CVE-2026-14807: Hard-coded credentials in PROG MIS ERP App
| Field | Value |
|---|---|
| CVE ID | CVE-2026-14807 |
| CVSS score | 9.8 Critical |
| Attack vector | Remote, unauthenticated |
| Auth required | None |
| Patch status | No publicly verified patch or fixed version identified in retrieved sources |
TL;DR - Critical hard-coded credentials flaw in PROG MIS ERP App enables unauthenticated remote login. - Attackers may view application code and recover database credentials. - No verified fixed version is publicly available, so isolate exposed instances and rotate secrets now.
What is CVE-2026-14807?
CVE-2026-14807 is a critical vulnerability in the ERP App developed by PROG MIS. According to the NVD description, the issue is a use of hard-coded credentials weakness that allows an unauthenticated remote attacker to log in, view application code, and obtain the database account and password. That combination makes this more than a simple authentication bypass. It potentially hands an external attacker both application-level access and the credentials needed to reach backend data directly.
The practical risk is high because the attack requires no prior account and no local access. In an ERP environment, that often means a compromise can expose sensitive operational, customer, inventory, finance, or HR data depending on how the product is deployed. Even if the application itself is segmented, disclosed database credentials can create a second path into the environment if those credentials are over-privileged or reused.
The available primary-source material confirms the vulnerability, vendor, product, severity, and core impact. However, important implementation details are still unknown from the retrieved sources. Specifically, the public material reviewed does not provide a version range, a fixed version, a vendor patch bulletin, or exploit specifics such as the exact endpoint or hard-coded credential pair. Defenders should therefore assume that any internet-reachable or partner-reachable PROG MIS ERP App instance may be at risk until vendor guidance says otherwise.
CVSS score and why it matters
CVE-2026-14807 has a CVSS v3.x base score of 9.8, which places it in the Critical range. While the full vector string was not provided in the returned NVD record, the textual description strongly supports why the score is so high. The issue is remotely exploitable, requires no authentication, and exposes highly sensitive information. In many environments, database credential disclosure can rapidly turn into full data compromise.
A 9.8 score should influence prioritization, but practitioners should focus on the business context more than the number alone. This is an ERP application, which typically sits near high-value workflows and sensitive records. If the recovered database account has broad read or write access, a single successful exploitation attempt could enable data theft, fraud, tampering, or ransomware pre-positioning even without deploying malware to the application host.
The unknowns in the advisory do not reduce urgency. If anything, they increase the need for conservative handling. When version data, patch notes, and exploit details are missing, the safest assumption is that exposure could be wider than currently documented. Treat this as a containment and secrets-management problem, not just a future patching task.
Who is affected?
The confirmed affected product is PROG MIS ERP App. The NVD record and referenced TWCERT advisories identify the product and the vulnerability class, but the affected version range is not publicly specified in the retrieved source material. The most accurate statement defenders can currently make is that PROG MIS ERP App is affected, while exact version boundaries remain unknown.
That lack of version detail matters operationally. If your asset inventory only tracks application names and not exact builds, you should treat every deployed PROG MIS ERP App instance as potentially exposed until you can obtain a vendor statement or compare against a future fixed release. This is especially important for SMBs and regional businesses that may run ERP systems without centralized vulnerability management coverage or formal software bill of materials tracking.
The same limitation applies to remediation planning. A fixed version number was not identified in the NVD entry or the referenced TWCERT pages available for this task. Because no verifiable fixed version is currently available, defenders should avoid making assumptions such as “only legacy builds are affected” or “the latest release must be safe.” In the absence of data, assume exposure and reduce attack surface first.
| Scope | Status |
|---|---|
| Vendor | PROG MIS |
| Product | ERP App |
| Affected versions | Not publicly specified in retrieved sources |
| Fixed version | Not publicly specified in retrieved sources |
| Internet exposure risk | High if ERP App is reachable from untrusted networks |
Exploitation status
At the time of writing, there is no confirmed CISA KEV listing for CVE-2026-14807. The CVE is marked as not on KEV, which means there is no CISA-confirmed evidence of known exploitation in the wild from that catalog as of 2026-07-06. That is useful context, but it is not proof that exploitation has not occurred elsewhere.
No verified public proof of concept was identified in the materials provided for this task. Likewise, no GitHub repository, exploit write-up, or public demonstration was verified from the retrieved references. The correct practitioner takeaway is: exploitation in the wild is not confirmed by KEV, a public PoC is not currently verified from the retrieved sources, and defenders should still act quickly because the vulnerability is straightforward in concept and highly impactful if abused.
Because this is a hard-coded credential issue, exploitation may be quieter than memory-corruption or RCE flaws. An attacker may simply authenticate successfully and browse the application like a valid user. That makes the absence of public exploit chatter a weak comfort signal. If you operate this product, prioritize exposure reduction and credential rotation rather than waiting for broader threat intelligence.
Bottom line for defenders
CVE-2026-14807 should be treated as an urgent exposure-management issue. The combination of unauthenticated access, source-code visibility, and database credential disclosure creates a high-likelihood path to sensitive data compromise even without a public PoC. If you run PROG MIS ERP App, assume risk now, especially for any instance reachable from untrusted networks.
Because the currently retrieved sources do not specify affected versions or a fixed release, your immediate actions should be compensating controls and credential rotation rather than waiting for perfect patch guidance. Restrict network access, review logs and database activity, rotate ERP-related secrets, and be ready to deploy a vendor update as soon as PROG MIS publishes version-specific remediation.
For further reading on related vulnerabilities, check out our articles on CVE-2026-8760 and CVE-2026-10192.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
How to detect potential exploitation
Detection is difficult without vendor-specific indicators such as login endpoint names, default usernames, or exact application log formats. Still, security teams can build useful hunting coverage around the observable outcomes described in the advisory: unauthenticated remote login, application code viewing, and database credential access. Start by identifying all ERP App hosts and placing them under heightened monitoring for web access, authentication events, file access, and database connections.
Focus first on impossible or unexpected access patterns. If the ERP application is usually restricted to internal IPs, any successful session from external or unfamiliar networks deserves immediate review. If the application server suddenly begins making database connections from new processes, or if database authentication occurs from unusual source IPs shortly after web access to the ERP instance, treat that as a possible exploitation chain.
Also review whether the ERP web root, source directories, backup paths, or configuration files were accessed in ways that do not match normal administration. Since the advisory explicitly mentions viewing application code and obtaining the database account and password, defenders should watch for requests involving source files, export features, configuration endpoints, or pages that reveal backend settings.
Technical Notes
The exact logging schema for PROG MIS ERP App was not provided in the retrieved sources, so defenders should assume they need to rely on reverse proxy, web server, EDR, and database telemetry around the application host.
Example web server log patterns to investigate:
# Look for successful access from unexpected public IP space
<client_ip> - - [06/Jul/2026:08:xx:xx +0000] "POST /login HTTP/1.1" 200
<client_ip> - - [06/Jul/2026:08:xx:xx +0000] "GET /source HTTP/1.1" 200
<client_ip> - - [06/Jul/2026:08:xx:xx +0000] "GET /config HTTP/1.1" 200
Generic Splunk hunt for suspicious ERP exposure and follow-on activity:
(index=web OR index=proxy)
(host="*erp*" OR url="*erp*")
(method=POST OR method=GET)
(status=200 OR status=302)
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_ip, dest, uri_path, user_agent, status
| where cidrmatch("10.0.0.0/8", src_ip)=false AND cidrmatch("172.16.0.0/12", src_ip)=false AND cidrmatch("192.168.0.0/16", src_ip)=false
Generic database correlation hunt if you can tie web access to backend authentication:
(index=web host="*erp*") OR (index=db sourcetype IN ("mysql","mssql","postgres"))
| transaction maxspan=10m connected=false startswith=(index=web) endswith=(index=db)
| search "login" OR "authentication" OR "failed" OR "succeeded"
Linux triage on the application host for recent configuration and source access:
find /var/www /opt /srv -type f \( -name "*.php" -o -name "*.config" -o -name "*.env" -o -name "*.ini" \) -mtime -7 -ls
grep -RniE "password|db_user|db_pass|connectionString" /var/www /opt /srv 2>/dev/null
last -a
ss -plant
If you do not have product-specific logs, assume a successful attacker may leave only standard web requests and downstream database activity. In that case, baseline deviations and network segmentation logs become your best evidence sources.
Mitigation and patching
No publicly verified patch or fixed version was identified in the NVD record or the referenced TWCERT material available for this task. That means defenders cannot yet rely on a known-good upgrade target. Until PROG MIS publishes version-specific remediation, the most defensible approach is layered mitigation: restrict access, rotate exposed secrets, and increase monitoring.
The first priority is to remove unnecessary exposure. If ERP App is internet-facing, place it behind a VPN, IP allowlist, or application gateway immediately. If business constraints prevent full removal from the internet, restrict access to known corporate source ranges and add additional authentication at the edge where possible. Because the vulnerability allows unauthenticated login, any compensating control that blocks anonymous reachability materially reduces risk.
The second priority is secrets hygiene. The advisory explicitly says an attacker may obtain the database account and password. Assume those credentials are compromised if the application was reachable from untrusted networks. Rotate the ERP application database password, audit its privileges, and check for reuse in other services. If the same credential exists in reporting jobs, integrations, backups, or admin tooling, rotate those dependencies as part of the same change window.
Finally, prepare for a patch even though a fixed version is not yet public. Inventory all ERP App instances, identify maintenance owners, and establish a rapid validation path so you can deploy a vendor release quickly when it appears. Document current version numbers now, because they were not publicly specified in the sources and you may need that data later to determine exposure.
Technical Notes
Because no verified fixed version is currently available, there is no trustworthy upgrade command to a known-safe release that can be published here without inventing details. Defenders should not run undocumented package names or installer targets based on guesswork. Instead, use concrete containment and credential-rotation steps now.
Example Linux firewall restriction to allow only a trusted admin subnet to reach the ERP web service:
# Example only: adjust port and subnet to your environment
sudo iptables -A INPUT -p tcp --dport 443 -s 203.0.113.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j DROP
Example Windows Firewall restriction with PowerShell:
New-NetFirewallRule -DisplayName "Allow ERP from trusted subnet" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 443 -RemoteAddress 203.0.113.0/24
New-NetFirewallRule -DisplayName "Block ERP from untrusted sources" -Direction Inbound -Action Block -Protocol TCP -LocalPort 443
Example database credential rotation workflow placeholders. Use the actual database engine and application config path in your environment:
-- Example SQL pattern only. Validate syntax for your DBMS.
ALTER USER erp_app_user IDENTIFIED BY 'NewStrongUniquePasswordHere';
# Example config update pattern only. Replace with your actual file path.
sudo sed -i 's/DB_PASSWORD=.*/DB_PASSWORD=NewStrongUniquePasswordHere/' /path/to/erp-app/.env
sudo systemctl restart erp-app
If your deployment uses a package manager or service wrapper, wait for a vendor-published advisory before executing an application upgrade. In the meantime, document the exact installed version using system inventory commands so you can compare it against future remediation guidance.
References
The primary public description comes from the NVD record for CVE-2026-14807, published on 2026-07-06. The key wording is that ERP App developed by PROG MIS contains a hard-coded credentials vulnerability allowing unauthenticated remote attackers to log in, view application code, and obtain the database account and password.
Supporting product and vendor identification comes from the two TWCERT advisory pages referenced by the CVE record. The English advisory identifies “PROG MIS｜ERP App - Use of Hard-coded Credentials,” while the Chinese advisory identifies “博格資訊管理顧問｜ERP App - Use of Hard-coded Credentials.” These references confirm the product, vendor identity, and vulnerability class, but the retrieved material did not provide a verifiable affected version range or fixed version number.
- NVD CVE record: CVE-2026-14807
- TWCERT English advisory: https://www.twcert.org.tw/en/cp-139-11024-c5c1a-2.html
- TWCERT Chinese advisory: https://www.twcert.org.tw/tw/cp-132-11023-3abe8-1.html