CVE-2026-18782

CriticalCVSS 9.8

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.

Risk Assessment

An attacker can execute system-level commands through SQL injection, potentially leading to full system compromise and disruption of production data.

Recommendation

Upgrade Trex MES to a version after 2026-09-29 if available. Conduct a security audit of the application and restrict access to the system.

Other vulnerabilities in Trex MES

CVE-2026-18783High
Trex MES from Trex Digital Smart Manufacturing Systems Inc. contains a missing authentication for critical function vulnerability, allowing authentication bypass. The issue affects versions through 2026-09-29.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS