---
id: "CVE-2026-14571"
kind: "vulnerability"
aliases: ["CVE-2026-14571"]
title: "Futurum Software management software: blind SQL injection exposes customer PII"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["futurum-software", "management-software", "sql-injection", "unauthenticated", "vendor", "waf-bypass"]
not_affected_if: []
published_at: "2026-10-28T10:17:08+00:00"
first_seen_at: "2026-10-28T10:32:15+00:00"
updated_at: "2026-10-28T10:36:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14571", "first_seen_at": "2026-10-28T10:32:15+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T10:36:00+00:00"}]
---

# Futurum Software management software: blind SQL injection exposes customer PII

Futurum Software's management software does not validate user input sent to its private-area database queries, and a WAF misconfiguration lets crafted HTTP requests bypass protection. An unauthenticated attacker can run arbitrary database queries, map the database structure and read sensitive customer data including PII.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-28T10:32:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-14571
- 2026-10-28T10:36:00+00:00 analyst — CNA is INCIBE (cve.org); NVD and cve.org pages are empty and no INCIBE-CERT notice or vendor advisory found yet (published 2026-10-28). Secondary vuln.today: User Authentication Module, CVSS 4.0 9.1, unauthenticated, no public exploit known, versions not enumerated. Affected versions, fix and check command unknown; re-check the INCIBE-CERT security-advisories page for a Futurum notice. Nothing verified.

## From the sources

A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms to be bypassed solely by sending manipulated HTTP requests. Successful exploitation of the vulnerability could allow an unauthenticated attacker to execute arbitrary queries against the database, extract its complete structure and gain access to sensitive customer information, including personally identifiable information (PII).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_