Skip to main content

CISA issues update on Xerte Online Toolkits RCE vulnerabilities

Source Decision Insights Threat Desk Published August 23, 2026 Companies 2
Human View Machine View

2 companies named across 6 categories, one of 21 articles referencing ONLINE. Previous coverage: Sophos makes Microsoft 365 backup and recovery powered by Rubrik available (Jun 2026).

Companies mentioned

Best suited for

Seniority
C Level / Executive Team
Job function
Chief Information Security Officer
Persona
Security Operations Leader
Buyer role
Decision Maker / Budget Holder
Decision stage
Which to buy
Adoption curve
Early Majority
Technology maturity
Established Technology
Industry
Education / K-12

Our classification, not the publisher's statement. Best suited for, not only for.

Xerte Online Toolkits contains two vulnerabilities that can lead to remote code execution on the affected server. One issue relates to the persistence of the /setup/ directory after installation and can enable an unauthenticated actor to gain administrative access. The other involves an editable antivirus binary path that can be redirected to a PHP interpreter, allowing uploaded files to execute as PHP code.

CVE-2026-14261 tracks persistence of the /setup/ directory after installation. The issue enables an unauthenticated attacker to reconfigure the application to point to a remote database they control, which allows administrative access. CVE-2026-12116 tracks an editable antivirus binary path that can be redirected to a PHP interpreter. In the described workflow, after admin privileges are obtained, the attacker edits the antivirus binary path to point to a PHP interpreter, causing new uploaded files to be passed to the PHP runtime through website_code/php/import/fileupload.php. This bypasses file extension checks and results in remote code execution. During installation, Xerte creates a /setup/ folder to configure database connection settings. This folder persists post-installation without access controls or automatic cleanup, and /setup/index.php does not verify whether installation has completed. The vulnerability enabling CVE-2026-14261 involves authentication bypass and remote code execution via reinstallation through the /setup/ folder by pointing to a remote database they control.

Successful exploitation can allow full remote code execution on the affected server. The advisory states this enables attackers to establish persistent access, exfiltrate data, or launch supply chain attacks by injecting malicious content into educational materials distributed by the platform.

The issues were addressed in two commits: 8fec660 removes /setup/ automatically after installation/upgrade and blocks reuse, and 8ef2062 moves sensitive configuration files, including the antivirus binary path, to server-side locations. The advisory also states users should manually remove the initial installation /setup/ folder from installations. It further states users should upgrade to Xerte v3.15.5 or v3.14.6 and run upgrade.php, which enforces automatic /setup/ removal and includes security hardening. If removal fails, the advisory states the updated code still prevents exploitation.

For additional information and contact data, the advisory provides a blog post at https://www.xerte.org.uk/index.php/en/news/blog/80-news/364-xerte-3-14-and-3-15-important-security-update. It also includes acknowledgements thanking the reporter, George Filippov from the Vexel Foundation, and states the document was written by Christopher Cullen. The referenced issues and commits include https://github.com/thexerteproject/xerteonlinetoolkits/issues/1532, https://github.com/thexerteproject/xerteonlinetoolkits/commit/8ef20628f80bd88bd1fe3e5844a9116a910086b7, https://github.com/thexerteproject/xerteonlinetoolkits/commit/8fec6602e80c5d35903d65e65b65b794297d8e90, and https://github.com/thexerteproject/xerteonlinetoolkits/issues/1543.

Blog post, originally published by Christopher Cullen at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-update-on-xerte-online-toolkits-rce-vulnerabilities/",
        "name": "CISA issues update on Xerte Online Toolkits RCE vulnerabilities",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-update-on-xerte-online-toolkits-rce-vulnerabilities/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/online/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/online/",
      "name": "ONLINE"
    },
    "articleSection": [
      "Cybersecurity",
      "Data Center"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "C Level / Executive Team"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Chief Information Security Officer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Established Technology"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Education / K-12"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T12:41:49-06:00",
    "datePublished": "2026-08-23T09:43:34-06:00",
    "description": "Xerte Online Toolkits vulnerabilities CVE-2026-14261 and CVE-2026-12116 can enable remote code execution; versions v3.15.5 and v3.14.6 fix.",
    "headline": "CISA issues update on Xerte Online Toolkits RCE vulnerabilities",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Christopher Cullen"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/734812"
    },
    "keywords": [
      "Antivirus",
      "Database",
      "Server",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-update-on-xerte-online-toolkits-rce-vulnerabilities/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/online/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/online/",
        "name": "ONLINE"
      },
      {
        "@id": "https://decisioninsights.ai/projects/php/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/php/",
        "name": "PHP"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages