External risk intelligence

NoviGest Desktop App Java RMI Service Authentication Bypass Leads to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-112197

The vulnerability exists in a Java RMI service associated with a desktop application. While RMI services can be network-reachable, they are typically designed for internal communication within a local network or between specific application components, not for direct exposure to the public internet. Common deployment patterns for desktop application services do not usually involve public-facing internet exposure.

Missing Authentication

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Java RMI service of the NoviGest Desktop App. This flaw allows unauthenticated attackers with network access to potentially gain access to sensitive credentials, execute arbitrary SQL queries, and ultimately compromise the server's confidentiality, integrity, and availability by executing operating system commands.

Unauthenticated access to critical app functions.
Potential for credential theft and server compromise.
Confirm relevance and assess exposure to the app.

Attack Path

How an attacker could exploit the issue

An attacker with network access to the NoviGest Desktop App's Java RMI service can bypass authentication to execute arbitrary SQL queries and obtain sensitive credentials. This can be chained to execute operating system commands on the server, leading to a full compromise.

Network access to RMI service required.
Unauthenticated remote method invocation triggers vulnerability.
Full server compromise is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the NoviGest Desktop App's Java RMI service could allow an attacker with network access to bypass authentication and access sensitive database credentials. When supported by the advisory, this could lead to the execution of arbitrary SQL queries on PostgreSQL and potentially operating system commands on the server, impacting its confidentiality, integrity, and availability.

System credentials and database access.
Unauthenticated remote method invocation.
Server compromise: confidentiality, integrity, availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NoviGest Desktop App's Java RMI service has a critical vulnerability allowing unauthenticated attackers with network access to potentially compromise the server. The immediate first step is to identify all instances of the NoviGest Desktop App, confirm their network reachability and business criticality, and then assign ownership for remediation planning based on the assessed risk.

Application owners and infrastructure teams are likely responsible.
Verify network reachability and business criticality.
Assess risk and plan remediation based on ownership.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the NoviGest Desktop App?

NoviGest is a desktop application that manages business processes and data. It utilizes a Java RMI (Remote Method Invocation) service to handle internal communication between its components and backend databases, specifically PostgreSQL. This architecture allows the software to perform complex operations like database queries and administrative tasks remotely, which is central to how the application coordinates its functions across a network environment.

How does CVE-2026-112197 affect NoviGest?

This vulnerability is classified as CWE-306, which refers to a Missing Authentication for Critical Function. Essentially, the software fails to verify who is requesting an action before executing it. Because of this, an unauthenticated user can interact with the Java RMI service, run unauthorized SQL queries, access protected credentials, and eventually trigger system-level commands on the underlying server.

What conditions trigger this vulnerability?

The flaw is triggered when an attacker successfully makes a network connection to the RMI service and invokes its methods without needing valid login credentials. It is important to note that this requires network reachability to the specific service; if an instance is isolated or restricted from receiving external connections, the vulnerability cannot be triggered via those restricted paths.

Is my server at risk from this RMI issue?

According to Halo Surface Signal, this risk is currently labeled as Unlikely for public-facing exposure. While the Java RMI service is technically network-accessible, it is typically intended for local or internal communication rather than public internet exposure. You should prioritize checking if your deployment configuration inadvertently exposes this RMI service beyond your trusted local network.

How should I respond to this threat?

Start by identifying all deployed instances of the NoviGest Desktop App within your environment. Once identified, verify which systems have network reachability to the RMI service and determine the business criticality of those assets. Assign clear ownership for these systems to your infrastructure or application teams to assess the risk and initiate formal remediation planning.

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.