{"id":"CVE-2026-115738","kind":"vulnerability","aliases":["CVE-2026-115738"],"related":[],"title":"DLP on-prem extensions: SQL injection by a logged-in remote user","description":"SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries.","summary":"DLP on-prem extensions version 11.13.1 and earlier build SQL queries without sanitizing input or using parameterized queries. A remote attacker with a valid account can inject SQL to read or change data in the database.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dlp","on-prem","other","sql"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed DLP on-prem extensions version against `11.13.1`","fix":"- DLP on-prem extensions: unknown (move to a version later than `11.13.1`; the sources do not name the fixed version)","status":"open","published_at":"2026-11-05T15:17:17+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","triaged_at":"2026-11-05T15:40:45+00:00","updated_at":"2026-11-05T15:40:45+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-05T15:40:45Z","model":"claude-haiku-5-5","output":{"fix":"- DLP on-prem extensions: unknown (move to a version later than `11.13.1`; the sources do not name the fixed version)","reach":"network","title":"DLP on-prem extensions: SQL injection by a logged-in remote user","impact":"high","summary":"DLP on-prem extensions version 11.13.1 and earlier build SQL queries without sanitizing input or using parameterized queries. A remote attacker with a valid account can inject SQL to read or change data in the database.","audience":"businesses","category":"other","nicknames":[],"who_cares":["dlp","on-prem","sql"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads or alters database contents through injected SQL","analyst_note":"Confirm the fixed version and vendor advisory at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-115738 and identify the vendor product.","how_to_check":"- Check the installed DLP on-prem extensions version against `11.13.1`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running DLP on-prem extensions at version 11.13.1 or earlier. The flaw needs an authenticated remote account, so exposure depends on who can log in to the affected service. The sources do not say which deployments are most exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4196,"output_tokens":520,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115738':17A,20A '-2026':16A,19A '11.13.1':33B,74C 'account':52B 'allow':77C 'attack':48B,81C 'authent':80C 'build':36B 'chang':59B 'cve':15A,18A 'data':60B 'databas':63B 'dlp':1A,21B,27B,68C 'earlier':35B,76C 'extens':5A,31B,72C 'inject':7A,54B,65C,83C 'input':41B 'log':11A 'logged-in':10A 'on-prem':2A,22B,28B,69C 'parameter':44B,89C 'prem':4A,24B,30B,71C 'queri':38B,45B,85C,90C 'read':57B 'remot':13A,47B,79C 'sanit':40B,87C 'sql':6A,26B,37B,55B,64C,84C 'use':43B 'user':14A 'valid':51B 'version':32B,73C 'vulner':66C 'without':39B,86C","nicknames":[],"mitigations":[],"who_affected":"Organizations running DLP on-prem extensions at version 11.13.1 or earlier. The flaw needs an authenticated remote account, so exposure depends on who can log in to the affected service. The sources do not say which deployments are most exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dlp","high","onprem","other","sql"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"trellixpsirt@trellix.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115738","severity":null,"published_at":"2026-11-05T15:17:17+00:00","modified_at":"2026-11-05T15:17:17+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","fetched_at":"2026-11-05T15:39:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}