Critical · CVSS 9.4CVE-2026-112197

Missing Authentication for Critical Function in Tactis' NoviGest Desktop AppCVE-2026-112197

Answer in brief

CVE-2026-112197 records a Critical severity (CVSS 9.4) vulnerability in Missing Authentication for Critical Function in Tactis' NoviGest Desktop App. The current sources do not mark it as known exploited. The current feed maps Tactis/NoviGest Desktop App (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 28, 2026Updated Oct 28, 2026Source checked Oct 28, 2026First seen by HOL Oct 28, 2026Material review Oct 28, 2026

Upstream Advisory

Key facts

Risk: Critical · CVSS 9.4
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 9.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Tactis/NoviGest Desktop App (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Tactis/NoviGest Desktop Appgeneric	NoviGest Desktop App prior to version 8.0.0-300	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Tactis/NoviGest Desktop App.
Review the reported fix. Source-reported solution: Update the NoviGest Desktop App to version 8.0.0-300, in which the vendor confirms that the vulnerabilitie have been fixed. For CVE-2026-112197, remote methods that access data require a JWT session token validated on the server. Interfaces that exposed credentials and allowed arbitrary SQL execution have been removed, and the privileges of the PostgreSQL account have been reduced to prevent program execution and access to server files.

Evidence timeline and material changes

Published upstream
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 28, 2026

Sources and claim methodology

Source referenceincibe.es

Upstream source description

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.

Quoted source text, attributed separately from HOL analysis.