CVE-2026-3014

Remote Code Execution by administrative user on the Management Server

Published Jul 14, 2026 CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

Milestone
has released a new version of XProtect® (and several cumulative patch updates)
which fix security vulnerability in Management Server API.

The vulnerability
causes users with edit permissions to the Management Server to be able to
execute arbitrary code in context of the Management Server Service.

Analysis

Technical impact

A flaw in the Management Server API permits a user with edit permissions to run arbitrary code within the context of the Management Server Service. This results in remote code execution, granting full control over the server’s processes and data, compromising confidentiality, integrity, and availability. The weakness is a classic command‑in‑jection issue classified as CWE‑78.

Affected Systems

Milestone Systems XProtect Management Server, as well as the XProtect Recording Server and XProtect Management Client, are vulnerable. The advisory recommends applying the latest cumulative patches that address this issue for all supported releases from 2023 R3 to 2025 R3.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1 % means the likelihood of exploitation is low at present. The vulnerability can be leveraged only by users who already possess edit permissions on the Management Server, so restricting those rights mitigates risk. Because the issue is not listed in KEV, there no known active exploitation in the wild, but the possible remote code execution warrants caution.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Milestone Systems

XProtect Management Server

unaffected

Version	Status	Constraints
`0`	affected	≤ 25.3

No data.

Vendor Product Versions

Milestone Systems

Xprotect Management Server

Version	Status	Scheme	Platform
`[0,25.3]`	affected	generic	—

Remediation

Vendor Solution

To mitigate the issue, we highly recommend upgrading to the latest version of XProtect VMS. For versions 2023 R3 – 2025 R3, please use the provided cumulative patches. The affected components that need to be patched are XProtect Management Server, XProtect Recording Server and XProtect Management Client.

OpenCVE Recommended Actions

Upgrade XProtect VMS to the latest version or apply the cumulative patches for 2023 R3–2025 R3.
Patch all affected components – XProtect Management Server, XProtect Recording Server, and XProtect Management Client.
Restrict edit permissions to trusted administrators and audit permissions regularly to ensure only authorized users retain elevated access.

Generated by OpenCVE AI on July 31, 2026 at 10:34 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.782% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-825228.html
https://doc.milestonesys.com/en-US/bundle/sec1504_latest/page/milestone_security_advisory_CVE-2026-3014_potential_remote_code_execution_by_admin_user_on_Management_Server.html
https://support.milestonesys.com/article/CVE-2026-3014-potential-remote-code-execution-by-admin-user-on-Management-Server

History

Aug 11, 2026 4:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-825228.html

Jul 27, 2026 3:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Milestone Systems Milestone Systems xprotect Management Server
Vendors & Products		Milestone Systems Milestone Systems xprotect Management Server

Jul 16, 2026 1:00 PM Description updated View changes

Type	Values Removed	Values Added
Description	Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.	Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.

Jul 15, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://doc.milestonesys.com/en-US/bundle/sec1504_latest/page/milestone_security_advisory_CVE-2026-3014_potential_remote_code_execution_by_admin_user_on_Management_Server.html

Jul 14, 2026 12:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 14, 2026 10:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.
Title		Remote Code Execution by administrative user on the Management Server
Weaknesses		CWE-78
References		https://support.milestonesys.com/article/CVE-2026-3014-potential-remote-code-execution-by-admin-user-on-Management-Server
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 6.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H'}`