Which versions of Zalktis are affected by CVE-2026-59109?

Zalktis accounting software versions before 2026.1.586 (v1 branch) and 2026.2.592 (v2 branch) contain a high-severity SQL injection vulnerability in electronic invoice processing that allows external…. A patch is available.

How to fix or mitigate CVE-2026-59109?

Within 24 hours, identify all Zalktis deployments and verify running versions against 2026.1.586 (v1) and 2026.2.592 (v2) baselines; implement strict validation and sanitization on all invoice field inputs before database processing; restrict invoice submission access to pre-authorized trading partners via network allowlist. Within 7 days, deploy database activity monitoring and query audit logging; implement network segmentation isolating the Zalktis application from other enterprise systems; restrict the Zalktis service account database permissions to minimum necessary privileges, removing access to tables unrelated to invoice processing. Within 30 days, establish vendor communication protocols to track patch availability; assess alternative accounting software platforms for migration planning; deploy Web Application Firewall rules configured to detect and block SQL injection patterns in invoice submission if technically feasible.

Zalktis CVE-2026-59109

Q: What is the CVSS score of CVE-2026-59109?

CVE-2026-59109 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-58133 HIGH

SQL Injection (CWE-89)

2026-08-13 ENISA

GHSA-r3xf-cfg3-3pgx

SQLi Zalktis

8.7

CVSS 4.0 · Vendor: ENISA

Severity by source

Vendor (ENISA) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Payload delivered over network with no attacker privileges, but victim must perform the invoice import (UI:R); impact confined to the accounting database with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ENISA).

CVSS VectorVendor: ENISA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Aug 13, 2026 - 18:04 EUVD

Analysis Generated

Aug 13, 2026 - 17:36 vuln.today

CVSS changed

Aug 13, 2026 - 17:22 NVD

8.8 (HIGH) 8.7 (HIGH)

CVE Published

Aug 13, 2026 - 16:40 cve.org

HIGH 8.7

DescriptionCVE.org

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic.

This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.

AnalysisAI

SQL injection in Zalktis accounting software allows an external trading partner to execute arbitrary database queries by embedding malicious payloads in electronic invoice fields (UBL/PEPPOL format). Versions before 2026.1.586 (v1 branch) and 2026.2.592 (v2 branch) concatenate partner-controlled invoice field values directly into SQL statement text, bypassing the application's own Dazadi.sql_txt() escaping helper on the e-invoice and e-commerce import code paths. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the attack surface is inherent to the standard business workflow of receiving and importing invoices from counterparties.

Technical ContextAI

The vulnerability resides in the e-invoice import functionality of the Zalktis accounting application, developed by Latvian vendor SIA 'Zalktis Programmas' (CPE: cpe:2.3:a:zalktis_programmas_(sia_"zalktis_programmas"):zalktis). The affected code paths process UBL (Universal Business Language) and PEPPOL-format electronic invoices, as well as e-commerce export documents - standardized XML-based B2B document formats used for automated invoice exchange across EU markets. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: string values sourced from invoice fields under trading-partner control are concatenated directly into SQL query text with neither parameterized queries nor sanitization. The application possesses a dedicated escaping helper, Dazadi.sql_txt(), but this function is not called on the invoice import code paths, meaning the protective mechanism exists in the codebase but is simply absent where external data enters SQL statements.

RemediationAI

Organizations should upgrade Zalktis immediately to version 2026.1.586 or later on the v1 branch, or to version 2026.2.592 or later on the v2 branch - these are the confirmed fixed releases per the CVE description. For organizations unable to patch immediately, a targeted compensating control is to disable the UBL/PEPPOL e-invoice import and e-commerce export import features entirely within Zalktis; this eliminates the vulnerable code path at the cost of disrupting automated invoice ingestion workflows, which may require manual re-entry of invoices. A less disruptive alternative is to restrict which counterparties may submit electronic invoices by enforcing allowlist-based validation at the network or procurement layer before documents reach Zalktis, reducing the pool of parties who can deliver a malicious payload. Neither workaround replaces patching. Consult the OFFSEQ research advisory at https://offseq.com/en/research/zalktis-cve-2026-59109 and CERT Latvia at https://cvd.cert.lv/disclosed/vuln-all-631428755 for vendor-specific guidance.