What is the CVSS score of CVE-2026-5372?

CVE-2026-5372 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5372?

Yes, a patch is available for CVE-2026-5372. Update the affected software to the latest version immediately.

Platform CVE-2026-5372

EUVD-2026-19632 MEDIUM

SQL Injection (CWE-89)

2026-04-07 runZero

SQLi Platform Runzero

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.0.260123.1

EUVD ID Assigned

Apr 07, 2026 - 14:30 euvd

EUVD-2026-19632

Analysis Generated

Apr 07, 2026 - 14:30 vuln.today

CVE Published

Apr 07, 2026 - 14:10 nvd

MEDIUM 6.4

DescriptionCVE.org

An issue that allowed a SQL injection attack vector related to saved queries (introduced in version 4.0.260123.0). This is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H (6.4 Medium). This issue was fixed in version 4.0.260123.1 of the runZero Platform.

AnalysisAI

SQL injection in runZero Platform versions 4.0.260123.0 through 4.0.260123.0 allows authenticated high-privileged users to execute arbitrary SQL commands via improperly sanitized saved query parameters, potentially leading to unauthorized data access, modification, or deletion. The vulnerability requires high privileges, user interaction, and non-standard attack complexity, resulting in a CVSS 6.4 medium severity rating. Vendor-released patch version 4.0.260123.1 addresses the issue.

Technical ContextAI

This SQL injection vulnerability (CWE-89) stems from improper neutralization of special SQL characters in saved query processing within the runZero Platform. The vulnerability was introduced in version 4.0.260123.0, indicating a regression or new feature that failed to implement parameterized query construction or input validation. The attack surface is limited to the saved queries feature, which suggests the injection point exists in query storage, retrieval, or execution logic. CPE designation cpe:2.3:a:runzero:platform indicates the issue affects the runZero commercial asset discovery and management platform, a tool used for network reconnaissance and vulnerability assessment. The requirement for PR:H (high privileges) indicates the affected functionality is restricted to administrative or power-user roles within the platform.

RemediationAI

Vendor-released patch: Upgrade runZero Platform from version 4.0.260123.0 to version 4.0.260123.1 or later. This patch resolves the SQL injection vulnerability in saved query processing by implementing proper input validation and/or parameterized query construction. As an interim mitigation pending patch deployment, organizations should restrict saved query creation and modification to the most trusted administrative accounts and audit saved query usage for suspicious payloads. Detailed remediation guidance and release notes are available in the runZero advisory at https://www.runzero.com/advisories/runzero-platform-saved-sqli-cve-2026-5372/ and release notes at https://help.runzero.com/docs/release-notes/#402602020.