What is the CVSS score of EUVD-2026-42965?

EUVD-2026-42965 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of MobilMen 20T are affected by EUVD-2026-42965?

Critical SQL injection vulnerability in Adam Retail Automation's MobilMen 20T retail-automation platform (versions v3 through build 10072026) enables unauthenticated remote attackers to achieve full…

How to fix or mitigate EUVD-2026-42965?

24 hours: Restrict all MobilMen 20T instances to private network access only; disable internet-facing exposure; enable database connection logging and configure alerts for unusual queries. 7 days: Deploy Web Application Firewall (WAF) rules blocking SQL metacharacters and common injection patterns to the MobilMen 20T application endpoint; conduct forensic review of all database access logs from past 90 days for indicators of exploitation. 30 days: Contact vendor (Adam Retail Automation) for emergency security patch or formal workaround; if unavailable, execute migration to alternative PCI-DSS-compliant retail automation platform or decommission MobilMen 20T systems; complete incident response assessment.

MobilMen 20T EUVD-2026-42965

| CVE-2026-2397 CRITICAL

SQL Injection (CWE-89)

2026-07-10 TR-CERT

GHSA-r958-fxrc-p879

SQLi Mobilmen 20T

9.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated SQL injection over the network (AV:N/AC:L/PR:N/UI:N) grants full database read/write, so C:H/I:H/A:H; scope unchanged as impact stays within the database system.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 18:25 vuln.today

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection.

This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Adam Retail Automation's MobilMen 20T retail-automation software (versions v3 through build 10072026) lets remote attackers inject arbitrary SQL through improperly neutralized input, yielding full read/write access to the backing database. Rated CVSS 9.8 by TR-CERT with an unauthenticated network-reachable vector, though no public exploit has been identified and it is not on CISA KEV. The vendor was contacted but did not respond, so no fix is available.

Technical ContextAI

MobilMen 20T is a retail/point-of-sale automation product from the Turkish vendor Adam Retail Automation Ltd. (CPE cpe:2.3:a:adam_retail_automation_ltd.:mobilmen_20t). The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue: user-controlled input is concatenated into SQL statements without parameterization or proper escaping, so crafted values break out of the intended query context and are executed by the database engine. Because retail automation platforms typically store pricing, inventory, transaction and customer/payment records, the underlying database is a high-value target.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor was contacted early but did not respond, so no fixed version number exists to cite. In the absence of a patch, apply compensating controls: place MobilMen 20T behind a WAF with SQL-injection signatures to filter malicious input (accepting that WAF rules can be bypassed and may need tuning to avoid breaking legitimate POS transactions); restrict network access to the application so only trusted POS terminals and management hosts can reach it, ideally removing any internet exposure and segmenting it onto an isolated VLAN (trade-off: remote/branch access must be routed through VPN); enforce least-privilege on the application's database account so a successful injection cannot escalate beyond the minimum required tables (trade-off: requires testing to confirm the app still functions); and enable database query logging/monitoring to detect anomalous statements. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0526 and, given the unresponsive vendor, evaluate migrating off the product if a maintained alternative exists.