Cyber Resilience

CVE-2026-35614

Critical

Published: 07 April 2026

Published
07 April 2026
Modified
13 April 2026
KEV Added
—
Patch
—
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0026 17.2th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-35614 is a critical-severity SQL Injection (CWE-89) vulnerability in Frappe Frappe. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-35614 is a SQL injection vulnerability (CWE-89) in the bulk_update function of Frappe, a full-stack web application framework. It affects Frappe versions prior to 16.14.0 and 15.104.0. The vulnerability was published on 2026-04-07 and carries a CVSS v3.1 base score of 9.8, indicating critical severity due to its high impact on confidentiality, integrity, and availability.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows attackers to inject malicious SQL queries via the bulk_update endpoint, potentially enabling arbitrary database operations such as data exfiltration, modification, or deletion, depending on database permissions.

The Frappe security advisory at https://github.com/frappe/frappe/security/advisories/GHSA-583g-fg76-fhfr details the fix, recommending upgrades to version 16.14.0 or 15.104.0 to mitigate the issue. No additional workarounds are specified in the provided information.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.14.0 and 15.104.0.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web framework endpoint directly enables T1190 for remote unauthenticated exploitation and arbitrary DB operations.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-30212Same product: Frappe Frappe
CVE-2026-31877Same product: Frappe Frappe
CVE-2025-30217Same product: Frappe Frappe
CVE-2026-39351Same product: Frappe Frappe
CVE-2026-29081Same product: Frappe Frappe
CVE-2026-28436Same product: Frappe Frappe
CVE-2025-30214Same product: Frappe Frappe
CVE-2025-30213Same product: Frappe Frappe
CVE-2025-68929Same product: Frappe Frappe
CVE-2026-44446Same vendor: Frappe

Affected Assets

frappe
frappe
≤ 15.104.0 · 16.0.0 — 16.14.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents SQL injection attacks by validating and sanitizing user inputs to the vulnerable bulk_update endpoint in Frappe.

SI-2 Flaw Remediation good match
prevent

Ensures timely patching of the specific SQL injection flaw by upgrading Frappe to versions 16.14.0 or 15.104.0.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Vulnerability scanning identifies the SQL injection vulnerability in the Frappe bulk_update function prior to exploitation.

References