CVE-2026-89310

Summary

A SQL injection vulnerability exists in the application's database handling where user-supplied parameters from request bodies are directly inserted into T-SQL statements without proper escaping or parameterization, allowing attackers to execute arbitrary SQL commands with the privileges of the database account.

Exploitability

Exploitation is relatively straightforward for a remote attacker who can submit crafted requests to the vulnerable endpoint, requiring only basic SQL injection techniques and no additional authentication or complex preconditions.

Blast radius

The impact could be severe across the entire application's data access layer, potentially allowing attackers to read, modify, or delete sensitive data, escalate privileges, or even execute system commands through database-level operations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Immediate remediation requires upgrading to version 2.590 or later where this SQL injection vulnerability has been patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.