CVE-2026-1177
Published: 19 January 2026
Summary
CVE-2026-1177 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-1177 is a SQL injection vulnerability affecting Yonyou KSOA 9.0, specifically in an unknown functionality of the /kmf/save_folder.jsp file within the HTTP GET Parameter Handler component. The issue arises from improper handling of the 'folderid' argument, allowing attackers to manipulate it and inject malicious SQL payloads. Published on January 19, 2026, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).
The vulnerability can be exploited remotely by unauthenticated attackers with no privileges required, low attack complexity, and no user interaction needed. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as extracting sensitive data, modifying database contents, or disrupting service to a minor extent.
Advisories from VulDB (ctiid.341771, id.341771, submit.734577) and a GitHub issue (LX-66-LX/cve/issues/17) detail the flaw, with a public exploit available that could facilitate attacks. The vendor was notified early but provided no response, and no patches or mitigations are mentioned in the available references.
An exploit has been publicly disclosed, increasing the risk of real-world attacks against exposed Yonyou KSOA 9.0 instances.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3279
Vulnerability details
A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql injection.…
more
It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of unauthenticated SQL injection in a public-facing web application component (/kmf/save_folder.jsp).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted inputs such as the folderid GET parameter to block SQL command injection.
Boundary protection devices (e.g., WAF rules) can inspect and drop HTTP requests containing SQL metacharacters targeting /kmf/save_folder.jsp.
Continuous monitoring of web-server and database logs can identify anomalous SQL syntax or error patterns indicative of attempted injection.