CVE-2026-14807 identifies a Use of Hard-coded Credentials vulnerability (CWE-798) in the PROG MIS ERP App. This security weakness permits unauthenticated remote attackers to bypass authentication controls by leveraging embedded credentials within the application. Exploitation allows attackers to access sensitive application code and database credentials, potentially leading to further compromise. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available, and no affected versions have been explicitly stated.

An unauthenticated remote attacker can exploit the hard-coded credentials to gain unauthorized access to the ERP application. This access enables viewing of the application source code and extraction of database account credentials, which can lead to significant data exposure and potential further exploitation of the backend database. The vulnerability severely compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting network access to the ERP application, monitor for unauthorized access attempts, and review application code for hard-coded credentials to remove or replace them with secure credential management solutions.