{"id":"CVE-2026-77874","title":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection","summary":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to vie…","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cwe":["CWE-89"],"vendor":"IBM","product":"Enterprise Build of Quarkus","affected":["enterprise_build_of_quarkus >= 3.27.1 <= 3.27.5.SP1","enterprise_build_of_quarkus >= 3.33.1 <= 3.33.3.SP1"],"published":"2026-09-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T19:41:16.513","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77874","references":[{"url":"https://www.ibm.com/support/pages/node/7289050","label":"psirt@us.ibm.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77874.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-77874"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2513748"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77874"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77874"},{"url":"https://access.redhat.com/errata/RHSA-2026:70257"},{"url":"https://access.redhat.com/errata/RHSA-2026:69470"},{"url":"https://access.redhat.com/errata/RHSA-2026:69440"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"url":"https://access.redhat.com/errata/RHSA-2026:87410"},{"url":"https://access.redhat.com/errata/RHSA-2026:86891"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-24T14:50:50.894476Z"},"ingestedAt":"2026-09-24T15:45:56.645Z","epss":0.00282,"epssPercentile":0.20641,"patched":["build_of_apache_camel 3.33.3.SP2","build_of_quarkus 3.27.5.SP2","build_of_quarkus 3.33.3.SP2"],"slug":"CVE-2026-77874","body":"## Overview\n\nIBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat build of Debezium 3, Red Hat JBoss Enterprise Application Platform 7, Red Hat OpenStack Platform 13 (Queens), Red Hat Single Sign-On 7, Red Hat build of Apache Camel 4 for Quarkus 3 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat OpenStack Platform 13 (Queens), Red Hat Single Sign-On 7, Red Hat build of Debezium 3 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77874.json)\n- **RHSA-2026:70257** · Red Hat · fixed in: Red Hat Build of Apache Camel 3.33.3.SP2 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70257)\n- **RHSA-2026:69470** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.5.SP2 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69470)\n- **RHSA-2026:69440** · Red Hat · fixed in: Red Hat build of Quarkus 3.33.3.SP2 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69440)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)\n- **RHSA-2026:87410** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87410)\n- **RHSA-2026:86891** · Red Hat · fixed in: Red Hat OpenShift AI 3.5 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:86891)","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}