High severity · published May 13, 2026
CVE-2026-6888
SQL Injection Vulnerability
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitrary commands via a specific interface, potentially enabling the attacker to access, modify, or delete sensitive information within the database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
ECOWatch SaaS-Composer · Advantech
prior to version 3.4.17 · source: vendor
IE
IoT Edge Linux docker · Advantech
prior to version 2.2.0 · source: vendor
IE
IoT Edge Windows · Advantech
prior to version 2.2.0 · source: vendor
IG
IoTSuite Growth Linux docker · Advantech
prior to version 2.2.0 · source: vendor
IS
IoTSuite Starter Linux docker · Advantech
prior to version 2.2.0 · source: vendor
SC
SaaS Composer · Advantech
prior to version 3.4.17 · source: vendor
WS
WebAccess SaaS-Composer · Advantech
prior to version 3.4.17.1 · source: vendor
WE
WebAccess/SCADA · Advantech
prior to version 9.2.3 · source: vendor