CVE-2026-115330 uselotus CVE debrief

Who should care

Defenders responsible for Lotus deployments, particularly those with authenticated organization users, should assess exposure and prioritize patching or mitigating the vulnerability.

Why it matters

CVE-2026-115330 is a SQL injection vulnerability in Lotus that allows authenticated users to execute arbitrary SQL, potentially leading to data breaches, lateral movement, and business disruption. Defenders should prioritize patching, restrict access, and monitor for suspicious activity.

• Potential data breaches due to unauthorized data access or modification
• Increased risk of lateral movement within the network
• Need for verification of affected systems and user access controls
• Potential disruption to business operations due to data tampering or loss

Technical summary

The vulnerability exists in the billable metrics feature of Lotus, allowing authenticated users to execute arbitrary SQL by appending stacked statements to custom metric queries via POST /app/metrics/. This is possible because the validation for custom metric queries does not properly restrict stacked statements, allowing attackers to bypass first-statement-only validation. The vulnerability has a significant impact as it allows attackers to read or modify data across all tenants, potentially leading to data breaches and business disruption.

Defensive priority

Defenders should prioritize verifying and patching affected systems, restricting access to the /app/metrics/ endpoint, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and apply patches for Lotus version 0.10.2 or earlier
• Restrict access to the /app/metrics/ endpoint to authorized users
• Monitor for suspicious activity and implement additional logging and monitoring measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Lotus through version 0.10.2 and the potential for authenticated users to execute arbitrary SQL. The vulnerability is confirmed to exist in the billable metrics feature of Lotus, and defenders should verify the patch status of their deployments. The source item and CVE record are the primary sources of information for this vulnerability, and no additional evidence is available at this time.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.