Security Resilience

CVE-2026-63774

SQLi

SQLi
Published
06 November 2026
Modified
06 November 2026
CVSS Score v4 9.4
Click a component to see what it means
Raw vectorCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0030 23th percentile
Risk Priority 35 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-63774 is a critical-severity SQL Injection (CWE-89) vulnerability in Cisa (inferred from references). Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Email Collection (T1114); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise Techniques

MITRE ATT&CK v20.0

T1114 Email Collection Collection
Adversaries may target user email to collect sensitive information.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
T1491 Defacement Impact
Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2018-17254Shared CWE-89
CVE-2024-9536Shared CWE-89
CVE-2024-7669Shared CWE-89
CVE-2024-30238Shared CWE-89
CVE-2023-29118Shared CWE-89
CVE-2018-6329Shared CWE-89
CVE-2023-5014Shared CWE-89
CVE-2023-34418Shared CWE-89
CVE-2023-49546Shared CWE-89
CVE-2023-33439Shared CWE-89

Affected Assets

Cisa
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V6.2.5

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

SA-11 Developer Testing and Evaluation good match

SA-11 (d) requires implementing a verifiable flaw remediation process and (e) requires correcting flaws identified during testing and evaluation. Both are enumerated imperative requirements, so removal is a defined standing function, and the locus is first-party code under development, so the si-2 CVE-mediation objection does not apply. Grade `mostly` follows NIST's own hedge, 'reduce or eliminate'.

SA-8 Security and Privacy Engineering Principles partial match

Secure engineering principles require parameterized queries and input sanitization that structurally eliminate SQLi.

SI-10 Information Input Validation partial match

Input validation directly stops untrusted data from reaching SQL query construction without neutralization.

SI-4 System Monitoring partial match

System monitoring can identify attempted SQLi exploitation via anomalous queries after the weakness exists.

Mitigating Controls (NIST CSF 2.0)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly target injection flaws during coding and review so largely prevent CWE-89 introduction, yet the single broad outcome leaves residual risk from incomplete neutralization techniques or missed edge cases.

PR.AT-02 partial match
blocks

Training raises developer awareness of SQLi risks and can reduce introduction likelihood (partial) but removes none of the actual coding flaw's risk by itself since technical neutralization is still required.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.29 Security testing in development and acceptance full match
finds

The same secure-coding and static-analysis activities surface missing neutralization of SQL metacharacters before the system is accepted.

A.6.3 Information security awareness, education and training partial match
prevents

A.6.3's education and training for technical teams reduces the odds that developers write unneutralised SQL, but as a fallible human practice covering only part of the developer population it keeps a minority of injection defects from ever arising, in line with the owner's partial grade for training against developer-introduced weaknesses such as CWE-598 and CWE-79.

A.8.28 Secure coding partial match
prevents

Language-specific secure coding rules, peer review and SAST together prevent the construction of SQL statements from untrusted data without proper parameterization or escaping.

A.8.30 Outsourced development partial match
prevents

A.8.30 contracts secure design, coding and testing practices (8.25-8.29) into outsourced development, so a faithful implementation reduces SQL injection in delivered code the way those practices do, but the effect is mediated through the supplier's compliance and the clause carries a declared ceiling of partial on this verb.

A.8.8 Management of technical vulnerabilities partial match
finds

created from the owner's anchor; an owner grade is a row and does not wait for an instrument (Mythos 2026-09-29T15:58Z).

References