JTL-WMS CVE-2026-89310

Requires an authenticated session to JTL-WMS with at least low privileges (CVSS PR:L), after which the attacker reaches an endpoint that places a request-body parameter directly into a T-SQL statement without parameterization or escaping (the T-SQL dialect indicates a Microsoft SQL Server backend). No user interaction is needed and the vulnerability is reachable over the network against affected versions. The primary limiting factor is the credential requirement - fully anonymous exploitation is not supported by the vector; exposure is further bounded by whether the JTL-WMS instance is network-reachable to the attacker and whether the vulnerable code path/version is deployed.

This is a genuine high-priority issue, though not a drop-everything emergency absent exploitation signals. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low-privileged authentication and no user interaction, with HIGH impact to confidentiality, integrity and availability of both the vulnerable application and the subsequent database system (VC/VI/VA/SC/SI/SA all H) - consistent with a classic CWE-89 SQL injection that yields full read/write control of the application's database account. The CVSS 4.0 base score of 9.4 is credible given these metrics. However, several signals temper raw severity: there is no EPSS score provided, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The PR:L requirement is a meaningful limiter - an attacker needs valid low-privileged credentials to the application, which narrows the exploit population to insiders, credential-phishing outcomes, or chained auth bypasses rather than fully anonymous internet-wide scanning. Net: a real, actionable patch priority for JTL-WMS operators, but the lack of KEV/EPSS/POC signals and the authentication prerequisite suggest it is not currently under mass exploitation.

An attacker holding a low-privileged JTL-WMS application account submits a request whose body parameter contains SQL syntax; because the value is concatenated into a T-SQL statement without parameterization or escaping, the injected SQL executes against the backend database in the context of the application's database account, allowing extraction or modification of warehouse/order data. No public proof-of-concept is referenced, so exploitation would require an attacker to craft the injection against the vulnerable endpoint themselves. Low attack complexity (AC:L) and no user interaction (UI:N) make successful exploitation straightforward once authenticated.