Is CVE-2026-12116 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12116 being exploited in the wild.

How severe is CVE-2026-12116?

Informational severity, with a CVSS score of 9, published 9 July 2026.

Which products and versions are affected?

The Xerte Project Xerte Online Toolkits Prior to 3.14 / 3.15.

Is there a fix for CVE-2026-12116?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12116 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-12116?

Check whether you run The Xerte Project Xerte Online Toolkits at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12116: The Xerte Project Xerte Online Toolkits RCE via antivirus binary path configuration

CVE-2026-12116 · Severity: info · CVSS 9 · Published 2026-07-09

Xerte Online Toolkits, a platform for creating interactive learning materials, contains a security flaw in its server management settings. An attacker with administrative access can change the path of the system's antivirus software to point to a malicious script or a command interpreter. This allows the attacker to execute arbitrary code on the server, potentially leading to a full system takeover and the theft of sensitive educational data.

Technologies: The Xerte Project Xerte Online Toolkits. Vendors: The Xerte Project.

Quick answers

Is CVE-2026-12116 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12116 being exploited in the wild.
How severe is CVE-2026-12116?: Informational severity, with a CVSS score of 9, published 9 July 2026.
Which products and versions are affected?: The Xerte Project Xerte Online Toolkits Prior to 3.14 / 3.15.
Is there a fix for CVE-2026-12116?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12116 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-12116?: Check whether you run The Xerte Project Xerte Online Toolkits at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A remote code execution (RCE) vulnerability exists in Xerte Online Toolkits due to insecure handling of the antivirus configuration path in the management interface. An attacker with sufficient privileges can modify the 'antivirus binary path' setting to point to a PHP interpreter or other executable. By subsequently uploading a file that triggers an antivirus scan, the attacker can force the server to execute the specified binary with the uploaded file as an argument, leading to arbitrary code execution. The fix involves moving this configuration out of the web-accessible management page to prevent unauthorized modification.

Affected products

The Xerte Project Xerte Online Toolkits Prior to 3.14 / 3.15

Timeline

2026-06-17: disclosed: Issue reported via GitHub and CERT/CC VINCE
2026-07-09: advisory: CVE published and security update announced

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.