CVE-2026-111057 explained: what the Mercury flaw means for your business and how to fix it

The two-minute check

1. Ask whoever set up Mercury whether it is still running anywhere in your business.
2. Open the Mercury application in a browser and look for a version number in the footer or an about page.
3. Check the deployment files, such as a requirements list or container file, for a pinned Mercury version.
4. Note whether the deployment is reachable from the open internet, not just your internal network.

What the record does and does not tell us

The official record for this flaw does not list specific vendor or product names beyond Mercury itself. That is normal for this kind of entry, and it does not mean you are in the clear. The description tells us versions from 3.0.0 up to 3.2.4 are affected, and the fix ships in version 3.2.4. A second, related flaw affects versions before 3.2.6, fixed in that release. If you do not know your current version, treat that as a reason to check today, not a reason to assume you are safe.

What the official record says

This flaw carries a Common Vulnerability Scoring System (CVSS) score of 10, the highest possible, rated CRITICAL (NVD). The scoring details show it can be reached over a network, needs no special skill to pull off, and needs no password or user click. A successful attempt gives the intruder full read, write, and shutdown control over whatever the Mercury process can touch. The same update also covers a related issue, CVE-2026-111058, so installing one update handles both.

The Exploit Prediction Scoring System (EPSS) puts the chance of exploitation in the next 30 days at 0.44%, which sits at the 37th percentile of all scored flaws (FIRST.org). That score is a forecast of near-term attack activity. It is not a measure of how damaging the flaw would be if someone did use it.

What that means for a business like yours

Translate the numbers and the picture is simple. The door is unlocked, and nobody needs a key or a password to walk through it. Right now, the record shows no confirmed attempts to do so. That combination means the risk is real but not currently being chased by attackers at scale, so the smart move is to patch on a normal schedule, not to panic.

If someone else manages your IT

Send this to your provider, word for word:

• "Please confirm whether we run Mercury anywhere in our environment."
• "If we do, please update it to version 3.2.4 or later for CVE-2026-111057."
• "Please also apply version 3.2.6 or later, which covers CVE-2026-111058."
• "Let us know once this is done and confirmed."

If you rely on a managed IT services partner, this kind of check should already be part of their routine patching work.

If you manage it yourself

1. Find every place Mercury runs, including test servers and any cloud instances.
2. Open each instance and note the version shown in the footer or about page.
3. If the version is older than 3.2.6, plan to update it.
4. Read the release notes for version 3.2.6 before you apply it.
5. Apply the update using your normal deployment process.
6. Restart the Mercury service once the update finishes.
7. Reopen the application and confirm the version number changed.

This flaw is not on the Known Exploited Vulnerabilities (KEV) catalog, and the record shows no confirmed exploitation yet. That gives you room to patch on a planned basis rather than as an emergency. A sensible window is within the next few weeks, treated as routine maintenance. That changes if the flaw is added to the KEV catalog later, or if you notice unusual traffic to your Mercury deployment in the meantime.

Do not trust a progress bar alone. After the update, open Mercury in a browser and look at the version shown in the footer or about page. It should read 3.2.6 or higher. If your deployment uses a container image or pinned package file, confirm the version string there matches too. If you have any monitoring in place, check that the Mercury service came back up cleanly after the restart.

If an immediate update is not possible, you can reduce exposure while you plan one. Restrict network access to the Mercury deployment so only trusted internal addresses can reach it; this does not fix the flaw, but it narrows who can try. Require a connection through a virtual private network (VPN) for any remote access, for the same reason. If your setup allows it, disable or firewall off the specific endpoints named in the vendor's advisory until you can upgrade. None of these steps replace the update. They only buy time, and your endpoint detection and response (EDR) tooling or cybersecurity provider should still be watching for odd activity in the meantime.

Do I need to do anything if we only use Mercury internally?

Yes. The scoring details show this can be reached by anyone who can reach the server over a network, which includes your own staff network, not only the public internet. Confirm your version and update it regardless of where it sits.

Will updating break anything?

The record doesn't say which custom configurations might be affected. Read the release notes linked above before updating, and test in a non-critical environment first if you have one.

How do I know if we even have Mercury?

Ask whoever built or deployed your internal dashboards and data tools. If you don't have a clear answer, that is itself worth raising with your IT provider or through a free IT assessment.

Does this affect the rest of our business systems?

The record names no other software, so there is nothing else to flag from this entry. If you handle regulated data, it is still worth confirming your broader patching practices align with requirements like HIPAA or the FTC Safeguards Rule.

What if we don't manage our own servers?

Ask your hosting provider or developer directly whether Mercury runs anywhere in your stack. If you want a second set of eyes, our team offers business-hours support with after-hours emergency response, backed by 20+ years of experience and 100% Texas-based support. Contact us if you'd like help checking.

If you would rather have someone else run this check for you, request a free IT assessment and we'll look at your environment directly.