What is the CVSS score of CVE-2026-44446?

CVE-2026-44446 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of ERPNext are affected by CVE-2026-44446?

ERPNext deployments running versions prior to 15.104.3 or 16.14.0 contain a SQL injection vulnerability allowing authenticated users to extract sensitive financial and operational data directly from…. A patch is available.

How to fix or mitigate CVE-2026-44446?

24 hours: Inventory all ERPNext instances and document current versions across production and non-production environments. 7 days: Deploy patches to ERPNext 15.104.3 (for 15.x installations) or 16.14.0 (for 16.x installations). 30 days: Validate patch deployment completion, review database access logs for suspicious SQL patterns from the prior 90 days, and confirm no lateral movement from affected systems.

ERPNext CVE-2026-44446

EUVD-2026-30197 HIGH

SQL Injection (CWE-89)

2026-05-13 GitHub_M

SQLi Erpnext

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:02 vuln.today

Patch available

May 13, 2026 - 23:17 EUVD

DescriptionGitHub Advisory

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 15.104.3 and 16.14.0.

AnalysisAI

SQL injection in ERPNext (Frappe's open-source ERP platform) prior to 15.104.3 and 16.14.0 allows authenticated remote attackers to extract sensitive database contents by sending crafted requests to vulnerable endpoints. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability, though EPSS sits at 0.04% and SSVC reports no observed exploitation, indicating this is a high-severity but currently unexploited issue. No public exploit identified at time of analysis.

Technical ContextAI

ERPNext is the business application layer (HR, accounting, inventory, manufacturing) built on top of the Frappe Framework, which uses Python with a MariaDB/MySQL backend. The root cause is CWE-89 (Improper Neutralization of Special Elements in an SQL Command), meaning one or more server-side endpoints concatenate or otherwise pass user-supplied input into SQL queries without proper parameterization or escaping. The CPE cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* confirms the Frappe-maintained ERPNext product line is affected across both the stable 15.x branch and the in-development 16.x beta branch.

RemediationAI

Vendor-released patch: upgrade to ERPNext 15.104.3 (for the 15.x branch) or 16.14.0 (for the 16.x branch) as documented in the upstream advisory at https://github.com/frappe/erpnext/security/advisories/GHSA-6fm9-g88m-hxr7. Because no workaround is published, compensating controls until patching include restricting network exposure of ERPNext to a VPN or IP allowlist, disabling self-service user signup in the System Settings to prevent unauthenticated actors from obtaining the low-privileged account needed for exploitation (trade-off: blocks legitimate portal/customer registration), and enabling database query logging plus monitoring for anomalous query patterns from the Frappe app user (trade-off: noisy and reactive rather than preventive). Review audit logs for unusual data export volume from low-privilege accounts before and after upgrade.