{"id":"CVE-2026-3014","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-3014","generatedAt":"2026-10-28T01:44:56.348Z","title":"Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API.","description":"Milestone\nhas released a new version of XProtect® (and several cumulative patch updates)\nwhich fix security vulnerability in Management Server API.\n\n\n\nThe vulnerability\ncauses users with edit permissions to the Management Server to be able to\nexecute arbitrary code in context of the Management Server Service.","published":"2026-07-14T10:16:33.000Z","lastModified":"2026-10-24T21:10:00.000Z","status":"Awaiting Analysis","sourceIdentifier":"cf45122d-9d50-442a-9b23-e05cde9943d8","cvss":{"version":"4.0","score":6.4,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-78"],"affected":[],"epss":{"score":0.00782,"percentile":0.55702,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.78%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://doc.milestonesys.com/en-US/bundle/sec1504_latest/page/milestone_security_advisory_CVE-2026-3014_potential_remote_code_execution_by_admin_user_on_Management_Server.html","source":"cf45122d-9d50-442a-9b23-e05cde9943d8"},{"url":"https://support.milestonesys.com/article/CVE-2026-3014-potential-remote-code-execution-by-admin-user-on-Management-Server","source":"cf45122d-9d50-442a-9b23-e05cde9943d8"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-825228.html","source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-3014","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}