{"id":"CVE-2026-77874","state":"PUBLISHED","title":"IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities","description":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.","publishedAt":"2026-09-24T14:22:53.822Z","updatedAt":"2026-09-24T14:53:15.426Z","severity":{"score":8.6,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","source":"ibm"},"assigner":"ibm","products":["IBM Enterprise Build of Quarkus"],"affected":[{"vendor":"IBM","product":"Enterprise Build of Quarkus","versions":[{"version":"3.27.1","status":"affected","lessThanOrEqual":"3.27.5.SP1","versionType":"semver"},{"version":"3.33.1","status":"affected","lessThanOrEqual":"3.33.3.SP1","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:sp1:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:sp1:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7289050"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/77xxx/CVE-2026-77874.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-77874","state":"PUBLISHED","datePublished":"2026-09-24T14:22:53.822Z","dateUpdated":"2026-09-24T14:53:15.426Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2026-08-21T15:18:24.233Z"},"containers":{"cna":{"title":"IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities","descriptions":[{"lang":"en","value":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database."}],"affected":[{"vendor":"IBM","product":"Enterprise Build of Quarkus","versions":[{"version":"3.27.1","status":"affected","lessThanOrEqual":"3.27.5.SP1","versionType":"semver"},{"version":"3.33.1","status":"affected","lessThanOrEqual":"3.33.3.SP1","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:sp1:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:sp1:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289050","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW","baseSeverity":"HIGH","baseScore":8.6,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"}}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2026-09-24T14:22:53.822Z"},"solutions":[{"lang":"en","value":"The issue is addressed in IBM Enterprise Build of Quarkus 3.27.5.SP2 and 3.33.3.SP2. To update your project to IBM Enterprise Build of Quarkus 3.27.5.SP2 or 3.33.3.SP2, follow the instructions in the  product documentation https://www.ibm.com/docs/en/quarkus/3.27.x .","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>The issue is addressed in IBM Enterprise Build of Quarkus 3.27.5.SP2 and 3.33.3.SP2. To update your project to IBM Enterprise Build of Quarkus 3.27.5.SP2 or 3.33.3.SP2, follow the instructions in the <a href=\"https://www.ibm.com/docs/en/quarkus/3.27.x?topic=overview-learn-whats-new-in-327#proc_updating-quarkus-maven\" rel=\"nofollow\">product documentation</a>.</p>"}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-24T14:50:50.894476Z","id":"CVE-2026-77874","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-24T14:53:15.426Z"}}]}}}