CVE-2026-22044
Published: 04 February 2026
Summary
CVE-2026-22044 is a medium-severity SQL Injection (CWE-89) vulnerability in Glpi-Project Glpi. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22044 is a SQL injection vulnerability (CWE-89) in GLPI, an open-source asset and IT management software package. The flaw affects versions from 0.85 up to but not including 10.0.23, allowing an authenticated user to execute arbitrary SQL queries. It has a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating medium severity with high confidentiality impact but no integrity or availability disruption. The vulnerability was publicly disclosed on February 4, 2026.
An attacker with low-privilege authenticated access (PR:L) can exploit this over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). Successful exploitation enables data exfiltration from the underlying database, potentially exposing sensitive IT asset information, user credentials, or other confidential records managed by GLPI instances.
The issue has been addressed in GLPI version 10.0.23, as detailed in the project's release notes and GitHub Security Advisory GHSA-569q-j526-w385. Security practitioners should upgrade to 10.0.23 or later and review access controls for authenticated users to mitigate risks until patching is complete.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5375
Vulnerability details
GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing GLPI web app directly enables T1190 exploitation and arbitrary DB queries for data access via T1213.006.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to block crafted SQL statements that enable the authenticated injection described in CVE-2026-22044.
Mandates timely application of the vendor patch (GLPI 10.0.23) that eliminates the SQL-injection flaw present in versions 0.85–10.0.22.
Limits the data and functions an authenticated low-privilege account can reach, thereby reducing the confidentiality impact of any successful SQL injection.