What is the CVSS score of CVE-2026-44047?

CVE-2026-44047 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Suse are affected by CVE-2026-44047?

A high-severity SQL injection vulnerability (CVE-2026-44047) in Netatalk 3.1.0 through 4.4.2 permits authenticated remote attackers to directly manipulate the MySQL-backed CNID database that…. A patch is available.

How to fix or mitigate CVE-2026-44047?

Within 24 hours: Inventory all systems running Netatalk versions 3.1.0 through 4.4.2 and document CNID database backend configurations. Within 7 days: Enforce database-level access restrictions limiting CNID connections to Netatalk service accounts only, enable and monitor MySQL query logging for Netatalk service activity, and review active AFP share configurations to disable unnecessary shares. Within 30 days: Monitor Netatalk project advisories for patch release, establish upgrade testing environment for future patched versions, and implement network segmentation between Netatalk services and CNID databases.

Suse CVE-2026-44047

EUVD-2026-31226 HIGH

SQL Injection (CWE-89)

2026-05-21 securin

GHSA-p2g3-q382-2rhw

SQLi Suse

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 08:00 vuln.today

DescriptionCVE.org

In Netatalk 3.1.0 through 4.4.2, sql injection in mysql cnid backend. Fixed in 4.4.3.

AnalysisAI

SQL injection in Netatalk 3.1.0 through 4.4.2 allows authenticated remote attackers to compromise the MySQL-backed CNID (Catalog Node ID) database used to track AppleTalk/AFP file metadata. The high CVSS 8.8 score (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) reflects network-reachable exploitation with low privileges and high impact to confidentiality, integrity, and availability; no public exploit identified at time of analysis.

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

9.8

CVE-2025-57819 CRITICAL POC

10.0

CVE-2017-8917 CRITICAL POC

9.8

CVE-2024-27956 CRITICAL POC

9.9

CVE-2014-3704 HIGH POC

7.5

CVE-2016-2555 CRITICAL POC

9.8

CVE-2016-8582 CRITICAL POC

9.8

CVE-2015-7297 HIGH POC

7.5

Same technique SQLi

View all

CVE-2025-57819 CRITICAL POC

10.0

CVE-2017-8917 CRITICAL POC

9.8

CVE-2024-27956 CRITICAL POC

9.9

CVE-2014-3704 HIGH POC

7.5

CVE-2016-2555 CRITICAL POC

9.8

CVE-2016-8582 CRITICAL POC

9.8

CVE-2013-0333 HIGH POC

7.5

CVE-2015-7297 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Server 12 SP5	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP5	Fixed
SUSE Linux Enterprise Desktop 12	Fixed

CVE-2026-44047 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Desktop 12 SP1	Fixed
SUSE Linux Enterprise Desktop 12 SP2	Fixed
SUSE Linux Enterprise Desktop 12 SP3	Fixed
SUSE Linux Enterprise Desktop 12 SP4	Fixed
SUSE Linux Enterprise Server 12	Fixed
SUSE Linux Enterprise Server 12 SP1	Fixed
SUSE Linux Enterprise Server 12 SP2	Fixed
SUSE Linux Enterprise Server 12 SP3	Fixed
SUSE Linux Enterprise Server 12 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 12	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP1	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP2	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP3	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP4	Fixed
SUSE Linux Enterprise Software Development Kit 12	Fixed
SUSE Linux Enterprise Software Development Kit 12 SP1	Fixed
SUSE Linux Enterprise Software Development Kit 12 SP2	Fixed
SUSE Linux Enterprise Software Development Kit 12 SP3	Fixed
SUSE Linux Enterprise Software Development Kit 12 SP4	Fixed
SUSE Linux Enterprise Software Development Kit 12 SP5	Fixed
SUSE Linux Enterprise Workstation Extension 12	Fixed
SUSE Linux Enterprise Workstation Extension 12 SP1	Fixed
SUSE Linux Enterprise Workstation Extension 12 SP2	Fixed
SUSE Linux Enterprise Workstation Extension 12 SP3	Fixed
SUSE Linux Enterprise Workstation Extension 12 SP4	Fixed
SUSE Linux Enterprise Workstation Extension 12 SP5	Fixed

Suse CVE-2026-44047

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Same weakness CWE-89 – SQL Injection

Same technique SQLi

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code