CVE-2026-89310
9.9CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-89
Impact
Authenticated attackers can run arbitrary SQL commands in the context of the application's database account. They only need low-privilege network access to send a malicious request body.
Root cause
A request body parameter is concatenated directly into a T-SQL query without escaping or parameterization.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade the affected JTL application to the patched release specified in the vendor advisory, or restrict database account permissions and block malicious request bodies via WAF rules if patching must wait.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.