CVE-2026-19926
Estado: AplazadaMedia (5.5)—
A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.14.12, 3.15.12, 3.16.6 and 3.17-beta2 is sufficient to fix this issue. The affected component should be upgraded.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.43%
- Percentil entre todas las CVEs puntuadas: 36
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-74, CWE-89
Referencias
- https://bugs.launchpad.net/evergreen/+bug/2147196
- https://bugs.launchpad.net/evergreen/+bug/2147196/+attachment/5958185/+files/2.png
- https://evergreen-ils.org/Evergreen-security-release-3-14-12-3-15-12-3-16-6-3-17-beta2
- https://vuldb.com/cve/CVE-2026-19926
- https://vuldb.com/submit/871976
- https://vuldb.com/vuln/390177
- https://vuldb.com/vuln/390177/cti
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-19926",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-19926",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-08-18T02:25:32.117872Z"
}
}
],
"cvssMetricV2": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.3,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 3.4,
"exploitabilityScore": 3.9
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 5.5,
"Automatable": "NOT_DEFINED",
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "PROOF_OF_CONCEPT",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "cna@vuldb.com",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:evergreen:evergreen:*:*:*:*:*:*:*:*"
],
"vendor": "n/a",
"modules": [
"open-ils.fielder OpenSRF Service"
],
"product": "Evergreen",
"versions": [
{
"status": "affected",
"version": "3.14.0"
},
{
"status": "affected",
"version": "3.14.1"
},
{
"status": "affected",
"version": "3.14.2"
},
{
"status": "affected",
"version": "3.14.3"
},
{
"status": "affected",
"version": "3.14.4"
},
{
"status": "affected",
"version": "3.14.5"
},
{
"status": "affected",
"version": "3.14.6"
},
{
"status": "affected",
"version": "3.14.7"
},
{
"status": "affected",
"version": "3.14.8"
},
{
"status": "affected",
"version": "3.14.9"
},
{
"status": "affected",
"version": "3.14.10"
},
{
"status": "affected",
"version": "3.14.11"
},
{
"status": "affected",
"version": "3.15.0"
},
{
"status": "affected",
"version": "3.15.1"
},
{
"status": "affected",
"version": "3.15.2"
},
{
"status": "affected",
"version": "3.15.3"
},
{
"status": "affected",
"version": "3.15.4"
},
{
"status": "affected",
"version": "3.15.5"
},
{
"status": "affected",
"version": "3.15.6"
},
{
"status": "affected",
"version": "3.15.7"
},
{
"status": "affected",
"version": "3.15.8"
},
{
"status": "affected",
"version": "3.15.9"
},
{
"status": "affected",
"version": "3.15.10"
},
{
"status": "affected",
"version": "3.15.11"
},
{
"status": "affected",
"version": "3.16.0"
},
{
"status": "affected",
"version": "3.16.1"
},
{
"status": "affected",
"version": "3.16.2"
},
{
"status": "affected",
"version": "3.16.3"
},
{
"status": "affected",
"version": "3.16.4"
},
{
"status": "affected",
"version": "3.16.5"
},
{
"status": "affected",
"version": "3.17-beta1"
},
{
"status": "unaffected",
"version": "3.14.12"
},
{
"status": "unaffected",
"version": "3.15.12"
},
{
"status": "unaffected",
"version": "3.16.6"
},
{
"status": "unaffected",
"version": "3.17-beta2"
}
]
}
]
}
],
"published": "2026-08-16T02:16:48.790",
"references": [
{
"url": "https://bugs.launchpad.net/evergreen/+bug/2147196",
"source": "cna@vuldb.com"
},
{
"url": "https://bugs.launchpad.net/evergreen/+bug/2147196/+attachment/5958185/+files/2.png",
"source": "cna@vuldb.com"
},
{
"url": "https://evergreen-ils.org/Evergreen-security-release-3-14-12-3-15-12-3-16-6-3-17-beta2",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/cve/CVE-2026-19926",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/submit/871976",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/vuln/390177",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/vuln/390177/cti",
"source": "cna@vuldb.com"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"description": [
{
"lang": "en",
"value": "CWE-74"
},
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.14.12, 3.15.12, 3.16.6 and 3.17-beta2 is sufficient to fix this issue. The affected component should be upgraded."
}
],
"lastModified": "2026-08-20T12:48:31.843",
"sourceIdentifier": "cna@vuldb.com"
}