CVE-2026-44446: SQL Injection in ERPNext

Successful exploitation of this SQL Injection vulnerability could allow an attacker to bypass authentication and authorization controls, gaining unauthorized access to the ERPNext database. Sensitive data such as user credentials, financial records, customer information, and inventory details could be exfiltrated. Depending on the database configuration and permissions, an attacker might even be able to modify or delete data, leading to significant operational disruption and potential financial loss. The impact is amplified if ERPNext is integrated with other systems, as the attacker could potentially pivot to those systems using the compromised ERPNext instance as a foothold.

1. Reserviert2026-05-06
2. Veröffentlicht2026-05-13

The primary mitigation for CVE-2026-44446 is to immediately upgrade ERPNext to version 16.14.0 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to detect and block SQL Injection attempts targeting the vulnerable endpoints. Carefully review and sanitize all user inputs to prevent malicious code from being injected into database queries. Regularly audit database access controls to ensure that only authorized users have access to sensitive data. After upgrading, confirm the fix by attempting a SQL injection attack on the previously vulnerable endpoints and verifying that the requests are properly sanitized.