Is there a public PoC exploit available for EUVD-2026-53016?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53016. Prioritise patching immediately. EPSS: 0.3%.

ESAFENET CDG EUVD-2026-53016

Q: What is the CVSS score of EUVD-2026-53016?

EUVD-2026-53016 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-18859 MEDIUM

SQL Injection (CWE-89)

2026-08-05 VulDB

GHSA-hqxv-537f-gq45

SQLi Cdg Esafenet

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Login endpoint is network-accessible without credentials (AV:N/PR:N); SQLi enables limited data read/write but no scope change or service disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 05, 2026 - 01:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 01:14 vuln.today

CVE Published

Aug 05, 2026 - 00:45 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in ESAFENET CDG's USB key login endpoint allows remote unauthenticated attackers to manipulate backend database queries through the unvalidated keyid parameter at /CDGServer3/ukey/usbkey;logindojojs. All CDG versions up to build 20260615 are affected per CPE data, with impacts spanning limited database read and write access. A public exploit is available (E:P per CVSS 4.0 vector), the vendor has not responded to disclosure, and no patch has been released - leaving all deployed instances exposed with no vendor-confirmed remediation path.

Technical ContextAI

ESAFENET CDG (Document Control and Governance) is a Chinese enterprise DLP and document security platform. The vulnerable endpoint path /CDGServer3/ukey/usbkey;logindojojs is a web handler for USB hardware key (ukey) based authentication, with the logindojo suffix suggesting a Dojo JavaScript framework-backed login interface hosted within the CDG Java application server (CDGServer3). CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates the keyid parameter - representing the USB key identifier submitted during login - is directly concatenated or interpolated into a SQL query without parameterized queries or adequate sanitization. This is a pre-authentication attack surface, as the endpoint handles the login flow itself. CPE cpe:2.3:a:esafenet:cdg:*:*:*:*:*:*:*:* covers all CDG versions with no upper version bound, reflecting that the researcher was unable to identify a patched release.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure, and no patched CDG version is confirmed. As an immediate compensating control, restrict network-level access to the /CDGServer3/ukey/usbkey;logindojojs endpoint at the perimeter firewall or reverse proxy to only IP ranges of hosts legitimately using USB key authentication; this reduces attack surface without disabling the feature for authorized users, though it does not fix the underlying flaw. Deploying a Web Application Firewall with SQL injection rule sets targeting the keyid parameter can block common payload patterns, but WAF bypass through encoding or out-of-band techniques remains possible. If the USB key authentication feature is not required, disabling or removing the endpoint at the application server configuration level eliminates the attack surface entirely. Monitor VulDB entries https://vuldb.com/vuln/385869 and https://vuldb.com/cve/CVE-2026-18859 for any future vendor patch release.