Tactis NoviGest Desktop App: Missing authentication in Java RMI service
Summary
The Java RMI service of the NoviGest Desktop App, a clinical management software, does not require authentication for critical functions. A remote attacker with network access to the service can invoke remote methods, obtain sensitive credentials and execute arbitrary SQL queries on PostgreSQL. Due to the elevated database privileges, these steps can be chained to execute operating system commands on the server.
Affected
- NoviGest Desktop App prior to version 8.0.0-300
- INCIBE tested version 7.4.4-292
- Earlier versions: Unknown.
Fixed in
- Update to NoviGest Desktop App version 8.0.0-300 (vendor-confirmed fix)
Workaround
- No vendor workaround published. Restrict network access to the Java RMI service and the PostgreSQL port to strictly necessary systems and users until the update is installed.
Exploitation
- No known exploitation reported.
- No public proof of concept found.
- Not listed in CISA KEV.
- VulDB labels the entry as 0-Day; this is a status label and does not confirm in-the-wild exploitation.
Our recommendation
- Check whether NoviGest Desktop App is installed and which version is in use.
- Update to version 8.0.0-300 as soon as possible, together with the related fix for CVE-2026-112198.
- Review the PostgreSQL account privileges and confirm that the Java RMI service is not reachable from the Internet.
- Monitor logs for unusual RMI or database activity.
- Note that the NVD status is Deferred and CVSS scoring differs between sources (CNA 9.4, VulDB 7.3); use the higher score for prioritization.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT notice INCIBE-2026-801 www.incibe.es
- VulDB entry 427813 vuldb.com
- Strix CVE record CVE-2026-112197 www.strix.ai
- Techconsulting summary of INCIBE notice techconsulting.es
- Bujarra copy of INCIBE notice www.bujarra.com
- OffSeq radar CVE-2026-112197 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:42.
Original description (NVD)
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.