CVE-2026-3014
Remote Code Execution by administrative user on the Management Server
- State
- Published
- Severity
- 6.4 Medium
- Published
- Jul 14, 2026
- Updated
- Aug 11, 2026
- Reserved
- Feb 23, 2026
Description
Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API.
The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.4 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H | Milestone |
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | Milestone |
Weaknesses
- CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
Affected Products
| Product | Versions |
|---|---|
XProtect Management ServerMilestone Systems |
|
References
- https://support.milestonesys.com/article/CVE-2026-3014-potential-remote-code-execution-by-admin-user-on-Management-Serverpermissions-required
- https://doc.milestonesys.com/en-US/bundle/sec1504_latest/page/milestone_security_advisory_CVE-2026-3014_potential_remote_code_execution_by_admin_user_on_Management_Server.htmlvendor-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-825228.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.