SQL Injection Vulnerability in IBM Enterprise Build of Quarkus
CVE-2026-77874

8.6HIGH

Key Information:

Vendor

IBM
Status
Enterprise Build Of Quarkus
Vendor
CVE Published:
24 September 2026

What is CVE-2026-77874?

The IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 are susceptible to SQL injection vulnerabilities. Attackers can exploit this flaw by sending specially crafted SQL queries, potentially allowing them unauthorized access to the back-end database. Successful exploitation could lead to viewing, adding, modifying, or deleting critical data, posing significant risks to data integrity and security.

Affected Version(s)

Enterprise Build of Quarkus 3.27.1 <= 3.27.5.SP1

Enterprise Build of Quarkus 3.33.1 <= 3.33.3.SP1

References

https://www.ibm.com/support/pages/node/7289050
vendor-advisorypatch

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.