Which versions of Java are affected by CVE-2026-4594?

A critical SQL injection vulnerability in the Erupt framework (versions through 1.13.3) allows unauthenticated attackers to compromise sensitive data and system integrity.

Is there a public PoC exploit available for CVE-2026-4594?

Yes, a public proof-of-concept exploit is available for CVE-2026-4594. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4594?

Within 24 hours: Identify all systems running Erupt framework versions ≤1.13.3 and isolate them or disable internet-facing access; implement emergency WAF rules to block malicious sort.field parameters. Within 7 days: Deploy network segmentation to restrict access to affected systems; conduct forensic logs review for signs of exploitation. Within 30 days: Upgrade to patched framework version when released; perform comprehensive security assessment of affected databases for unauthorized access or data exfiltration.

Java CVE-2026-4594

Q: What is the CVSS score of CVE-2026-4594?

CVE-2026-4594 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14475 MEDIUM

SQL Injection: Hibernate (CWE-564)

2026-03-23 VulDB

GHSA-8fx2-x558-87xq

SQLi Java

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 24, 2026 - 16:37 NVD

HIGH MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 24, 2026 - 15:54 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 18:00 euvd

EUVD-2026-14475

Analysis Generated

Mar 23, 2026 - 18:00 vuln.today

CVE Published

Mar 23, 2026 - 17:41 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in erupts erupt up to 1.13.3. Affected by this issue is the function geneEruptHqlOrderBy of the file erupt-data/erupt-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java. Such manipulation of the argument sort.field leads to sql injection hibernate. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Erupt up to version 1.13.3 allows unauthenticated remote attackers to execute arbitrary SQL queries through the sort.field parameter in the HQL query builder. Public exploit code exists for this vulnerability, and no patch is currently available. Affected Java applications using vulnerable versions of Erupt are at risk of data exfiltration and manipulation.

Technical ContextAI

This vulnerability affects the erupts erupt framework (CPE: cpe:2.3:a:erupts:erupt), specifically the JPA (Java Persistence API) data layer component. The flaw is classified as CWE-564 (SQL Injection: Hibernate), indicating improper input validation when constructing Hibernate Query Language (HQL) statements. The geneEruptHqlOrderBy function in EruptJpaUtils.java fails to properly sanitize the sort.field parameter before incorporating it into HQL ORDER BY clauses. Unlike traditional SQL injection, HQL injection targets the object-relational mapping layer, allowing attackers to manipulate queries executed against the underlying database through Hibernate's query translation mechanism. This type of injection can bypass typical SQL injection defenses if developers assume ORM frameworks inherently prevent injection attacks.

RemediationAI

Upgrade to erupts erupt version 1.13.4 or later if the vendor has released a patched version, though no official patch has been confirmed as the vendor did not respond to disclosure attempts. In the absence of vendor patches, immediately implement input validation and sanitization on all user-controllable sort parameters before they reach the geneEruptHqlOrderBy function. Use parameterized queries or Hibernate Criteria API instead of dynamic HQL string concatenation for ORDER BY clauses. Apply a whitelist-based validation approach that only allows predefined, safe column names for sorting operations. As an additional defense layer, restrict network access to the application to trusted IP ranges and implement web application firewall (WAF) rules to detect and block SQL injection patterns. Monitor application logs for suspicious sorting parameter values that contain SQL keywords or special characters. Given the vendor's lack of response, consider migrating to an actively maintained alternative framework if this component is critical to your infrastructure.