---
id: "CVE-2026-123087"
page: "https://infrastack.ai/live/CVE-2026-123087"
kind: "vulnerability"
aliases: ["CVE-2026-123087"]
title: "Atmira SIREC: SQL injection through a JSON field lets attackers read database data"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "SIREC", "fixed": [], "affected": "versions not specified; fixed by vendor 2026-10-16", "ecosystem": "vendor"}]
ecosystems: []
tags: ["atmira", "auth-required", "other", "sirec", "sql-injection"]
not_affected_if: ["patched-after-2026-10-16", "unknown"]
published_at: "2026-11-06T10:16:37+00:00"
first_seen_at: "2026-11-06T10:40:57+00:00"
updated_at: "2026-11-06T10:42:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123087", "first_seen_at": "2026-11-06T10:40:57+00:00"}, {"source": "analyst", "url": "https://www.incibe.es/incibe-cert/alerta-temprana/avisos/inyeccion-sql-en-sirec-de-atmira", "first_seen_at": "2026-11-06T10:42:32+00:00", "cites": ["https://www.incibe.es/incibe-cert/alerta-temprana/avisos/inyeccion-sql-en-sirec-de-atmira"]}]
exploit_sources: []
---

# Atmira SIREC: SQL injection through a JSON field lets attackers read database data

Link for people: https://infrastack.ai/live/CVE-2026-123087 (this .md is for agents)

Atmira's SIREC application takes a field from a user-supplied JSON object and concatenates it into an SQL statement without sanitising it. An attacker can alter the query and make the database return information it should not.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SIREC affected versions not specified; fixed by vendor 2026-10-16 fixed no fixed version listed

## How to check

Affected versions are not published. Ask Atmira whether your SIREC build predates the 16 Oct 2026 fix. SIREC is a debt-collection and recovery platform, so check whether your instance is reachable by authenticated users (PR:L) and review database logs for odd SQL from JSON request fields.

## Fix

Atmira told INCIBE it fixed the flaw on 16 October 2026; no fixed version number is published. Ask Atmira which build contains the fix.

## Timeline

- 2026-11-06T10:40:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123087
- 2026-11-06T10:42:32+00:00 analyst https://www.incibe.es/incibe-cert/alerta-temprana/avisos/inyeccion-sql-en-sirec-de-atmira — INCIBE-CERT advisory INCIBE-2026-843 (CNA, reporter Luis Ovejero Martin): affected versions not specified; Atmira confirmed fix on 16/10/2026, no version number given. Not verified: INCIBE relays the vendor, no Atmira page found. No exploitation or PoC seen.

## Documents

- [advisory] INCIBE-2026-843: Inyección SQL en SIREC de Atmira https://www.incibe.es/incibe-cert/alerta-temprana/avisos/inyeccion-sql-en-sirec-de-atmira

## From the sources

SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_