HIGH

CVE-2026-18859

2026-08-05 CVSS v3.1

CVSS

7.3

Description

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness (CWE)

CWE-74 Injection

CWE-89 SQL Injection

EPSS Score

0.25%

Probability of exploitation in next 30 days

17.3th percentile

References

https://ucn9h68n9289.feishu.cn/docx/LHkddOv7Jo6quTxlJKZcf8gfnOe?from=from_copylink https://vuldb.com/cve/CVE-2026-18859 https://vuldb.com/submit/858586 https://vuldb.com/vuln/385869 https://vuldb.com/vuln/385869/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE