EUVD-2026-86012
GHSA-hcr5-gpj4-pqhc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Quarkus-based endpoint
-
ExploitSend crafted HTTP request with SQL payload
-
ExecutionInjection reaches back-end query
-
ImpactRead/modify/delete database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions per the CVSS vector - remote unauthenticated exploitation (AV:N/PR:N/UI:N/AC:L) against applications running the affected IBM Enterprise Build of Quarkus (3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1). Limiting factors: the target must be one of these specific IBM redistribution versions with the vulnerable, network-reachable data-access path exposed; the flaw resides in a niche commercial IBM build rather than upstream Quarkus, so exposure is confined to IBM enterprise deployments of those versions. |
| Impact | This is a genuine high-priority issue on paper: the NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, low-complexity SQL injection with no user interaction, yielding an 8.6 base score with C:H and I:L/A:L. SQL injection (CWE-89) is a well-understood, reliably exploitable class, and the described impact ('view, add, modify, or delete information') is consistent with full read/write database compromise, which arguably justifies higher integrity/availability impact than the vendor assigned. However, several corroborating signals are absent: no EPSS probability was provided, the CVE is NOT in CISA KEV, and no public POC or exploit code is referenced - the only reference is the IBM support advisory itself. So while the theoretical severity and ease of exploitation are high, there is no evidence of active exploitation or in-the-wild weaponization at time of analysis. Net: treat as a real, patch-worthy priority for anyone running the affected IBM Enterprise Build of Quarkus versions, but the low real-world deployment footprint of this specific IBM redistribution tempers broad-fleet urgency. |
| Exploit ScenarioDerived | A remote unauthenticated attacker sends a crafted HTTP request containing malicious SQL to an application built on the vulnerable IBM Enterprise Build of Quarkus, injecting into a back-end query. Because no authentication or user interaction is required (PR:N/UI:N), the attacker can read sensitive data and add, modify, or delete database records. No public exploit code is identified at time of analysis, but SQL injection of this class is trivially exploitable with standard tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
SQL injection in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 allows remote unauthenticated attackers to view, add, modify, or delete back-end database information. The flaw (CWE-89) carries a CVSS 3.1 base score of 8.6, with an independent assessment vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating high confidentiality and integrity impact and low availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch is available via IBM support.
RemediationAI
Patch available per vendor advisory: IBM has released a fix for the affected versions, available at https://www.ibm.com/support/pages/node/7289050. Upgrade to the corrected version specified in the advisory as soon as possible, prioritizing internet-facing instances given the remote unauthenticated nature of the flaw. If immediate patching is not feasible, restrict network access to applications built on the affected IBM Quarkus versions, deploy a web application firewall with SQL injection signatures, and monitor database logs for unusual query patterns. Disabling the vulnerable data-access path may break application functionality; no official workaround is provided by IBM. Since no public exploit code has been identified, the immediate risk of opportunistic attacks is lower, but the high CVSS score warrants prompt action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is a classic SQL injection (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) affecting the IBM Enterprise Build of Quarkus, a commercial redistribution of the Quarkus Kubernetes-native Java framework. The flaw resides in a data-access component or extension included in the IBM build, allowing a remote unauthenticated attacker to inject arbitrary SQL statements through a network-reachable path. The CPE string cpe:2.3:a:ibm:enterprise_build_of_quarkus confirms the affected product is IBM's enterprise build specifically, not necessarily upstream Quarkus. The vulnerability is exploitable without authentication (PR:N) or user interaction (UI:N) over the network (AV:N) with low complexity (AC:L), meaning any exposed application using the affected versions could be targeted. The root cause is likely insufficient input sanitization or parameterization in a JDBC or ORM interaction layer within the IBM-maintained build.
Know when Enterprise Build Of Quarkus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Remote unauthenticated SQLi (AV:N/AC:L/PR:N/UI:N); 'add, modify, or delete' warrants I:H over the vendor's I:L, C:H for full read, A:L for possible destructive/DoS effects.
Primary rating from Vendor (ibm).
CVSS VectorNVD
DescriptionNVD
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Articles & Coverage 1
Executive ViewAI
IBM's Enterprise Build of Quarkus, the Java runtime underlying a portion of our application estate, contains a SQL injection flaw (CVE-2026-77874) that allows an unauthenticated network attacker to read, alter, or destroy data in connected back-end databases. Because no credentials are required, any internet- or partner-facing Quarkus service on the affected release trains effectively exposes its database tier to outsiders. A vendor fix is already available, so leadership should treat this as a scheduled, high-priority remediation rather than an incident, while recognizing that database corruption or data exposure would carry regulatory and operational consequences.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB