CVE-2026-112197 is a critical vulnerability in the NoviGest Desktop App's Java RMI service caused by lack of authentication in critical functions. An attacker with network access can invoke remote methods without authentication, leading to exposure of sensitive credentials and arbitrary SQL query execution on the PostgreSQL database. The database account's elevated privileges allow chaining these actions to execute operating system commands on the server, compromising confidentiality, integrity, and availability.