CVE-2026-26001

High

Published: 18 March 2026

Published

18 March 2026

Modified

23 March 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS Score 0.0021 11.4th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-26001 is a high-severity SQL Injection (CWE-89) vulnerability in Glpi-Project Glpi Inventory. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-26001 is an SQL injection vulnerability in the GLPI Inventory Plugin, which handles network discovery, inventory, software deployment, and data collection for GLPI agents. The flaw arises from non-sanitized user input in reports, affecting versions prior to 1.6.6. It is classified under CWE-89 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to its potential for significant data exposure.

An attacker with low privileges, such as an authenticated user with adequate rights on the system, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables SQL injection via crafted reports, resulting in high-impact confidentiality violations, such as unauthorized access to sensitive data in the database, alongside limited integrity impacts but no denial of service.

The vulnerability is addressed in GLPI Inventory Plugin version 1.6.6, which includes fixes for input sanitization. Additional details are available in the GitHub security advisory at https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-gp4r-m42c-wvgx. Security practitioners should prioritize upgrading affected installations to mitigate the risk.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-12671

Vulnerability details

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in network-accessible GLPI web plugin (reports) directly enables T1190 exploitation for initial access/data exposure and facilitates T1213.006 database querying via crafted input.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0