On October 22, 2026, Arista disclosed that its on-premises VeloCloud Orchestrator (VCO) carries an actively exploited SQL injection: any authenticated user, down to the Enterprise Read Only role, can become the superuser operator. If you self-host a VCO, upgrade immediately and assume every account — read-only included — has already been abused.
Patched in May 2026, the pre-authentication SQL injection CVE-2026-48842 in Roundcube Webmail’s virtuser_query plugin is now being exploited in the wild, according to the Canadian Centre for Cyber Security. Administrators should upgrade to 1.6.16 or 1.7.1, or disable the virtuser_query plugin without waiting.
On September 8, 2026, cPanel disclosed a SQL injection in EmailTrack that lets any mail-account holder write arbitrary files and then execute code as root. Every supported version is affected: on shared hosting, each customer account becomes a doorway to the whole server.
CVE-2026-16007 is an authenticated SQL injection in AppFlowy Cloud, the open-source Notion alternative: any logged-in user can read, modify, or drop the database. The fix exists only for the commercial tier — the self-hosted edition got no answer from the vendor.
On August 8, 2026, Metabase disclosed a maximum-severity SQL injection flaw (CVSS 10.0) that was already being exploited in the wild. The vulnerability lets unauthenticated attackers gain administrator privileges and drain every connected database. Self-hosted Metabase admins must patch, revoke sessions, and rotate all secrets immediately.
On August 5, 2026, Huntress researchers documented an attack where the khunt toolkit was compiled and executed inside an Oracle database via SQL injection on an Apache Tomcat endpoint. Attackers abused Oracle's embedded JVM to run OS commands with SYSTEM privileges, steal Windows hashes, and map the network. The message to DBAs is clear: your database is a full Java runtime — treat it like one.
