CVE-2026-115331 uselotus CVE debrief

Who should care

Defenders responsible for Lotus deployments should assess exposure and potential impact. This includes security teams, vulnerability management teams, and operators managing Lotus deployments. They should verify if the organization uses Lotus version 0.10.2 or earlier and evaluate the database shared by all tenants for potential vulnerabilities.

Why it matters

CVE-2026-115331 is a SQL injection vulnerability in Lotus through 0.10.2, which allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values.

• Verify exposure by checking if the organization uses Lotus version 0.10.2 or earlier.
• Assess potential impact by evaluating the database shared by all tenants.
• Implement compensating controls, such as input validation and sanitization, to prevent SQL injection attacks.

Technical summary

The CVE record and source item describe a SQL injection vulnerability in Lotus through 0.10.2, which allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. This vulnerability could allow attackers to access the database shared by all tenants, potentially leading to unauthorized data access or modifications. The issue is exploitable through Jinja-generated counter, gauge, and rate metric queries. Defenders should focus on input validation, sanitization, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact.

Recommended defensive actions

• Verify exposure by checking if the organization uses Lotus version 0.10.2 or earlier.
• Assess potential impact by evaluating the database shared by all tenants.
• Implement compensating controls, such as input validation and sanitization, to prevent SQL injection attacks.
• Monitor for suspicious activity and exception tracking to detect potential exploitation attempts.
• Review vendor patch guidance for Lotus and plan for updates or mitigations.
• Conduct an exposure review to identify potentially affected systems.
• Perform asset inventory checks to identify deployments of Lotus through 0.10.2.

Evidence notes

The CVE record and source item provide details on the SQL injection vulnerability in Lotus through 0.10.2. Evidence is limited to CVE Program and NVD descriptions. Defenders should verify the vulnerability's existence and impact through official sources and assess potential exposure. The CVE record was published on 2026-10-22T10:57:48.115Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.