MCMS CVE-2026-88414

Exploitation requires network access to an MCMS instance running versions 6.1.1 through 6.2.1 with the /ms/mdiy/page/verify.do endpoint reachable; no authentication, user interaction, or non-default configuration is indicated (CVSS PR:N/UI:N), so a default-exposed MCMS deployment is directly attackable. The primary limiting factor is deployment scope: MCMS is a niche CMS, so realistic exposure depends on the instance being internet- or attacker-network-reachable. No feature toggle or special mode is named in the description as a prerequisite.

This is a classic high-severity signal profile with a low real-world-exploitation signal underneath it. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects an unauthenticated, network-reachable SQL injection (CWE-89) in a GET endpoint - mechanically trivial to exploit and the kind of flaw that is routinely automatable once a working payload is public. However, EPSS is only 0.19% (9th percentile), there is NO CISA KEV listing, and no functional exploit code is confirmed in the provided sources - the sole primary reference is a GitHub issue (15536818056/CVE/issues/1) that reports the finding and may contain reproduction detail but is not verified here as weaponized exploit code. The tension to flag: the CVSS vector rates all three impacts High (C:H/I:H/A:H), but a pure SQL injection via a single GET parameter more typically yields full database read and write (C:H/I:H) rather than guaranteed availability destruction (A:H) unless stacked queries permit destructive statements - the A:H rating looks inflated. Net: the flaw is genuinely dangerous where MCMS is exposed to untrusted networks, but the low EPSS and absence of KEV/confirmed POC indicate this is NOT yet under widespread active exploitation. Priority is driven by the unauthenticated+automatable nature, tempered by the product's small deployment footprint.

A remote, unauthenticated attacker sends a crafted GET request to /ms/mdiy/page/verify.do with a malicious SQL payload in a parameter consumed by PageAction.verify, injecting into the backend query to extract database contents (credentials, content, session data) or modify records. Because the vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability to the MCMS instance and can be automated with standard tooling such as sqlmap. A GitHub issue documenting the vulnerability exists, but no confirmed functional exploit code was identified in the provided data.