Which versions of Hcm are affected by CVE-2026-15804?

MetaGuru HCM platform contains a SQL injection vulnerability enabling authenticated attackers with low-privilege accounts to gain unauthorized read/write access to the entire backing database.. A patch is available.

How to fix or mitigate CVE-2026-15804?

Within 24 hours, identify all production and non-production MetaGuru HCM instances, audit accounts with low-privilege access to determine usage patterns, and establish communication with MetaGuru for patch timelines. Within 7 days, implement database-layer access restrictions (network segmentation, apply least-privilege database credentials), enable SQL query logging with alerts for injection patterns (UNION, SELECT statements, script syntax), and require multi-factor authentication for low-privilege HCM account access. Within 30 days, test MetaGuru-provided patches in non-production, audit historical database access logs for exploitation indicators, and deploy patches to all affected systems.

Hcm CVE-2026-15804

Q: What is the CVSS score of CVE-2026-15804?

CVE-2026-15804 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44598 HIGH

SQL Injection (CWE-89)

2026-07-15 twcert

GHSA-rxq4-xjvc-9vwx

SQLi Hcm

8.7

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (twcert) · only source for this CVE.

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 09:02 EUVD

Analysis Generated

Jul 15, 2026 - 08:01 vuln.today

CVE Published

Jul 15, 2026 - 07:31 cve.org

HIGH 8.7

DescriptionCVE.org

The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, thereby compromising the confidentiality, integrity, and availability of database data.

AnalysisAI

SQL injection in MetaGuru's HCM (Human Capital Management) platform lets authenticated remote attackers inject malicious SQL through specific request parameters, yielding full read/write control over the backing database and its confidentiality, integrity, and availability. The flaw was reported by TWCERT (Taiwan CERT) and carries a CVSS 4.0 base score of 8.7; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because valid low-privilege credentials are required (PR:L), risk concentrates in environments where accounts are broadly provisioned or credentials can be phished/reused.