Read the docs
TI-2026-54213 Aliases CVE-2026-77874GHSA-hcr5-gpj4-pqhc

IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Priority MEDIUM 43CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · Low
Fix status
Partial Red Hat: 10 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-89.

Summary

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00282 20th percentileScored 2026-11-07
Fix Partial Red Hat: 10 advisoriesRed Hat: 10 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMEnterprise Build of Quarkus3.27.1 – 3.27.5.SP1; 3.33.1 – 3.33.3.SP1—No fix listedCNA
  • Enterprise Build of Quarkus VendorIBM Affected 3.27.1 – 3.27.5.SP1; 3.33.1 – 3.33.3.SP1 Fixed in — No fix listed CNA

CPE names CNA · 6

CPEVersionsRoleVendor
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*3.27.1—IBM
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:*:*:*:*:*:*:*3.27.5.sp1—IBM
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:sp1:*:*:*:*:*:*3.27.5.sp1 sp1—IBM
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*3.33.1—IBM
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:*:*:*:*:*:*:*3.33.3.sp1—IBM
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:sp1:*:*:*:*:*:*3.33.3.sp1 sp1—IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:* Versions 3.27.1 — ·IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:*:*:*:*:*:*:* Versions 3.27.5.sp1 — ·IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:sp1:*:*:*:*:*:* Versions 3.27.5.sp1 sp1 — ·IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:* Versions 3.33.1 — ·IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:*:*:*:*:*:*:* Versions 3.33.3.sp1 — ·IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:sp1:*:*:*:*:*:* Versions 3.33.3.sp1 sp1 — ·IBM

Remediation

Red Hat 10 advisories

  • RHSA-2026:95762 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.8 Images Security Update
    • Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:95760 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.17 Images Security Update
    • Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:95761 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.8 Security Update
    • Red Hat build of Keycloak 26.6.8
Show 7 more Red Hat advisories
  • RHSA-2026:95759 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.17 Security Update
    • Red Hat build of Keycloak 26.4.17
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:70257 Released 2026-09-22 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2)
    • Red Hat Build of Apache Camel 3.33.3.SP2 com.github.luben.zstd-jni-1.5.7.16-rhel8-redhat-00001.jar, com.squareup.wire.wire-runtime-6.4.7.jar, com.squareup.wire.wire-runtime-jvm-6.4.7.jar +7
  • RHSA-2026:69440 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3.SP2 release and security update
    • Red Hat build of Quarkus 3.33.3.SP2
  • RHSA-2026:69470 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP2 release and security update
    • Red Hat build of Quarkus 3.27.5.SP2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3Affected—
Red Hat build of Debezium 3AffectedNo fix yet
Red Hat Build of Apache Camel 3.33.3.SP2Fixed RHSA-2026:70257
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat build of Keycloak 26.4Fixed RHSA-2026:95760
Red Hat build of Keycloak 26.4.17Fixed RHSA-2026:95759
Red Hat build of Keycloak 26.6Fixed RHSA-2026:95762
Red Hat build of Keycloak 26.6.8Fixed RHSA-2026:95761
Red Hat build of Quarkus 3.27.5.SP2Fixed RHSA-2026:69470
Red Hat build of Quarkus 3.33.3.SP2Fixed RHSA-2026:69440
Not affected: 13 products
  • Cryostat 4
  • Red Hat Build of Apache Camel 3.33.3.SP2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Web Server 5
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Dev Spaces
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77874
  2. 2026-10-03 Alias added: GHSA-hcr5-gpj4-pqhc
  3. 2026-10-09 Fix available: RHSA-2026:69440 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:69470 · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:70257 · Red Hat
  6. 2026-10-10 Fix available: Red Hat Build of Apache Camel 3.33.3.SP2, Red Hat build of Quarkus 3.27.5.SP2, Red Hat build of Quarkus 3.33.3.SP2 · Red Hat
  7. 2026-10-16 Affected versions changed · Red Hat
  8. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  9. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  10. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  11. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  12. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
  13. 2026-10-24 Affected versions changed · Red Hat
  14. 2026-11-06 Fix available: RHSA-2026:95761 · Red Hat
  15. 2026-11-06 Fix available: Red Hat build of Keycloak 26.6.8 · Red Hat
  16. 2026-11-06 Fix available: RHSA-2026:95760 · Red Hat
  17. 2026-11-06 Fix available: RHSA-2026:95762 · Red Hat
  18. 2026-11-06 Fix available: RHSA-2026:95759 · Red Hat
  19. 2026-11-06 Fix available: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.17, Red Hat build of Keycloak 26.6 · Red Hat

References

Patch 1

  • TI-2026-08085 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-23774 IBM Aspera Faspex code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-03794 Improper authentication in IBM Data Risk Manager KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-03441 Code injection in IBM Planning Analytics KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-06198 Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT… KEVCVSS 3.1CRITICAL 9.8
See all 9711 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences