CVE-2026-59540
A flaw in SMS Alert Order Notifications versions 3.9.6 and earlier lets anyone on the network gain full control of the system without needing a password. The bug allows attackers to run arbitrary commands, read or delete data, and take over the affected server. It is a serious, unauthenticated privilege escalation vulnerability.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
SMS Alert Order Notifications software, any installation running version 3.9.6 or older. The typical user is an administrator or operator of the system.
Real-world impact
An attacker who exploits this flaw can execute any code on the server, steal sensitive data, modify or delete information, and potentially use the compromised machine to launch further attacks.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no authentication, and gives attackers complete control (confidentiality, integrity, availability).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources