CVE-2026-40820: Authenticated SQLi in getVpnData function

Published Nov 12, 2026

Updated

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getVpnData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Event History

Nov 12, 2026

CVE Published

via MITRE·07:41 AM

Data Sourced

via MITRE·07:41 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What should triage teams verify before assigning exploitability?

The supplied information is internally inconsistent about prerequisites: the CVSS vector specifies high privileges required (PR:H), and the description refers to a high-privileged remote attacker, but it also calls the SQL injection unauthenticated. Confirm the authentication and authorization requirements before prioritizing exposure.

CVE-2026-40820: Authenticated SQLi in getVpnData function

Event History

Frequently Asked Questions

What should triage teams verify before assigning exploitability?

Company

Resources

Contact

Frequently Asked Questions

What should triage teams verify before assigning exploitability?