Milestone Systems vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Milestone Systems products: 2 record(s), with severity, exploitation and fixes.

XProtect VMS 1 XProtect Management Server 1

Exploited only (KEV) →

CVE-2026-3014 Critical · 9.1 CWE-78 Jul 14, 2026

Remote Code Execution by administrative user on the Management Server

Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.

CVE-2025-0836 Medium · 6.3 CWE-862 Dec 16, 2025

XProtect MIP API Missing Authorization

Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.