CVE-2026-40836

Vulnerability

The vulnerability is an SQL injection in the inmessage model of MB connect line mbCONNECT24 and mymbCONNECT24. The software fails to properly neutralize special elements used in a SQL DELETE command, allowing an attacker to inject arbitrary SQL. The affected product versions are those prior to an undisclosed fixed release, as per the vendor advisory [1].

Exploitation

The attacker requires low-privileged remote access to the application. Despite the low privilege requirement, the SQL injection is unauthenticated, meaning no prior authentication is needed. The attack vector involves sending a crafted HTTP request that triggers the DELETE operation on the inmessage model, injecting SQL commands into the delete parameter to execute arbitrary queries against the database.

Impact

Successful exploitation allows the attacker to read the entire database, resulting in a total loss of confidentiality. Additionally, the attacker can delete entries in a non-critical table, causing some loss of integrity. The confidentiality impact is high, while the integrity impact is limited to non-critical data.

Mitigation

As of the publication date (May 27, 2026), no patch has been released by the vendor. Users should monitor the advisory [1] for updates and apply patches when available. Until a fix is deployed, restrict network access to affected systems and implement strict input validation as a temporary workaround.