What is CVE-2026-3014?

CVE-2026-3014 is a critical-severity vulnerability in Milestone Systems Xprotect Management Server, classified under OS Command Injection. CVSS score: 9.1/10. Published 2026-07-14.

How severe is CVE-2026-3014?

Critical severity. CVSS v3 base score is 9.1 out of 10.

RCE in Milestone Systems Xprotect Management Server

CVE-2026-3014

Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.008 (53.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Milestone Systems Xprotect Management Server — versions 0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

cf45122d-9d50-442a-9b23-e05cde9943d8 (permissions-required)
cf45122d-9d50-442a-9b23-e05cde9943d8 (vendor-advisory)
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Frequently asked questions

What is CVE-2026-3014?: CVE-2026-3014 is a critical-severity vulnerability in Milestone Systems Xprotect Management Server, classified under OS Command Injection. CVSS score: 9.1/10. Published 2026-07-14.
How severe is CVE-2026-3014?: Critical severity. CVSS v3 base score is 9.1 out of 10.