CVE-2026-3014

CriticalCVSS 9.1/10Last modified Oct 24, 2026

Description

Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API.

The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Milestone SystemsXProtect Management Server<= 25.3
SiemensSiveillance Video V2023 R3< V23.3 HotfixRev27
SiemensSiveillance Video V2024 R1< V24.1 HotfixRev16
SiemensSiveillance Video V2025< V25.1 HotfixRev15

References

Timeline

Published
Jul 14, 2026
Last modified
Oct 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-301407.5An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCVE-2026-301419.8An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in the DecodeLZW function allows remote attackers to cause a deniaCVE-2026-30158.8A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/formPolicyRouteConfCVE-2026-30168.8A vulnerability was identified in UTT HiPER 810G up to 1.7.7-171114. The affected element is the function strcpy of the file /goform/formP2PCVE-2026-301626.1Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.CVE-2026-30177.2The Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection CVE-2026-30187.5The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, CVE-2026-30208.6Identity based authorization bypass vulnerability (IDOR) that allows an attacker to modify the data of a legitimate user account, such as chCVE-2026-30216.5Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/centro/equiCVE-2026-30226.5Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/hospitalizaCVE-2026-302238.8OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured uCVE-2026-302245.4OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side se
CVE-2026-3014: Critical severity, CVSS 9.1 | Vulnix