CVE-2026-18854

Summary

The vulnerability allows for SQL injection through manipulation of the FilterString argument in the GetStoredClassByFilter function, enabling remote code execution.

Exploitability

Exploitation is moderately easy with public disclosure and no vendor response; requires access to the affected service endpoint.

Blast radius

If exploited, could lead to full compromise of systems hosting the PDM product data management system, including potential data theft or manipulation.

Prioritized remediation

Apply immediate patches from the vendor or use alternative secure methods to filter inputs and prevent SQL injection attacks.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.