CVE-2026-40819

Vulnerability

The vulnerability is an unauthenticated SQL injection in the sync_data24 task of MB connect line's mbCONNECT24 and mymbCONNECT24 products [1]. The improper neutralization of special elements in a SQL SELECT command allows an attacker to inject arbitrary SQL queries. The exact affected versions are not specified in the available advisory, but the vulnerability is present in these products.

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted HTTP request to the sync_data24 endpoint [1]. No authentication or user interaction is required. The attacker simply needs network access to the affected system.

Impact

Successful exploitation results in a total loss of confidentiality [1]. The attacker can read arbitrary data from the database, potentially including sensitive information such as user credentials, configuration data, and other stored data.

Mitigation

As of the advisory publication date (2026-05-27), no fix has been released [1]. Users should monitor the vendor's security advisories for patches and apply them as soon as they become available. No workaround is documented in the available reference.