CVE-2026-14807 identifies a use of hard-coded credentials vulnerability (CWE-798) in the PROG MIS ERP App. This vulnerability permits unauthenticated remote attackers to bypass authentication controls by leveraging embedded credentials within the application. Successful exploitation grants attackers access to view the application source code and retrieve sensitive database credentials. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction needed, and high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available.

Exploitation of this vulnerability allows attackers to gain unauthorized access to the ERP application, exposing the application code and database credentials. This can lead to further compromise of the database and potentially the entire backend infrastructure, posing a critical risk to confidentiality, integrity, and availability of enterprise data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the ERP application and monitor for unauthorized access attempts. Avoid deploying the vulnerable version in exposed environments if possible.