What is the CVSS score of CVE-2026-44447?

CVE-2026-44447 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of ERPNext are affected by CVE-2026-44447?

ERPNext deployments running versions prior to 16.9.0 are vulnerable to SQL injection attacks that allow authenticated users to extract or modify sensitive business data (CVE-2026-44447, CVSS 8.8).. A patch is available.

How to fix or mitigate CVE-2026-44447?

Within 24 hours: Inventory all ERPNext instances and identify those running versions prior to 16.9.0. Within 7 days: Deploy ERPNext 16.9.0 or later through change management procedures. Within 30 days: Audit all production systems to confirm patch deployment and conduct limited security testing of patched instances.

ERPNext CVE-2026-44447

EUVD-2026-30198 HIGH

SQL Injection (CWE-89)

2026-05-13 GitHub_M

SQLi Erpnext

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:41 vuln.today

Patch available

May 13, 2026 - 23:17 EUVD

DescriptionGitHub Advisory

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 16.9.0.

AnalysisAI

SQL injection in ERPNext versions prior to 16.9.0 allows authenticated remote attackers to extract sensitive data by sending specially crafted requests to vulnerable endpoints. The Frappe-maintained ERP platform requires low-privileged authentication (PR:L) but has high impact on confidentiality, integrity, and availability per CVSS 8.8. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%).

Technical ContextAI

ERPNext is an open-source Enterprise Resource Planning application built on the Frappe framework (Python/MariaDB stack), widely deployed for accounting, HR, inventory, and CRM workflows. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input reaches the database query layer without adequate parameterization or sanitization. The affected CPE is cpe:2.3:a:frappe:erpnext, and the issue spans multiple endpoints rather than a single function, suggesting systemic input-handling gaps in request processing rather than a one-off bug.

RemediationAI

Vendor-released patch: upgrade ERPNext to 16.9.0 or later, per the GitHub Security Advisory at https://github.com/frappe/erpnext/security/advisories/GHSA-q65v-fm9p-9vh3. For deployments that cannot patch immediately, restrict access to the ERPNext web interface using network ACLs or VPN-only access to reduce the pool of authenticated attackers, audit and disable unused low-privilege accounts (especially self-service portal/customer accounts), and enable database-level query logging or a WAF with SQLi signatures in front of the Frappe app server - noting that WAF rules may produce false positives against legitimate report-building queries and Frappe's report-builder API. Review database user privileges granted to the Frappe application user and apply least privilege where feasible, which will limit the blast radius but may break some ERPNext features that rely on broad DB access.