardless of current KEV status.