Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
SQL injection vulnerability in Atmira's SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitizing the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.
An unauthenticated attacker over the network can inject malicious SQL code to alter database queries and retrieve unexpected or sensitive information from the database.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch available. Update Atmira SIREC to version 16/10/2026 or later.
Immediately update Atmira SIREC to the patched version (16/10/2026 or later). Implement input validation and parameterized queries to prevent SQL injection. Apply network segmentation to restrict database access. Monitor database logs for suspicious query patterns.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feedly found the first article mentioning CVE-2026-123087 . See article
NVD published the first details for CVE-2026-123087
A CVSS base score of 8.7 has been assigned.
GitHub Advisories released a security advisory .
CVE-2026-123087 - Exploits & Severity - Feedly
SQL injection in Atmira’s SIREC
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
