What is the CVSS score of CVE-2026-5801?

CVE-2026-5801 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of SEM-PMP are affected by CVE-2026-5801?

Semtek SEM-PMP (through build 23042026) contains a critical SQL injection vulnerability (CVE-2026-5801, CVSS 9.8) that allows unauthenticated attackers to execute arbitrary operating-system commands…

How to fix or mitigate CVE-2026-5801?

Within 24 hours: Inventory all Semtek SEM-PMP deployments and identify build versions; restrict network access to SEM-PMP ports from untrusted sources. Within 7 days: Deploy network-layer compensating controls including WAF rules for SQL injection detection and input validation; contact Semtek for patch availability and timeline. Within 30 days: Apply vendor patch immediately upon release; if no patch emerges, evaluate product replacement or permanent decommissioning based on operational criticality.

SEM-PMP CVE-2026-5801

EUVD-2026-42972 CRITICAL

SQL Injection (CWE-89)

2026-07-10 TR-CERT

GHSA-q94r-r39w-76f6

SQLi Sem Pmp

9.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable SQL injection (AV:N/AC:L/PR:N/UI:N) yielding command execution gives full C/I/A impact; scope unchanged as OS access stems from DB privileges within the same authorization context.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 18:52 vuln.today

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM-PMP allows Command Line Execution through SQL Injection.

This issue affects SEM-PMP: through 23042026.

AnalysisAI

SQL injection in Semtek SEM-PMP through build 23042026 allows remote attackers to inject arbitrary SQL and, per the vendor description, escalate to operating-system command execution through the database layer. The flaw carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating and is reachable over the network without authentication or user interaction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the combination of unauthenticated network reach and command-execution impact makes it a high-priority patching target.

Technical ContextAI

SEM-PMP is a proprietary application from the Turkish vendor Semtek Informatics Software Consulting Trade Ltd. Co., coordinated through the Turkish national CERT (TR-CERT/USOM). The root cause is CWE-89, improper neutralization of special elements in an SQL command: user-controlled input is concatenated into SQL statements without parameterization or sanitization, letting an attacker alter query structure. Notably, the vendor states the SQL injection reaches 'Command Line Execution,' implying the backend database is configured with OS-command capabilities (e.g., xp_cmdshell on MS SQL Server, or equivalent stored-procedure/UDF facilities), so a query-layer flaw becomes a host-level code execution primitive. The single CPE, cpe:2.3:a:semtek_informatics_software_consulting_trade_ltd._co.:sem-pmp:*:*:*:*:*:*:*:*, confirms all versions are in scope up to the fixed build.

RemediationAI

Upgrade SEM-PMP to a build newer than 23042026, following the fixed release referenced in the TR-CERT/USOM advisory TR-26-0527 (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0527); the input data does not name an exact patched version string, so confirm the current fixed build directly with Semtek. If patching cannot be done immediately, restrict network access to the SEM-PMP application (place it behind a VPN or IP allowlist so it is not internet-exposed) and deploy a WAF with SQL injection signatures in front of it - noting WAF rules can be bypassed and may cause false positives. Critically, disable dangerous database command-execution features on the backend (for MS SQL Server, disable xp_cmdshell and remove OLE Automation/unnecessary extended stored procedures) and run the application's database account under least privilege so a successful injection cannot reach the OS shell; the trade-off is that any legitimate feature relying on those procedures will break, which should be validated first. Monitor database and application logs for anomalous query patterns and unexpected process creation while remediation is pending.