CVE-2026-35614
Published: 07 April 2026
Summary
CVE-2026-35614 is a critical-severity SQL Injection (CWE-89) vulnerability in Frappe Frappe. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection attacks by validating and sanitizing user inputs to the vulnerable bulk_update endpoint in Frappe.
Ensures timely patching of the specific SQL injection flaw by upgrading Frappe to versions 16.14.0 or 15.104.0.
Vulnerability scanning identifies the SQL injection vulnerability in the Frappe bulk_update function prior to exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web framework endpoint directly enables T1190 for remote unauthenticated exploitation and arbitrary DB operations.
NVD Description
Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.14.0 and 15.104.0.
Deeper analysisAI
CVE-2026-35614 is a SQL injection vulnerability (CWE-89) in the bulk_update function of Frappe, a full-stack web application framework. It affects Frappe versions prior to 16.14.0 and 15.104.0. The vulnerability was published on 2026-04-07 and carries a CVSS v3.1 base score of 9.8, indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows attackers to inject malicious SQL queries via the bulk_update endpoint, potentially enabling arbitrary database operations such as data exfiltration, modification, or deletion, depending on database permissions.
The Frappe security advisory at https://github.com/frappe/frappe/security/advisories/GHSA-583g-fg76-fhfr details the fix, recommending upgrades to version 16.14.0 or 15.104.0 to mitigate the issue. No additional workarounds are specified in the provided information.
Details
- CWE(s)