CVE-2026-123087 INCIBE-CERT - Vulnerabilities RSS / 7h The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.

www.incibe.es • November 6, 2026

Puntuación base: 8.70 ALTA Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vector de acceso (AV): A través de red Complejidad de acceso (AC): Bajo Attack Requirements (AT): Ninguno Privilegios Requeridos (PR): Bajo Interacción del usuario (UI): Ninguno Confidentiality (VC): Alto Integrity (VI): Alto Availability (VA): Alto Confidentiality (SC): Ninguno Integrity (SI): Ninguno Availability (SA): Ninguno

Referencias a soluciones, herramientas e información

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SQL Injection Vulnerability Discovered in Atmira’s SIREC A SQL injection vulnerability, identified as CVE-2026-123087, has been disclosed in Atmira’s SIREC. This flaw allows attackers to manipulate SQL queries by injecting malicious input into user-supplied JSON data. The vulnerability affects systems that utilize Atmira’s SIREC and has a CVSS score of 4.0, indicating a low to medium severity. Atmira confirmed that the vulnerability was patched on October 16, 2026, prior to its public disclosure on November 6, 2026. The vulnerability could potentially lead to unauthorized access to sensitive database information. Security professionals are advised to ensure that the patch is applied to mitigate risks associated with this vulnerability. 45

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)