A critical remote code execution vulnerability in the TMS Global Software TMS Management Console poses an extreme risk due to the potential for full system compromise.

The application fails to properly validate file uploads within the /Customer/AddEdit endpoint, allowing an unauthenticated remote attacker to upload malicious files and achieve arbitrary code execution.

Successful exploitation grants an attacker full control over the affected management console, leading to potential data exfiltration, unauthorized administrative actions, and complete system takeover. With a CVSS score of 10.0, this represents the highest level of severity, necessitating immediate attention to prevent catastrophic operational impact.

Immediate Action: Contact TMS Global Software support to obtain the necessary security patch or configuration update to disable the vulnerable file upload functionality.

Proactive Monitoring: Review web server and application access logs for suspicious file upload patterns or requests directed at the /Customer/AddEdit endpoint.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to block file uploads to the management console and restrict network access to the console to known, trusted management IP ranges.

Public Exploit Available: No (Exploit available: unknown)

Given the critical CVSS severity and the presence of a proof-of-concept, this vulnerability must be treated as a high-priority incident. Administrators should isolate the management console from the public internet immediately and coordinate with the vendor to apply the required security updates as soon as they are available.