Microsoft SQL Server Login Vulnerability in Jumis by Mans Jumis
CVE-2026-59105

9.3CRITICAL

Key Information:

Vendor

Jumis Pro Sia

Status
Jumis
Vendor
CVE Published:
6 November 2026

What is CVE-2026-59105?

The Jumis application utilizes a Microsoft SQL Server login with a password derived deterministically from the non-secret SQL Server name. This method allows individuals who can access the SQL Server instance to easily compute the password offline, leading to unauthorized administrative access. The impact is severe as authenticated users are granted sysadmin privileges, enabling control over the database and potential execution of operating system commands through the enabled xp_cmdshell.

Affected Version(s)

Jumis 0

References

https://offseq.com/en/research/jumis-cve-2026-59105/
third-party-advisory
https://www.mansjumis.lv/
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

OffSeq Cybersecurity (https://offseq.com)
.