Unauthenticated SQL Injection Vulnerability in Specific Database Functionality from Vendor
CVE-2026-40827

7HIGH

Key Information:

Vendor: Mb Connect Line
Status: Mbconnect24; Mymbconnect24; Myrex24v2; Myrex24v2.virtual
Vendor: CVE Published:; 27 May 2026

🔔 Create Mb Connect Line Vulnerability Alert

What is CVE-2026-40827?

A vulnerability exists in a database functionality that allows an unauthenticated remote attacker to exploit an SQL Injection flaw in the _RemoveRequest function. The issue arises from the inadequate handling of special elements within a SQL DELETE command, which may enable unauthorized users to gain access to the entire database. This exploitation could lead to sensitive data exposure and possible data manipulation, compromising the confidentiality and integrity of the affected systems.

Affected Version(s)

mbCONNECT24 0.0.0 <= 2.20.0

mbCONNECT24 2.20.0

mymbCONNECT24 0.0.0 <= 2.20.0

References

https://www.certvde.com/en/advisories/VDE-2026-044/

CVSS V4

Score:

Severity:

HIGH

Confidentiality:

High

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 27, 2026
Vulnerability Reserved
Apr 15, 2026

CVE-2026-40827 Data

JSON