[ CVE-2026-112198 · Published 28 Oct 2026 ]
Vulnerability in Tactis NoviGest Desktop App
CVSS 8.3
EPSS <1%No fix listed yet
[ Description ]Official description
XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.