SIREC · CVE-2026-123087 · Other
NO FIX YET · SEE WHAT TO DO
Atmira's SIREC application takes a field from a user-supplied JSON object and concatenates it into an SQL statement without sanitising it. An attacker can alter the query and make the database return information it should not.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organisations running Atmira's SIREC (a collections and debt-recovery platform) that were not updated after Atmira's fix of 16 Oct 2026. Exploitation needs network access and a low-privilege login (CVSS 4.0 PR:L). Hosted SIREC customers should confirm with Atmira that the fix is applied.
Not affected if patched-after-2026-10-16, unknown
Who cares atmira, auth-required, sirec, sql-injection
SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.