High severity · published Jan 17, 2026
CVE-2026-1050
risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injection
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/util/Y9PlatformUtil.java of the component REST Authenticate Endpoint. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Digital-Infrastructure · risesoft-y9
9.6.0; 9.6.1; 9.6.2; 9.6.3; 9.6.4; 9.6.5; +2 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1050
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1050
github.com
https://github.com/risesoft-y9/Digital-Infrastructure/
github.com
https://github.com/risesoft-y9/Digital-Infrastructure/issues/2
github.com
https://github.com/risesoft-y9/Digital-Infrastructure/issues/2#issue-3777863959
vuldb.com
https://vuldb.com/?ctiid.341603
vuldb.com
https://vuldb.com/?id.341603
vuldb.com
https://vuldb.com/?submit.731010
More from Digital-Infrastructure
9.1
CVE-2026-110116
Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile
7.5
CVE-2026-110115
Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream
6.5
CVE-2026-111651
Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController
5.4
CVE-2025-7108
risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversal