CVE-2026-77874
HighCVSS 8.6Summary
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Risk Assessment
An attacker could gain unauthorized access to data, modify or delete it, leading to a breach of data confidentiality and integrity. This may result in serious business and compliance consequences.
Recommendation
Update IBM Enterprise Build of Quarkus to a patched version or apply available workarounds. It is also recommended to implement input validation and least-privilege principles for database accounts.
Other vulnerabilities in IBM Enterprise Build of Quarkus
See all- CVE-2026-16308High
IBM Enterprise Build of Quarkus REST has a vulnerability due to unbounded accumulation of multipart MIME part-header bytes, potentially leading to resource exhaustion.
- CVE-2026-19651High
IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5 and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.
Original NVD description (English source)
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.