CVE-2026-84147: ERP System Unauthenticated RCE Vulnerability

CVE-2026-84147 Overview

CVE-2026-84147 is an unrestricted file upload vulnerability affecting an ERP system's API endpoint. The flaw combines missing authentication with inadequate file type validation, allowing unauthenticated remote attackers to upload arbitrary files to a web-accessible directory. Successful exploitation leads to arbitrary code execution and full system compromise. The vulnerability is classified under [CWE-434] (Unrestricted Upload of File with Dangerous Type) and carries a maximum CVSS 4.0 score. CERT-In tracks this issue under advisory CIVN-2026-0430.

Critical Impact
Unauthenticated attackers can achieve remote code execution by uploading malicious files to a publicly accessible directory, resulting in complete confidentiality, integrity, and availability loss.

Affected Products

ERP system referenced in CERT-In advisory CIVN-2026-0430
Specific vendor and product identifiers not published in the NVD record
Refer to the CERT-In advisory for the authoritative affected product list

Discovery Timeline

2026-09-01 - CVE CVE-2026-84147 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84147

Vulnerability Analysis

The vulnerability resides in an API endpoint that accepts file uploads without enforcing authentication or validating file types. An attacker with network access to the ERP application can send crafted upload requests directly to this endpoint. Because the endpoint writes uploaded files into a web-accessible directory, an attacker can place server-executable content (for example, a web shell) and then request it over HTTP to trigger code execution.

The combination of missing authentication and missing content-type enforcement is the defining property of [CWE-434]. Once the attacker retrieves the uploaded file through the web server, arbitrary commands run in the context of the ERP application process. This permits data theft, lateral movement, persistence, and destructive actions across connected business systems.

Root Cause

The root cause is twofold. First, the upload API endpoint does not require an authenticated session or valid token before accepting requests. Second, the server-side handler does not enforce an allow-list of permitted file extensions, MIME types, or magic bytes, and does not sanitize the resulting file path. These control gaps let an unauthenticated caller stage executable content inside the document root.

Attack Vector

Exploitation is network-based and requires no user interaction or prior privileges. An attacker sends a multipart HTTP request to the vulnerable upload endpoint containing a payload with a server-executable extension. The application stores the file in a directory served by the web server. The attacker then issues a follow-up HTTP request to the uploaded file's URL, which executes the payload and yields a foothold on the host.

No public proof-of-concept is listed in the NVD record at the time of publication, and the vulnerability is not currently tracked on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-84147

Indicators of Compromise

Unexpected files with executable extensions (.jsp, .php, .aspx, .jspx, .war) appearing in ERP upload or document directories
HTTP POST requests to the ERP upload API endpoint from external IP addresses without a preceding authentication flow
Web server access logs showing GET requests to newly created files in upload directories shortly after a POST
Child processes spawned by the ERP application user (for example, cmd.exe, powershell.exe, /bin/sh) with network or reconnaissance activity

Detection Strategies

Alert on process lineage where the ERP application or web server process spawns a shell or scripting interpreter
Baseline the contents of upload directories and flag new files with server-executable extensions or MIME mismatches
Correlate unauthenticated HTTP requests to upload endpoints with subsequent GET requests to files under the same path
Hunt for outbound connections initiated by the ERP process to unusual destinations following an upload event

Monitoring Recommendations

Forward web server, application, and endpoint telemetry to a centralized SIEM or data lake for correlation across layers
Enable command-line and process-creation logging on hosts running the ERP application
Retain HTTP access logs with request bodies stripped of sensitive data for at least 90 days to support retrospective hunts
Monitor file integrity for the ERP web root and any writable upload directories

How to Mitigate CVE-2026-84147

Immediate Actions Required

Restrict network access to the ERP application to trusted networks or a VPN until a vendor patch is applied
Block or disable the vulnerable upload API endpoint at the reverse proxy or web application firewall (WAF) layer
Audit ERP upload directories for unrecognized files and rotate any credentials or secrets accessible from the ERP host
Review CERT-In advisory CIVN-2026-0430 for vendor-specific guidance

Patch Information

The NVD record does not currently list a vendor patch URL. Administrators should consult the CERT-In advisory referenced above and the ERP vendor's security bulletins for fixed versions. Apply the vendor-supplied update as soon as it is available and validate that authentication and file type validation controls are enforced on the affected endpoint after patching.

Workarounds

Enforce authentication on the upload endpoint via reverse proxy rules until an official fix is deployed
Configure the web server to deny execution of scripts within upload directories (for example, disable script handlers or set the directory to serve static content only)
Implement a WAF rule that blocks multipart uploads with server-executable extensions or mismatched MIME types
Run the ERP application under a least-privilege service account to limit the impact of code execution

bash

# Example nginx configuration to prevent script execution in an uploads directory
location ^~ /uploads/ {
    # Serve files as static content only
    default_type application/octet-stream;
    # Block known server-executable extensions
    location ~* \.(php|phtml|jsp|jspx|aspx|asp|cgi|pl|py|sh)$ {
        deny all;
        return 403;
    }
}