CVE-2026-94492

Summary

The flaw allows SQL injection via manipulation of the operator argument in Yonyou U8cloud 5.x's OpenAPI module, enabling remote code execution.

Exploitability

Exploitation is moderately easy with public exploits available; requires access to the API endpoint and control over the 'operator' parameter.

Blast radius

If exploited, this could lead to full compromise of affected systems, including data theft or manipulation.

Prioritized remediation

Apply vendor patches immediately or disable the vulnerable OpenAPI endpoint until a fix is released.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.