Multiple Vulnerabilities in Tactis' NoviGest Desktop App

Posted date 28/10/2026

Identificador

INCIBE-2026-801

Importance

5 - Critical

Affected Resources

NoviGest Desktop App, version 7.4.4-292: Java RMI service and XML file import from the SAFT module.

Description

INCIBE has coordinated the disclosure of two vulnerabilities—one critical and one high severity—that affect NoviGest Desktop App by Tactis Serviços Informáticos, LDA, a clinical management software application. The vulnerabilities were discovered by Pablo Jordán Lucia and Marina Jiali Villalta Cerezo.

These vulnerabilities have been assigned the following codes, CVSS v4.0 base scores, CVSS vectors, and CWE vulnerability types:

CVE-2026-112197: CVSS v4.0: 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | CWE-306
CVE-2026-112198: CVSS v4.0: 8.3 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | CWE-611

Solution

Update the NoviGest Desktop App to version 8.0.0-300, in which the vendor confirms that both vulnerabilities have been fixed.
For CVE-2026-112197, remote methods that access data require a JWT session token validated on the server. Interfaces that exposed credentials and allowed arbitrary SQL execution have been removed, and the privileges of the PostgreSQL account have been reduced to prevent program execution and access to server files.
For CVE-2026-112198, XML processing uses an XMLStreamReader with DTDs and external entities disabled. Schema validation employs secure processing and blocks access to external DTDs and schemas.

Detail

CVE-2026-112197: Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.
CVE-2026-112198: XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.

CVE