by Kastro
Paper/Archive/CVE-2026-3014

CVE-2026-3014

Milestone Systems XProtect Management Server — Remote Code Execution by administrative user on the Management Server

EPSS 0.8%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 56.0.560 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.

Affected

ProductAffectedFixed inSource
XProtect Management Server≤ 25.3–CNA
Siveillance Video V2023 R3< V23.3 HotfixRev27V23.3 HotfixRev27siemens-SADP
Siveillance Video V2024 R1< V24.1 HotfixRev16V24.1 HotfixRev16siemens-SADP
Siveillance Video V2025< V25.1 HotfixRev15V25.1 HotfixRev15siemens-SADP

Scores by source

Milestone (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Milestone (CNA)6.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.milestonesys.com/article/CVE-2026-3014-potential-remote-code-execution-by-admin-user-on-Management-Serveradvisorydoc.milestonesys.com/en-US/bundle/sec1504_latest/page/milestone_security_advisory_CVE-2026-3014_potential_remote_code_execution_by_admin_user_on_Management_Server.htmlrefcert-portal.siemens.com/productcert/html/ssa-825228.html