CVE-2026-12116
Critical
Description
A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed.
SeverityCritical
CVSS9.8
Exploit probability—
ProductXerte Online Tools
PublishedJul 9, 2026
First seenJul 9, 2026
Weakness typeCWE-94Code injection
How to fix
Update
- Xerte Xerte Online Toolsv3.15.5, 3.14.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Xerte Xerte Online Tools | v < v3.15.5, v < 3.14.6 | v3.15.5, 3.14.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.