External risk intelligence

ERP App Hard-coded Credentials Allow Unauthenticated Login

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-14807

The vulnerability affects an Enterprise Resource Planning (ERP) application. ERP systems are commonly deployed as internet-facing web applications or services to facilitate remote access for employees and business partners, making them a common target for network-based exposure.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in PROG MIS's ERP App could allow unauthenticated attackers to access application code and sensitive database credentials remotely. The primary concern is confirming whether this specific ERP application is in use and exposed.

Hard-coded credentials grant unauthorized system access.
Protects sensitive application and database information.
Verify relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could remotely access the ERP application and gain access to sensitive information. This is possible because the application has hard-coded credentials that allow for unauthorized login. Once logged in, attackers can view application code and retrieve database account credentials.

No authentication required.
Hard-coded credentials provide access.
Sensitive code and credentials exposed.

Live Threat

Current exploitation, exposure, and threat context

The PROG MIS ERP App could allow unauthenticated remote attackers to view application code and obtain sensitive database credentials. This exposure is possible when the application is accessible over a network.

Application code and database credentials at risk.
Attackers could log in remotely without authentication.
Unauthorized access to sensitive system information.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PROG MIS ERP App, developed by PROG MIS, has a critical Use of Hard-coded Credentials vulnerability. This means that teams responsible for application security, infrastructure, and potentially vendor management need to coordinate. The first practical step is to locate all instances of the ERP App, determine their exposure (internal or external), assess their business criticality, identify the accountable application owner, and then plan remediation based on the assessed risk.

Application and infrastructure teams own this.
Verify ERP App presence and exposure.
Plan and execute remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the PROG MIS ERP App?

This software is an Enterprise Resource Planning system. These applications are designed to manage core business processes like accounting, inventory, and human resources, often serving as a central hub for organizational data and operational workflows.

What does CVE-2026-14807 mean by hard-coded credentials?

This vulnerability, classified as CWE-798, occurs when software uses a fixed, embedded password or account name to handle authentication. Instead of requiring a unique user login, the application contains a secret key baked into its code that allows anyone who knows it to bypass security checks and gain unauthorized access.

How do attackers trigger this vulnerability?

An attacker triggers this flaw by presenting the hard-coded credentials to the application's login interface. Because the system is programmed to accept these specific values, no legitimate user account or prior authorization is needed. Note that simply having the software installed is not the trigger; the attacker must be able to reach the application's login portal over the network.

Why is this ERP App considered a high-priority risk?

Halo Surface Signal notes that ERP systems are frequently deployed as internet-facing services to support remote business operations. Because this vulnerability is reachable over a network without needing an account, any instance exposed to the public internet is at a higher risk of being discovered and accessed by unauthorized parties.

What is the first step to address this issue?

Begin by creating a comprehensive inventory of all ERP App instances within your environment. Once mapped, confirm which systems are reachable from the internet versus those restricted to internal networks. After identifying these assets, coordinate with the application owners to assess the business risk and prioritize the implementation of security patches or configuration changes provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.