External risk intelligence

ERPNext Server-Side Template Injection Allows Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-65974

ERPNext is an enterprise resource planning platform commonly deployed as a web application accessible over the network. While the vulnerability requires low-privileged authentication, the application itself is frequently exposed to the internet or wide internal networks to support business operations, making the service surface likely to be reachable.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in ERPNext, an open-source Enterprise Resource Planning tool, impacting older versions. This flaw allows authenticated users with limited permissions to execute unauthorized code on the server, potentially leading to a significant compromise of the system.

Sensitive code execution via ERPNext.
Impacts data integrity and system availability.
Confirm relevance and ensure timely updates.

Attack Path

How an attacker could exploit the issue

An attacker with limited access to ERPNext can inject malicious code by leveraging a flaw in how templates are processed. This allows them to execute commands on the server, potentially leading to a compromise of the entire system.

Requires authenticated user access.
Triggered through server-side template injection.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

Limited authenticated users could execute arbitrary code on the server by exploiting a template injection vulnerability in ERPNext. This could occur when the `frappe.render_template` function is used without proper restrictions, potentially impacting system integrity and confidentiality when supported by the advisory.

Server-side code execution.
Cross-boundary permission escalation.
Potential unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability in ERPNext, the platform or application owner is responsible for coordinating remediation. The first step is to identify all instances of ERPNext, determine their reachability and business criticality, and then assign ownership for a planned update.

Platform or application owners should manage this.
Verify ERPNext instances and their reachability.
Plan remediation based on identified business risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ERPNext?

ERPNext is an open-source Enterprise Resource Planning (ERP) platform built on the Frappe framework. Businesses use it to manage integrated operations like accounting, inventory, human resources, and project management through a centralized web interface. Because it handles core organizational data, it typically requires a server-side environment capable of processing complex templates and dynamic content to generate user reports and application views.

What does CWE-1336 mean for CVE-2026-65974?

CWE-1336 refers to Improper Neutralization of Special Elements Used in a Template Engine. In this CVE, the application fails to restrict global variables when rendering templates. This weakness allows an attacker to inject malicious code into the template engine. Because the engine processes these instructions server-side, the vulnerability enables unauthorized remote code execution, granting the attacker control over the underlying server.

How is this ERPNext vulnerability triggered?

The flaw is triggered when the application calls the `frappe.render_template` function without enforcing necessary security restrictions. An attacker must possess an authenticated user account to reach this functionality. Importantly, simply browsing the application or accessing non-template components does not trigger the bug; the attacker must be able to influence the input processed by this specific, inadequately secured rendering function.

Why is this CVE relevant to my ERPNext deployment?

According to Halo Surface Signal, ERPNext is often deployed as a web application reachable over the network to facilitate business operations. While the vulnerability requires low-privileged authentication, the risk is high if your instance is internet-facing or accessible to a broad internal user base. If your deployment allows users to authenticate and reach the affected template rendering paths, your system is susceptible to the described code execution.

Do I need to update my ERPNext software?

Yes. If you are running a version prior to 15.111.0 or 16.22.0, you are affected by this vulnerability. Your first step should be to inventory all running instances of ERPNext in your environment. Once you have identified these instances, coordinate with your technical team to verify their current version and schedule an update to the patched releases (15.111.0 or 16.22.0) to eliminate the template injection path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.