CVE-2026-2613

HighCVSS 8.7/10Last modified Nov 2, 2026

Description

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.

A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 2, 2026
Last modified
Nov 2, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-261307.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-261317.8Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.CVE-2026-261327.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-261337.1AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-261347.8Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.CVE-2026-261358.8Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges overCVE-2026-261367.5Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to CVE-2026-261379.9Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network.CVE-2026-2613810.0Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.CVE-2026-261398.6Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.CVE-2026-26147.5A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows aCVE-2026-261417.8Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally.
CVE-2026-2613: High severity, CVSS 8.7 | Vulnix