EUVD-2026-88252
GHSA-x97r-h523-63rw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySubmit crafted input to vulnerable parameter
-
ExploitInject SQL into backend query
-
ExecutionRead or modify archived database records
-
ImpactExfiltrate or destroy stored data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege authenticated session to Iron Mountain enVision (PR:L) that can reach an input field or parameter improperly neutralized before use in a SQL command; from there exploitation is network-based, low-complexity, and needs no user interaction. The primary limiting factor is the authentication requirement - an attacker must already possess or obtain credentials - and exploitation is bounded to enVision instances running a build before 260655. The specific vulnerable feature/endpoint is not named in the available data, so defenders should consult the TR-CERT advisory to identify the exact input surface. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity SQL injection requiring only low-privilege authentication and no user interaction, with high impact to confidentiality, integrity, and availability - a genuinely serious weakness where an authenticated user can read, alter, or destroy database contents. However, the exploitation signals temper the priority: no EPSS score is provided, the CVE is not on CISA KEV, and no public POC is referenced, so this is no public exploit identified at time of analysis. The PR:L requirement means an attacker must first obtain valid (even low-tier) credentials, which meaningfully limits opportunistic mass exploitation compared to an unauthenticated SQLi. This is a real, patch-worthy issue rather than a hollow high-CVSS score, but in the absence of KEV/EPSS/POC signals it reads as a latent risk to remediate promptly, not evidence of ongoing campaigns. Note the affected-version boundary is given only as an opaque build number 'before 260655' with no semantic version, so version-scoping should be confirmed against the vendor/TR-CERT advisory. |
| Exploit ScenarioDerived | An attacker holding a low-privilege enVision account submits crafted input into an application field or API parameter that is concatenated into a SQL query, injecting attacker-controlled SQL. Because complexity is low and no user interaction is needed, the attacker can dump archived records, tamper with data, or degrade the database over the network in a single request sequence. No public exploit code is currently identified, so exploitation would require an attacker to develop the injection independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 28, 2026
Authenticated SQL injection in Iron Mountain enVision builds prior to 260655 allows a network-based attacker holding a low-privilege account to inject arbitrary SQL through an improperly neutralized input parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) reflects low-complexity exploitation with no user interaction and high impact across confidentiality, integrity, and availability, meaning an authenticated user could read, modify, or destroy database contents. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the vendor reports a patch is available; discovery is credited to TR-CERT (Turkish national CERT).
Earlier versions of this analysis (1)
SQL injection in Iron Mountain enVision archiving software (all builds before 260655) lets a network-positioned attacker with a valid low-privilege account inject arbitrary SQL into the application's backend queries and read data the account should not be able to reach. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms high confidentiality impact only, with no integrity or availability effect - an attacker reads, but does not modify or destroy, data. Exploitation is gated by prior authentication (PR:L) on a specialized enterprise records/archiving platform rather than broadly exposed internet software, and no public exploit identified at time of analysis; the specific vulnerable parameter or endpoint is not disclosed in the available data.
RemediationAI
Upgrade Iron Mountain enVision to build 260655 or later - the vendor states a patch is available and 260655 is the first non-vulnerable build per the affected-version range - and verify the running build number in the product's version/about view after upgrading. Where immediate upgrade is not possible, apply layered compensating controls: enforce least privilege on the database account enVision uses so a successful injection cannot reach unrelated schemas, tables, or stored procedures (trade-off: legitimate functionality requiring elevated DB rights may break and must be re-granted narrowly); restrict access to the enVision management and reporting interfaces to trusted networks or VPN, since exploitation requires an authenticated session over the network (trade-off: reduces usability for remote and third-party users); audit and prune low-privilege accounts, enforce strong authentication, and monitor for anomalous query patterns, error-based responses, or unexpected database errors (trade-off: monitoring generates noise and requires tuning). Deploying a WAF with SQL-injection signatures in front of enVision can reduce exploitability but is a stopgap only and may be bypassed by encoding tricks. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1201 and the vendor for the specific vulnerable endpoint and any vendor-supplied interim guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in an SQL command: user-supplied input is concatenated or otherwise incorporated into a SQL statement without parameterization or escaping, allowing an attacker to alter query logic. The affected component is the enVision application published by Iron Mountain Archiving Services Inc., identified by the wildcard CPE cpe:2.3:a:iron_mountain_archiving_services_inc.:envision:*:*:*:*:*:*:*:* - meaning the CPE does not pin a specific operating system or hardware platform, so the SQLi surface is in the application layer rather than a platform-specific component. The vulnerable input surface is reached over the network (AV:N) at low attack complexity (AC:L) and requires a valid low-privilege authenticated session (PR:L) with no user interaction (UI:N); the vulnerable feature or endpoint is not named in the available data (CVE.org, ENISA EUVD-2026-88252, and the TR-CERT advisory noted in references), so the exact request parameter must be identified from the vendor or TR-CERT advisory before targeted testing. Because the SQL statement executes under the application's own database credentials, the blast radius is bounded by the privileges of that database account, which is why reducing those privileges is a meaningful compensating control.
Know when Envision gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SQLi needing only low-privilege auth (PR:L) and no interaction; classic CWE-89 grants full DB read/write/destroy, so C/I/A:H and scope unchanged.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection.
This issue affects enVision: before 260655.
Executive ViewAI
Iron Mountain enVision deployments running builds earlier than 260655 carry a high-severity SQL injection flaw that allows the holder of any routine, low-privilege account to read, alter, or destroy the contents of the platform's underlying database. Because enVision typically consolidates backup, asset, and retention data, a successful attack could undermine the confidentiality, integrity, and availability of records the organization relies on for recovery and compliance obligations. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so near-term risk is driven primarily by internal misuse or compromised credentials rather than broad opportunistic exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountai
EMC RSA enVision 4.x before 4.1 Patch 4 uses unspecified hardcoded credentials, which makes it easier for remote attacke
EMC RSA enVision 4.x before 4.1 Patch 4 does not properly restrict the number of failed authentication attempts, which m
Multiple SQL injection vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote authenticated users to ex
Directory traversal vulnerability in EMC RSA enVision 4.x before 4.1 Patch 4 allows remote authenticated users to have a
Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote attackers to
Exploit-DB