CVE-2026-5964: Digiwin EasyFlow .NET - SQL Injection
CVE-2026-5964 describes an SQL Injection flaw (CWE-89) in Digiwin EasyFlow .NET that, according to the record, lets unauthenticated remote attackers run arbitrary SQL to read, modify, and delete database contents. The CNA TWCERT/CC reports a CVSS base score of 9.8. The record lists no fixed versions and no CISA KEV listing, so no confirmed exploitation appears in the sources consulted.
Overview
TWCERT/CC, acting as CNA, published CVE-2026-5964 describing an SQL Injection flaw (CWE-89) in Digiwin EasyFlow .NET. The record states that an unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database contents. Advisory details are available in the TWCERT/CC English advisory and the TWCERT/CC Chinese advisory.
Impact
The reported impact covers confidentiality, integrity and availability of the underlying database, since the record indicates total technical impact. The CNA-supplied CVSS base score is 9.8, which is in the critical range. Exploitation is described as requiring no authentication.
Affected products and versions
The record lists the product Digiwin Easyflow .net with these ranges and versions:
- From 6.6.0 up to and including 6.6.17.
- 6.1.0.
- 8.1.1 and 8.1.2, listed individually and as a range.
- Wildcard entries for sub-releases of the same branches, whose exact scope is not clarified in the record.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC fields in the record show exploitation as none and automatable as yes. Automatability is a triage input and is not evidence of observed attacks.
Remediation and mitigation
The record contains no fixed versions. An empty fix field does not mean no fix exists, so check the vendor and the TWCERT/CC advisories for update guidance. Until a fix is confirmed, prioritize an inventory of EasyFlow .NET deployments within the listed ranges, limit network exposure of the application, and apply vendor-recommended updates when they become available. Parameterized queries and strict input validation are the durable code-level remedies for this weakness class.
Detection guidance
- Review web application and database logs for unusual request parameters, repeated database errors, and unexpected data access patterns.
- Correlate such anomalies with requests coming from unauthenticated sources.
- Monitor for unexpected changes or deletions in database tables used by the application.
Limitations of the available information
The record does not provide a fixed version, vendor patch identifiers, root-cause technical details, or exploitation telemetry. It is not possible to determine from the record whether every wildcard range is affected, or whether the two listed advisories cover the same scope.
Frequently asked questions
What can an attacker do through this SQL Injection flaw?
According to the record, an unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database contents.
Is this vulnerability known to be exploited in the wild?
No. The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Which versions are affected and is there a fix?
The record lists versions from 6.6.0 up to and including 6.6.17, 6.1.0, 8.1.1 and 8.1.2, plus wildcard entries of unclear scope. It lists no fixed version, so check the vendor and TWCERT/CC advisories for update guidance.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.