CVE-2026-25606 Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy CVE debrief

Who should care

Security teams and administrators responsible for STER systems should be aware of this vulnerability and take steps to mitigate it. This includes reviewing system configurations, implementing additional security measures to detect and prevent SQL injection attacks, and restricting access to sensitive data and functionality. Given the high severity and potential impact, it is essential to prioritize this vulnerability and allocate necessary resources for mitigation and remediation efforts.

Technical summary

The CVE-2026-25606 vulnerability is a SQL injection issue in STER, which allows an authenticated attacker to access sensitive data by injecting malicious SQL code into multiple Search Filters. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. It allows an authenticated attacker to view sensitive data such as data belonging to other users, or any other data that the application itself is able to access. This issue was fixed in version 9.5. Security teams and administrators responsible for STER systems should take immediate action to protect against this vulnerability.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, as it allows an authenticated attacker to access sensitive data. Security teams and administrators responsible for STER systems should take immediate action to protect against this vulnerability. Compensating controls, monitoring, and asset inventory management are crucial until a patch is applied. Review system configurations and user inputs to prevent similar vulnerabilities. Track exceptions and retest remediated assets to ensure the vulnerability is fully addressed. This vulnerability has a CVSS score of 8.7 and is classified as HIGH severity, emphasizing the need for prompt action. Implement additional security measures to detect and prevent SQL injection attacks, and restrict access to sensitive data and functionality. Regularly review relevant monitoring, detection, and logs for exposed assets that need extra review. Consider rollback and change windows for updates, and ensure source tracking is in place for affected systems. Given the high severity and potential impact, it is essential to prioritize this vulnerability and allocate necessary resources for mitigation and remediation efforts. The CVE record and NVD entry provide critical information for understanding the vulnerability and its implications. By taking a proactive and defensive approach, organizations can minimize the risk associated with this vulnerability and protect their STER systems from potential attacks. This vulnerability highlights the importance of robust security measures, including regular updates, monitoring, and incident response planning, to prevent and respond to SQL injection attacks effectively. By prioritizing this vulnerability and taking prompt action, organizations can reduce the risk of exploitation and protect their sensitive data. The affected product or component is STER, and the vulnerability class is SQL injection. The likely operational impact is significant, and the source-confidence limits are based on the CVE record and NVD entry. Review context is essential to understand the vulnerability and its implications fully. Security teams and administrators should work together to address this

Recommended defensive actions

• Apply the patch or update to version 9.5
• Conduct a thorough review of STER system configurations and user inputs
• Implement additional security measures to detect and prevent SQL injection attacks
• Monitor system logs for suspicious activity
• Restrict access to sensitive data and functionality

Evidence notes

The CVE record was published on 2026-05-22T10:16:17.263Z and last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Deferred. The vulnerability affects STER systems and allows an authenticated attacker to access sensitive data. Evidence is limited, and defenders should verify the affected scope and vendor guidance.

Official resources