CVE-2026-22044
Published: 04 February 2026
Summary
CVE-2026-22044 is a medium-severity SQL Injection (CWE-89) vulnerability in Glpi-Project Glpi. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing GLPI web app directly enables T1190 exploitation and arbitrary DB queries for data access via T1213.006.
NVD Description
GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23.
Deeper analysisAI
CVE-2026-22044 is a SQL injection vulnerability (CWE-89) in GLPI, an open-source asset and IT management software package. The flaw affects versions from 0.85 up to but not including 10.0.23, allowing an authenticated user to execute arbitrary SQL queries. It has a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating medium severity with high confidentiality impact but no integrity or availability disruption. The vulnerability was publicly disclosed on February 4, 2026.
An attacker with low-privilege authenticated access (PR:L) can exploit this over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). Successful exploitation enables data exfiltration from the underlying database, potentially exposing sensitive IT asset information, user credentials, or other confidential records managed by GLPI instances.
The issue has been addressed in GLPI version 10.0.23, as detailed in the project's release notes and GitHub Security Advisory GHSA-569q-j526-w385. Security practitioners should upgrade to 10.0.23 or later and review access controls for authenticated users to mitigate risks until patching is complete.
Details
- CWE(s)