Threat reportVulnerabilityTL-2026-4957
ARKETEAM Protectel multiple vulnerabilities incl. unrestricted file upload (CVE-2025-68391) and SQL injection (CVE-2025-68393, CVE-2025-68394)
ARKETEAM Protectel multiple vulnerabilities incl. (TL-2026-4957) is a high-severity software vulnerability scored CVSS 8.4, first published 2026-11-01. It has no confirmed attribution, affects ARKETEAM Protectel PROTECTELMAJ, references 5 CVEs (CVE-2025-68391, CVE-2025-68392, CVE-2025-68393), maps to 5 MITRE ATT&CK techniques (T1059.007, T1078, T1190), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 8.4/10High
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4957
- Threat ID
- TL-2026-4957
- Severity
- HIGH
- CVSS
- 8.4 (CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- finance, banking, fintech, insurance
- Target regions
- Europe, france
- Detection rules
- 9
- Indicators of compromise
- 10
How ARKETEAM Protectel multiple vulnerabilities incl. works
CERT Polska disclosed five vulnerabilities in ARKETEAM Protectel (modules PROTECTELMAJ and BDF): unrestricted file upload (CVE-2025-68391), incorrect authorization (CVE-2025-68392), two SQL injections (CVE-2025-68393, CVE-2025-68394) and stored XSS in the note editor (CVE-2025-68395). Fixed in PROTECTELMAJ 6.5.19 and BDF 6.4.67; no in-the-wild exploitation or public PoC is reported.
On 30 October 2026 CERT Polska (CNA CERT-PL) published coordinated-disclosure advisories and CVE records for five vulnerabilities in ARKETEAM Protectel, a French compliance and risk-management platform for financial institutions. The vendor describes it as a single portal/API for KYC/KYB due diligence, AML screening, continuous third-party monitoring, a scenario engine and Banque de France integration (incident file declarations such as FCC, FICP, FNCI), used by 170+ financial institutions with data hosted in France. All five flaws affect the PROTECTELMAJ module before 6.5.19 and the BDF module before 6.4.67. The reporter credited is Karol Miring. The CVE IDs were reserved on 2025-12-16 and published on 2026-10-30.
CVE-2025-68391 (CWE-434) allows any user to upload an arbitrary file and override existing files in a temporary folder; the advisory notes this could lead to JavaScript execution when authenticated users download the uploaded file. The CVE record scores it CVSS 4.0 5.3 MEDIUM (AV:A/PR:N, low integrity impact). CVE-2025-68392 (CWE-863) lets low-privileged users use functionality reserved for administrators by forging direct requests to a specific endpoint (CVSS 4.0 5.1 MEDIUM, AV:A/PR:L).
CVE-2025-68393 and CVE-2025-68394 (CWE-89) are SQL injections caused by improper neutralization of input supplied by a low-privileged user in the 'Utilisateur' and 'profilInput' parameters respectively. The CVE records score both CVSS 4.0 8.4 HIGH (AV:A/PR:H) with high confidentiality and integrity impact and low availability impact on the vulnerable system. CVE-2025-68395 (CWE-79) is a stored XSS in the note editor: a low-privileged attacker can inject arbitrary HTML and JS into notes that is rendered/executed when a user visits the module (CVSS 4.0 5.1 MEDIUM, AV:A/PR:N/UI:P).
The CVE records use an adjacent-network attack vector (AV:A), suggesting the application is primarily reachable from internal or restricted networks. The sources state no CVSS from CERT Polska itself, no known exploitation, no public proof of concept (a web search found none) and no IOCs. Chaining is plausible in principle (authorization bypass, upload or stored XSS to reach privileged sessions, then SQL injection against the backend database), but the sources document no chain; this is an analyst inference, not an evidenced attack. Defenders should patch to PROTECTELMAJ 6.5.19 / BDF 6.4.67 and monitor for the vulnerability classes described.
MITRE ATT&CK techniques used in TL-2026-4957
Execution
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Collection
T1213 Data from Information Repositories
Impact
Affected products and versions in ARKETEAM Protectel multiple vulnerabilities incl.
- ARKETEAM — Protectel PROTECTELMAJ
Vulnerable versions: all versions before 6.5.19
Fixed in: 6.5.19 - ARKETEAM — Protectel BDF
Vulnerable versions: all versions before 6.4.67
Fixed in: 6.4.67
Remediation for ARKETEAM Protectel multiple vulnerabilities incl.
Patches
- ARKETEAM Protectel PROTECTELMAJ v6.5.19
- ARKETEAM Protectel BDF v6.4.67
Immediate actions
- Upgrade PROTECTELMAJ to 6.5.19 or later and BDF to 6.4.67 or later
- Restrict network access to Protectel to trusted internal segments (CVE records score an adjacent-network vector)
- Review accounts with low privileges and audit use of administrator-reserved endpoints
Workarounds
- No vendor workaround documented in the sources; limit user roles and network exposure until patched
Longer-term hardening
- Monitor web/application logs for SQL metacharacters in the Utilisateur and profilInput parameters
- Monitor the Protectel temporary upload folder for unexpected file creation or overwrites
- Apply a restrictive Content-Security-Policy and output encoding review for the note editor
CVEs associated with ARKETEAM Protectel multiple vulnerabilities incl.
CVE-2025-68391, CVE-2025-68392, CVE-2025-68393, CVE-2025-68394, CVE-2025-68395
Weaknesses (CWE) in ARKETEAM Protectel multiple vulnerabilities incl.
Timeline of ARKETEAM Protectel multiple vulnerabilities incl.
- CVE-2025-68391 through CVE-2025-68395 reserved by CERT-PL (per CVE records), starting the coordinated-disclosure window.
- Advisory and CVE records report no in-the-wild exploitation, no public PoC and no IOCs; a follow-up web search found no public exploit code.
- Karol Miring credited as the vulnerability finder/reporter.
- Advisory documents fixes in PROTECTELMAJ 6.5.19 and BDF 6.4.67; all earlier versions are affected. Actual vendor release dates are not stated in the sources.
- CVE-2025-68393 (Utilisateur) and CVE-2025-68394 (profilInput) SQL injections scored CVSS 4.0 8.4 HIGH, the highest of the set.
- CVE records for CVE-2025-68391 through CVE-2025-68395 published with CVSS 4.0 scores of 5.1 to 8.4 and CWE-434/863/89/79 classifications.
- CERT Polska published the coordinated-disclosure advisory covering five Protectel vulnerabilities (CVE-2025-68391 to CVE-2025-68395).
- Threadlinqs ingested and researched the disclosure.
Sources cited for ARKETEAM Protectel multiple vulnerabilities incl.
- Vulnerabilities in ARKETEAM Protectel software - CERT Polska
- CVE-2025-68391 record (CNA CERT-PL)
- CVE-2025-68392 record (CNA CERT-PL)
- CVE-2025-68393 record (CNA CERT-PL)
- CVE-2025-68394 record (CNA CERT-PL)
- CVE-2025-68395 record (CNA CERT-PL)
- ARKETEAM Protectel product page (vendor)
- ARKETEAM Protectel homepage referenced in CVE records
- CWE-434 Unrestricted Upload of File with Dangerous Type
- CWE-89 SQL Injection
- CWE-863 Incorrect Authorization
- CWE-79 Cross-site Scripting
- CERT Polska coordinated vulnerability disclosure policy
Detection coverage for TL-2026-4957
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4957 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.