CVE-2026-84147

CVE-2026-84147 is a critical (CVSS 4.0: 10.0) flaw in an ERP system caused by improper authentication controls combined with inadequate file type validation at an API endpoint. An unauthenticated remote attacker can trigger it by sending file uploads through the API, with uploaded files being written to a web-accessible directory on the targeted system. Because uploaded content is not properly validated, the attacker can plant malicious files (CWE-434) that are then executed, yielding arbitrary code execution and full system compromise. Organizations running the affected ERP system are at risk, particularly where the API endpoint is reachable from the internet. As of now there is no public proof of concept, the flaw is not listed in CISA KEV, and EPSS puts the 30-day exploitation probability at about 0.5% (44th percentile), indicating no known exploitation activity.

What to do: Check the CERT-In advisory and the ERP vendor for patch details, and apply the fixed release as soon as one is identified (no version numbers are available in the current data). In the interim, restrict network access to the API endpoint, require authentication on upload functionality, enforce strict file type allowlists, and ensure the upload directory is not executable or web-accessible. Audit the upload directory for unexpected files (e.g., scripts or webshells) and review access logs for unauthenticated POST requests to the affected API.