CVE-2026-86595: SQLi in Iron Mountain's enVision
Published Sep 28, 2026
·Updated
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection.
This issue affects enVision: before 260655.
Affected Software
1 affected component
Iron Mountain enVision<260655
Event History
Sep 28, 2026
CVE Published
via MITRE·01:12 PM
Data Sourced
via MITRE·01:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attack vector is network-based and requires low privileges. No user interaction is required.
2
What is the primary impact if exploitation succeeds?
The vulnerability has a high confidentiality impact. The available scoring information indicates no integrity or availability impact.
3
How can I determine whether an enVision deployment is affected?
Deployments running an enVision version before 260655 are affected. The provided information does not state whether any configuration or deployment mode is exempt.