Is CVE-2023-29927 actively exploited?

No active exploitation of CVE-2023-29927 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-29927 be exploited remotely?

Yes. CVE-2023-29927 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-29927?

CVE-2023-29927 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2023-29927

MEDIUM

CVE-2023-29927

NVD-CWE-noinfoPublished: May 16, 2023· Updated: Jun 17, 2026

4.3

CVSS v3.1

Official Description

Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connection strings being used by Sage 300 and interact directly with the underlying database(s) to create, update, and delete all company records, bypassing the program’s role-based access controls.

NVD Source

Technical Analysis

CVE-2023-29927 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.