CVE-2026-1122
Published: 18 January 2026
Summary
CVE-2026-1122 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-1122 is a SQL injection vulnerability (CWE-74, CWE-89) in Yonyou KSOA 9.0. It affects an unknown function within the file /worksheet/work_info.jsp in the HTTP GET Parameter Handler component, where manipulation of the ID argument in HTTP GET requests triggers the issue. The vulnerability was published on 2026-01-18.
Attackers can exploit this remotely without authentication or user interaction, requiring only low complexity (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base score 7.3). Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via SQL injection.
Advisories on VulDB (ctiid.341714, id.341714, submit.734549) and a GitHub issue (https://github.com/LX-66-LX/cve/issues/8) confirm the exploit is publicly disclosed and may be utilized. The vendor was contacted early about disclosure but provided no response, with no patches or mitigations referenced.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3176
Vulnerability details
A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The…
more
exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated SQL injection in a public web app component directly enables exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the ID HTTP GET parameter in work_info.jsp to reject SQL syntax before it reaches the database.
Boundary protection devices can enforce input filtering or WAF rules that block the malicious ID payloads targeting this endpoint.
Continuous monitoring of web requests and database queries can identify anomalous SQL patterns originating from the unauthenticated /worksheet/work_info.jsp handler.