Trex MES CVE-2026-18782

No special conditions - remote unauthenticated exploitation against network-reachable instances of Trex MES (versions through 2026-09-29), per AV:N/AC:L/PR:N/UI:N. The primary limiting factor is exposure: the affected MES is niche industrial software typically deployed on internal/OT-adjacent manufacturing networks rather than the public internet, so realistic risk hinges on whether the vulnerable web interface is reachable by the attacker. Escalation to OS command execution additionally depends on the database service account's privileges and whether command-execution features (e.g., xp_cmdshell-style procedures) are enabled on the backend.

This is a genuinely high-risk vulnerability by every available signal, though enterprise-wide prevalence tempers the aggregate threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a remote, unauthenticated, low-complexity SQL injection requiring no user interaction, and the description escalates the impact beyond data theft to 'Command Line Execution through SQL Injection' - meaning the SQLi is a pivot to operating-system command execution, which fully justifies the triple-High impact. No EPSS score, CISA KEV entry, POC, or SSVC decision data was supplied in the input, so there is no evidence of active exploitation or public exploit code at time of analysis; the risk is therefore assessed from the vector and description alone. The single reference is a TR-CERT (Turkish national CERT) advisory, which lends credibility to the finding but is not an English-language vendor patch note. Net: the technical severity is real and unauthenticated RCE-class, but exposure depends heavily on the small, industry-specific deployment footprint of this MES product, so prioritize for any organization actually running Trex MES rather than treating it as a broad internet-wide emergency.

A remote unauthenticated attacker reachable over the network sends a crafted request to a Trex MES endpoint that concatenates input into a SQL query, injecting SQL that the backend database executes. Because the description explicitly notes 'Command Line Execution through SQL Injection,' the attacker leverages database features (e.g., stored procedures such as xp_cmdshell or equivalent) to run operating-system commands on the host, achieving full compromise. No public exploit code was identified in the provided data, but the low attack complexity makes exploitation straightforward once the vulnerable parameter is located.