---
id: CVE-2026-123087
title: SQL injection in Atmira’s SIREC
summary: >-
  SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value
  of a field from a JSON object containing user-supplied information and
  concatenates it into an SQL statement without properly sanitising the input.
  This allows…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: Atmira
product: SIREC
affected:
  - SIREC < 16/10/2026
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T09:30:48.276Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123087'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-atmiras-sirec
tags:
  - cve.org
ingestedAt: '2026-11-06T09:48:47.394Z'
epss: 0.00344
epssPercentile: 0.28097
---

## Overview

SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.

## Affected

- `SIREC < 16/10/2026`

## Remediation

Atmira has confirmed that the vulnerability was fixed on 16 October 2026.