CVE-2026-44446: ERPNext SQL Injection Exposes Sensitive Data
The National Vulnerability Database has disclosed CVE-2026-44446, a high-severity SQL injection vulnerability affecting ERPNext, a popular free and open-source Enterprise Resource Planning tool. This flaw, rated 8.8 CVSS, allows authenticated attackers to craft special requests and extract sensitive information from vulnerable ERPNext instances.
Specifically, versions prior to 15.104.3 and 16.14.0 are impacted. The vulnerability stems from inadequately sanitized input on certain endpoints, a classic CWE-89 SQL injection scenario. Attackers can leverage this to bypass authentication, dump databases, or gain further access, making it a critical threat to organizations relying on ERPNext for their core business operations.
This isn’t just about data exposure; it’s about core business integrity. An ERP system holds the keys to an organization’s kingdom – financial data, customer details, supply chain logistics. A successful exploit here means an attacker could gain a comprehensive understanding of an organization’s inner workings, facilitating further attacks or direct data exfiltration.
What This Means For You
- If your organization uses ERPNext, you need to check your version immediately. Patch to 15.104.3 or 16.14.0 without delay to mitigate CVE-2026-44446. Prioritize this fix, as an unpatched ERP system is a goldmine for attackers, offering direct access to critical business intelligence.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-44446: ERPNext SQL Injection via crafted URI query
title: CVE-2026-44446: ERPNext SQL Injection via crafted URI query
id: scw-2026-05-13-ai-1
status: experimental
level: critical
description: |
Detects SQL injection attempts targeting ERPNext by looking for common SQL injection patterns within the URI query parameters. This is the primary detection for CVE-2026-44446, which allows attackers to extract sensitive data.
author: SCW Feed Engine (AI-generated)
date: 2026-05-13
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-44446/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- "' OR '1'='1"
- "' UNION SELECT"
- "' AND (SELECT"
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-44446 | SQLi | ERPNext versions prior to 15.104.3 |
| CVE-2026-44446 | SQLi | ERPNext versions prior to 16.14.0 |
| CVE-2026-44446 | SQLi | Specially crafted requests to ERPNext endpoints |
| CVE-2026-44446 | Information Disclosure | Extraction of sensitive information from ERPNext |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 14, 2026 at 01:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
OPNsense RCE: Critical Flaw Allows Root Access via DHCP Input
CVE-2026-45158 — OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the...
Hoppscotch CVE-2026-44478: Unauthenticated Infrastructure Secret Leak
CVE-2026-44478 — hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the unauthenticated POST /v1/onboarding/config endpoint by checking...
CVE-2026-44471: gitoxide Symlink Vulnerability Exposes Filesystem to Attack
CVE-2026-44471 — gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out...