CVE-2026-14807: PROG MIS ERP App Auth Bypass Vulnerability

CVE-2026-14807 Overview

CVE-2026-14807 is a hard-coded credentials vulnerability [CWE-798] in the ERP application developed by PROG MIS. Unauthenticated remote attackers can authenticate to the application using embedded credentials. Once inside, attackers view application code and extract the backing database account and password. This exposes the underlying database to full compromise, including read and write access to enterprise resource planning data. The Taiwan Computer Emergency Response Team (TW-CERT) coordinated disclosure of this issue.

Critical Impact
Unauthenticated network attackers can retrieve database credentials from the ERP application, leading to full compromise of confidentiality, integrity, and availability of business data.

Affected Products

PROG MIS ERP App (specific version identifiers not published in NVD)
Database backends referenced by the ERP application
Downstream integrations that reuse the exposed database credentials

Discovery Timeline

2026-07-06 - CVE-2026-14807 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14807

Vulnerability Analysis

The ERP application ships with credentials embedded directly in the codebase or configuration. Any remote actor who reaches the application over the network can authenticate without a valid user account. Successful authentication grants access to application source code and configuration surfaces. From there, attackers extract the database account and password used by the ERP backend. The vulnerability is classified under [CWE-798] Use of Hard-coded Credentials and does not require user interaction or prior privileges.

Root Cause

Developers embedded static credentials in the shipped ERP application rather than requiring per-deployment secrets. These credentials are identical across all installations, so knowledge of them from one instance transfers to every other instance. The application also exposes source code or code-viewing functionality to authenticated users, allowing further secret extraction such as database connection strings.

Attack Vector

The attack occurs over the network against the ERP application's authentication endpoint. An attacker sends valid requests with the hard-coded username and password. After authentication, the attacker navigates to code-viewing functionality inside the application and retrieves the database credentials. The attacker then connects directly to the database, bypassing application-level access controls entirely. No phishing, malware delivery, or local access is required.

No verified exploitation code is public. See the TW-CERT Security Advisory for vendor-coordinated technical details.

Detection Methods for CVE-2026-14807

Indicators of Compromise

Successful logins to the ERP application from unexpected external IP addresses or geographies.
Repeated authentication attempts against the ERP login endpoint using identical credentials across multiple source hosts.
Direct database connections originating from IP addresses that are not the ERP application server.
Access to application source-code or configuration-viewing features shortly after login.

Detection Strategies

Correlate ERP application authentication logs with database connection logs to spot out-of-band database access.
Alert on any successful ERP login that is immediately followed by browsing of code, configuration, or administrative pages.
Baseline normal ERP client IP ranges and flag deviations, especially from internet-facing sources.

Monitoring Recommendations

Ingest ERP application, web server, and database logs into a centralized analytics platform for cross-source correlation.
Monitor database audit logs for logins that do not originate from the sanctioned ERP application host.
Track configuration file reads and code repository access inside the ERP application for anomalies.

How to Mitigate CVE-2026-14807

Immediate Actions Required

Restrict network access to the ERP application to trusted internal networks or VPN clients until a fix is applied.
Rotate all database credentials referenced by the ERP application and audit for reuse elsewhere.
Review ERP application and database logs for unauthorized authentication and data access dating back to deployment.
Contact PROG MIS for a patched build and remediation guidance.

Patch Information

Refer to the TW-CERT Security Advisory and the TW-CERT Incident Report for the latest vendor guidance. Apply the fixed version supplied by PROG MIS as soon as it is available for your deployment.

Workarounds

Place the ERP application behind a VPN or IP allow-list to block unauthenticated internet exposure.
Enforce network segmentation so the database is only reachable from the ERP application server.
Where feasible, disable in-application code and configuration viewing features until vendor remediation is deployed.
Require multi-factor authentication at the network perimeter for any user reaching the ERP application.

bash

# Configuration example
# Restrict ERP application exposure at the network edge (illustrative iptables rules)
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Restrict database access to the ERP application host only
iptables -A INPUT -p tcp --dport 3306 -s <erp-app-server-ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP