Platform CVE-2026-5372

While the CVSS v3.1 score of 6.4 (medium) reflects high confidentiality, integrity, and availability impact (C:H/I:H/A:H), multiple mitigating factors significantly reduce real-world exploitation risk. The attack vector is network-based (AV:N), but requires high privileges (PR:H), user interaction (UI:R), and non-standard attack complexity (AC:H), substantially limiting the threat pool. Only trusted administrators or power users can exploit this, and successful exploitation requires them to craft malicious saved queries with SQL injection payloads. The non-zero CVSS score reflects genuine risk to confidentiality and integrity if exploited by a compromised high-privileged account or a malicious insider. EPSS probability data was not provided, but given the privilege and interaction requirements, exploitation likelihood in the wild is lower than the base CVSS would suggest for an unauthenticated network vulnerability. This is a legitimate priority for runZero customers using multi-user deployments with elevated permission models, but lower priority for single-administrator or air-gapped deployments. No public exploit code or active exploitation signals (KEV/POC) were identified in available data.

A malicious insider or attacker with compromised high-privilege credentials in a runZero Platform instance could create a saved query containing SQL injection payloads targeting the underlying database. Upon execution or when another administrative user interacts with the malicious saved query, the injected SQL executes with database permissions, potentially exfiltrating sensitive asset data, modifying scan results, or deleting records. No public proof-of-concept code was identified, but the attack requires only knowledge of SQL injection syntax and access to the saved queries feature-a low bar for someone with administrative-level access.