CVE-2026-3014: XProtect Management Server RCE Vulnerability

CVE-2026-3014 Overview

Milestone Systems disclosed a vulnerability in the XProtect Management Server API that allows authenticated users with edit permissions to execute arbitrary code in the context of the Management Server Service. The flaw is tracked as [CWE-78: OS Command Injection]. Milestone has released a new version of XProtect along with cumulative patch updates to address the issue. The vulnerability affects video management system (VMS) deployments where administrators grant edit privileges to the Management Server component.

Critical Impact
Authenticated administrators with edit rights can execute arbitrary code under the Management Server Service account, gaining control over the VMS host and any connected recording infrastructure.

Affected Products

Milestone XProtect (Management Server component)
Milestone XProtect cumulative patch releases prior to the vendor fix
Deployments exposing the Management Server API to networked administrators

Discovery Timeline

2026-07-14 - CVE-2026-3014 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-3014

Vulnerability Analysis

The vulnerability resides in the XProtect Management Server API, which handles administrative operations for the VMS platform. The API fails to properly sanitize input supplied by users holding edit permissions, allowing operating system command injection [CWE-78]. When exploited, injected commands run in the process context of the Management Server Service, which typically operates with elevated privileges on the host. The attack originates over the network and requires no user interaction, but the attacker must first authenticate with edit rights on the Management Server.

Root Cause

The root cause is improper neutralization of special elements passed to an OS command within the Management Server API. Input received through privileged API endpoints reaches a command execution path without adequate validation or parameterization. This design flaw converts an administrative editing action into a code execution primitive against the underlying Windows host.

Attack Vector

An attacker with valid credentials and edit permissions authenticates to the Management Server API over the network. The attacker submits a crafted API request containing OS command payloads in fields consumed by the vulnerable handler. The Management Server Service parses the input and executes the attacker-supplied commands with service-level privileges. Because the impact extends to subsequent systems, a compromised Management Server can be leveraged to pivot into connected recorders, cameras, and integration components. See the Milestone Security Advisory CVE-2026-3014 for technical details.

Detection Methods for CVE-2026-3014

Indicators of Compromise

Unexpected child processes spawned by the Milestone Management Server Service (VideoOS.Server.Management.exe or related binaries), particularly cmd.exe, powershell.exe, or wscript.exe.
Anomalous outbound network connections initiated from the Management Server host to attacker-controlled infrastructure.
New scheduled tasks, services, or local accounts created shortly after Management Server API activity.

Detection Strategies

Correlate Management Server API authentication events for accounts with edit permissions against subsequent process creation events on the host.
Alert on any Management Server Service process tree containing shell interpreters or LOLBins such as certutil.exe, bitsadmin.exe, or mshta.exe.
Baseline normal API request patterns and flag anomalously long parameter values or shell metacharacters (;, |, &, backticks) within Management Server requests.

Monitoring Recommendations

Enable and forward Windows Security, Sysmon, and Milestone application logs to a centralized SIEM for correlation.
Continuously audit which accounts hold edit permissions on the Management Server and review any recent privilege grants.
Monitor Management Server hosts for integrity changes to service binaries, configuration files, and API endpoint definitions.

How to Mitigate CVE-2026-3014

Immediate Actions Required

Apply the fixed XProtect release or the appropriate cumulative patch update published by Milestone as soon as feasible.
Restrict Management Server API network exposure to trusted administrative subnets and VPN-only access.
Review all accounts with edit permissions on the Management Server and remove unnecessary privileges.
Rotate credentials for administrative accounts and enable multi-factor authentication for VMS administration where supported.

Patch Information

Milestone has released a new XProtect version and cumulative patch updates that remediate the command injection flaw. Refer to the Milestone Support Article CVE-2026-3014 for the specific fixed versions applicable to each supported branch and upgrade guidance.

Workarounds

Reduce the number of accounts granted edit permissions on the Management Server until patches are deployed.
Place the Management Server behind network segmentation and permit API access only from a hardened jump host.
Increase logging verbosity on the Management Server and monitor for anomalous administrative activity while awaiting remediation.

bash

# Example: restrict Management Server API access using Windows Firewall
New-NetFirewallRule -DisplayName "Milestone MgmtServer API - Admin Subnet Only" `
  -Direction Inbound -Protocol TCP -LocalPort 80,443 `
  -RemoteAddress 10.10.20.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Milestone MgmtServer API - Block Other" `
  -Direction Inbound -Protocol TCP -LocalPort 80,443 `
  -Action Block