Back securityvulnerability.io

SQL injection in Atmira’s SIREC High & Critical Vulnerabilities / 10h Atmira - Sirec - HIGH - CVE-2026-123087. SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.

securityvulnerability.io • November 6, 2026

Atmira's SIREC is susceptible to an SQL injection vulnerability that occurs when user-supplied data is improperly concatenated into SQL statements. This flaw allows attackers to manipulate queries through malicious inputs, potentially revealing unauthorized data and causing significant security risks for the affected database. Organizations using SIREC must urgently address this vulnerability to safeguard their data integrity and security.

Download the Critical Vulnerability Management Cheat Sheet

Vulnerability published Nov 6, 2026

Vulnerability published

Vulnerability Reserved Nov 5, 2026

Vulnerability Reserved

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SQL Injection Vulnerability in Atmira's SIREC (CVE-2026-123087) A SQL injection vulnerability, identified as CVE-2026-123087, has been discovered in Atmira's SIREC system. This flaw arises from improper handling of user-supplied data, allowing unauthenticated attackers to manipulate SQL queries and potentially access sensitive information. The vulnerability has a CVSS score of 8.7, categorizing it as high severity. No public proof-of-concept or evidence of has been reported at this time. Organizations using SIREC are urged to update to version 16/10/2026 or later to mitigate this risk. Security measures such as input validation and parameterized queries are recommended to prevent SQL injection attacks. The vulnerability was disclosed on November 6, 2026. 1 sources 66

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)