CVE-2026-3014 json
Remote Code Execution by administrative user on the Management Server
published 3mo ago modified 16d ago also EUVD-2026-43655
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API.
The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.
Patch / fix
- Siemens Siveillance Video V2023 R3 V23.3 HotfixRev27
- Siemens Siveillance Video V2024 R1 V24.1 HotfixRev16
- Siemens Siveillance Video V2025 V25.1 HotfixRev15
Is CVE-2026-3014 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-26-225-09 updated cvss 9.1
Siemens Siveillance Video
-
Siemens Siveillance Video V2023 R3 < 23.3.27affected: fixed in V23.3 support.industry.siemens.com
-
Siemens Siveillance Video V2024 R1 < 24.1.16affected: fixed in V24.1 support.industry.siemens.com
-
Siemens Siveillance Video V2025 < 25.1.15affected: fixed in V25.1 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 3mo ago
Exploit prediction
0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H |
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| CNA | 4.0 | 6.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Milestone Systems XProtect Management Server
- Siemens Siveillance Video V2023 R3
- Siemens Siveillance Video V2024 R1
- Siemens Siveillance Video V2025
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
doc.milestonesys.com
/en-US/bundle/sec1504_latest/page/milestone_security_advisory_CVE-2026-3014_potential_remote_code_execution_by
vendor-advisory
-
support.milestonesys.com
/article/CVE-2026-3014-potential-remote-code-execution-by-admin-user-on-Management-Server
permissions-required
- cert-portal.siemens.com /productcert/html/ssa-825228.html
Sources
- CVE List CVE-2026-3014
- NVD CVE-2026-3014
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.