SQL injection in Atmira SIREC lets attackers alter database queries
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
Atmira SIREC before 16/10/2026 is affected. The server concatenates a field value taken from a JSON object containing user-supplied input into an SQL statement without properly sanitising it (CWE-89). A remote attacker with low privileges can alter the original query through malicious input, causing the database to return unexpected information.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Atmira SIREC is fixed in version 16/10/2026.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA SIREC (Atmira) Fixed in 16/10/2026
Timeline
- 2026-11-06 Threatist record created from CVE-2026-123087
- 2026-11-06 Alias added: GHSA-x2hr-mpw9-c694
- 2026-11-07 Priority changed: MEDIUM → LOW
Sources
- CVE-2026-123087 · CVE Program
- CVE-2026-123087 · NVD
- FIRST EPSS
- GHSA-x2hr-mpw9-c694 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences