PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40546 SOPlanning CVE debrief

SOPlanning versions 1.55 and below contain SQL injection vulnerabilities across multiple endpoints and parameters. An attacker with low privileges can inject arbitrary SQL commands, potentially achieving full database control. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and high impacts to confidentiality and integrity with low availability impact. The vulnerability is classified as CWE-89 (SQL Injection). No known exploitation in ransomware campaigns has been documented.

Vendor
SOPlanning
Product
Unknown
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running SOPlanning version 1.55 or below; security teams responsible for web application and database security; database administrators managing SOPlanning deployments

Technical summary

SOPlanning 1.55 and below are affected by SQL injection (CWE-89) across multiple endpoints and parameters. The vulnerability requires low privileges to exploit, with network accessibility and low attack complexity. Successful exploitation can result in high confidentiality and integrity impacts, with low availability impact, potentially granting full database control to an attacker.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade SOPlanning to a version newer than 1.55 when available, or apply vendor-provided patches
  • Review and restrict database account privileges used by SOPlanning to least-privilege principles
  • Implement parameterized queries or prepared statements for all database interactions
  • Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns
  • Monitor database query logs for anomalous SQL execution patterns
  • Conduct code review of SOPlanning endpoints identified as vulnerable to SQL injection
  • Validate and sanitize all user-supplied input before processing in database queries

Evidence notes

CVE published and modified 2026-06-01. Source references include CERT.PL advisory and SOPlanning vendor website. CVSS 4.0 vector provided in NVD source data. Vendor attribution marked low confidence with review flag due to 'Unknown Vendor' classification in source data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40546 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40546

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40546 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40546

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.