SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-65974

CRITICAL · CVSS 9.9 EPSS 0.56% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-17 · Last synced 2026-09-16

CyberRota Analysis

AI-Generated

Limited authenticated users of ERPNext versions prior to 15.111.0 and 16.22.0 can exploit a server-side template injection vulnerability due to the exposure of the frappe.render_template function without proper restrictions. This flaw allows attackers to execute arbitrary code on the server, posing a critical risk to the integrity and security of the application. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution
GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-65974
Severity
CRITICAL
CVSS
9.9
EPSS
0.56%

Original NVD Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.