CVE-2026-3014

CRITICAL

Remote Code Execution by administrative user on the Management Server

Title source: cna

Description

Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.

References (2)

Core 2

Core References

permissions-required

https://support.milestonesys.com/article/CVE-2026-3014-potential-remote-code-execution-by-admin-user-on-Management-Server

Vendor Advisory vendor-advisory

https://doc.milestonesys.com/en-US/bundle/sec1504_latest/page/milestone_security_advisory_CVE-2026-3014_potential_remote_code_execution_by_admin_user_on_Management_Server.html

Scores

CVSS v3 9.1

EPSS 0.0048

EPSS Percentile 38.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (1)

Milestone Systems/XProtect Management Server < 25.3

Published Jul 14, 2026

Tracked Since Jul 14, 2026