Which versions of Java are affected by CVE-2026-4593?

Organizations using A flaw should be aware of moderate risk from CVE-2026-4593 rated CVSS 6.3. Exploitation could compromise the security of affected deployments.

Is there a public PoC exploit available for CVE-2026-4593?

Yes, a public proof-of-concept exploit is available for CVE-2026-4593. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4593?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Java CVE-2026-4593

Q: What is the CVSS score of CVE-2026-4593?

CVE-2026-4593 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14473 LOW

SQL Injection: Hibernate (CWE-564)

2026-03-23 VulDB

GHSA-473j-28g3-gv2f

Java SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 24, 2026 - 15:54 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 17:15 euvd

EUVD-2026-14473

Analysis Generated

Mar 23, 2026 - 17:15 vuln.today

CVE Published

Mar 23, 2026 - 16:55 nvd

MEDIUM 6.3

DescriptionCVE.org

A flaw has been found in erupts erupt bis 1.13.3. Affected by this vulnerability is the function EruptDataQuery of the file erupt-ai/src/main/java/xyz/erupt/ai/call/impl/EruptDataQuery.java of the component MCP Tool Interface. This manipulation causes sql injection hibernate. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Erupt's MCP Tool Interface allows authenticated attackers to manipulate database queries through the EruptDataQuery component, potentially exposing or modifying sensitive data. The vulnerability affects Java-based Erupt deployments version 1.13.3 and has public exploit code available. No patch is currently available from the vendor, who has not responded to disclosure efforts.

Technical ContextAI

The vulnerability resides in the EruptDataQuery.java file within the erupt-ai module, which handles data query operations through the MCP (Model Context Protocol) Tool Interface. The root cause is classified under CWE-564 (Unsafe Name Mapping), indicating improper handling of user-supplied input that gets passed directly to Hibernate ORM queries without adequate sanitization or parameterization. Erupts Erupt is a low-code/no-code rapid development framework built on Java, and the MCP Tool Interface is designed to bridge external tools with the Erupt data layer. When user input from MCP tools is passed to the EruptDataQuery function, it bypasses proper input validation and becomes part of Hibernate query construction, enabling SQL injection attacks at the database level.

RemediationAI

Immediate action requires upgrading Erupts Erupt to a patched version beyond 1.13.3 if available from the vendor, though note that the vendor has not responded to early disclosure efforts, which may complicate obtaining official patches. As an interim mitigation, restrict network access to the MCP Tool Interface to only trusted internal networks and implement strict authentication controls to limit PR:L exposure to authorized users only. Apply database-level access controls to limit the Erupt application's database user permissions to only necessary tables and operations, reducing the impact scope of successful SQL injection exploitation. Additionally, implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in requests to the EruptDataQuery endpoint, monitor database query logs for anomalous activity, and consider disabling the MCP Tool Interface entirely if it is not actively required for operations. Reference the VulDB entries at https://vuldb.com/?submit.775593 and the published exploit details at https://fx4tqqfvdw4.feishu.cn/docx/EunDdwORZoG3uzxpLykcj24mncJ?from=from_copylink for technical analysis to inform filtering rules.