CVE-2026-123087 Atmira CVE debrief

Who should care

Defenders responsible for systems using Atmira's SIREC should assess exposure and prioritize verification of this vulnerability, as it could lead to unauthorized database information disclosure.

Why it matters

This SQL injection vulnerability in Atmira's SIREC allows attackers to manipulate SQL queries, potentially leading to unauthorized database information disclosure. Defenders should prioritize verifying the presence of this vulnerability in their systems and implement proper input sanitization to prevent such attacks.

• Potential unauthorized disclosure of database information
• Need for input sanitization to prevent SQL injection attacks
• Verification of system inventory and vulnerability presence required

Technical summary

The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without proper sanitization. This allows malicious input to alter the original query, potentially leading to unauthorized database information disclosure. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. Defenders should prioritize verifying the presence of this vulnerability in their systems, especially if they use Atmira's SIREC, and assess the potential impact of SQL injection attacks.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems, especially if they use Atmira's SIREC, and assess the potential impact of SQL injection attacks.

Recommended defensive actions

• Verify the presence of Atmira's SIREC in your system inventory
• Assess the potential impact of SQL injection attacks on your system
• Implement proper input sanitization for user-supplied information
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the SQL injection vulnerability in Atmira's SIREC, including its CVSS score of 8.7 and weaknesses. The vulnerability allows malicious input to alter the original SQL query, potentially leading to unauthorized database information disclosure. Defenders should verify the presence of Atmira's SIREC in their system inventory and assess the potential impact of SQL injection attacks. The official CVE Program record and NIST NVD detail page offer source-provided CVE metadata and source- and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.