SQL Injection Vulnerability in DLP On-Prem Extensions by Trellix
CVE-2026-115738

7.1HIGH

Key Information:

Vendor

Trellix

Status
Dlp On-prem Extensions
Vendor
CVE Published:
5 November 2026

What is CVE-2026-115738?

An SQL injection vulnerability exists in the DLP on-prem extensions, allowing remote attackers with authenticated access to execute arbitrary SQL queries. The lack of input sanitization and the absence of parameterized queries in versions 11.13.1 and earlier make these systems susceptible to potential data compromise and unauthorized access.

Affected Version(s)

DLP on-prem extensions 11.13.1 and earlier

References

https://support.trellix.com/s/article/000015949

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.