Security Digest: June 1, 2026 - 14 Critical Vulnerabilities

Today’s alert is dominated by high-risk SQL injection, authentication bypass, XSS, and privilege escalation flaws affecting OTRS, Apache Solr, Apache MINA SSHD, DELMIA, and multiple public web applications. Several issues are already publicly exploited or have working proof-of-concept code, which means defenders should move to patching, credential review, and exposure reduction immediately.

· 11 min read

Executive Summary

Today’s alert is dominated by high-risk SQL injection, authentication bypass, XSS, and privilege escalation flaws affecting OTRS, Apache Solr, Apache MINA SSHD, DELMIA, and multiple public web applications. Several issues are already publicly exploited or have working proof-of-concept code, which means defenders should move to patching, credential review, and exposure reduction immediately.

If you run any affected platform, assume compromise is possible until proven otherwise. Prioritize internet-facing systems, admin portals, and any environment using default or bootstrap credentials.

Critical Vulnerabilities

CVE-2026-48188: OTRS SQL Injection Leading to Authentication Bypass

  • Impact: Unauthenticated attackers may inject SQL and bypass authentication.
  • Affected Systems: OTRS 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.4.x; ((OTRS)) Community Edition 6.0.x; likely downstream products. Only exposed when MySQL/MariaDB uses NO_BACKSLASH_ESCAPES.
  • Immediate Action: Check database SQL mode now; if NO_BACKSLASH_ESCAPES is enabled, treat the system as urgent priority and restrict access immediately.
  • Mitigation: Upgrade to a fixed OTRS release; remove the risky SQL mode where possible; review authentication logs for suspicious logins.

CVE-2026-9024: DELMIA Service Process Engineer Stored XSS

  • Impact: Attackers can store script that runs in a user’s browser session.
  • Affected Systems: DELMIA Service Process Engineer in 3DEXPERIENCE R2024x through R2026x.
  • Immediate Action: Restrict access to Process Experience Studio and warn users not to open untrusted project content.
  • Mitigation: Apply vendor patch as soon as available; review session theft risk and force reauthentication for exposed users.

CVE-2026-44825: Apache Solr Hardcoded Credentials in Basic Auth Bootstrap

  • Impact: Remote attackers can gain full admin access using known default credentials.
  • Affected Systems: Apache Solr 9.4.0 through 9.10.1 and 10.0.0 when bin/solr auth enable was used.
  • Immediate Action: Find any cluster bootstrapped with BasicAuth and rotate credentials now.
  • Mitigation: Delete template users superadmin, admin, search, index from security.json or change passwords immediately; upgrade to 9.11.0 or 10.1.0 when released.

CVE-2026-27788: ServerView Agents for Windows Privilege Escalation

  • Impact: A local authenticated attacker can gain SYSTEM privileges.
  • Affected Systems: ServerView Agents for Windows V11.60.04 and earlier.
  • Immediate Action: Treat any shared or low-trust Windows host as high risk and remove unnecessary local accounts.
  • Mitigation: Apply the vendor fix; audit privileged local access and isolate affected servers.

CVE-2026-10243: Smart Parking System Missing Authentication

  • Impact: Remote attackers can access admin endpoints without authentication.
  • Affected Systems: code-projects Smart Parking System 1.0, multiple endpoints.
  • Immediate Action: Block public access to the admin interface and review for unauthorized changes.
  • Mitigation: Remove internet exposure, apply any available patch, and hunt for suspicious admin activity.

CVE-2026-10250: Online Blood Bank Management System SQL Injection

  • Impact: Remote SQL injection may allow data theft or further compromise.
  • Affected Systems: itsourcecode Online Blood Bank Management System 1.0, /admin/campsdetails.php.
  • Immediate Action: Disable or restrict the admin module until patched.
  • Mitigation: Patch immediately; inspect database access logs for abnormal queries.

CVE-2026-10225: Student Management System Login SQL Injection

  • Impact: Remote attackers can inject SQL via the login flow.
  • Affected Systems: raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1.
  • Immediate Action: Assume login credentials may be exposed and rotate privileged accounts.
  • Mitigation: Apply project fixes when available; add WAF rules and monitor login anomalies.

CVE-2026-10226: Student Management System Delete Function SQL Injection

  • Impact: Remote SQL injection may expose or alter records.
  • Affected Systems: raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1.
  • Immediate Action: Restrict delete endpoints and review all destructive actions.
  • Mitigation: Patch the application; check for mass record changes or database tampering.

CVE-2026-10227: Student Management System User Creation SQL Injection

  • Impact: Remote attackers can inject SQL through role assignment.
  • Affected Systems: raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1.
  • Immediate Action: Audit newly created accounts and roles right away.
  • Mitigation: Patch, then verify no unauthorized users or privilege changes exist.

CVE-2026-10236: Water Billing Management System Improper Authorization

  • Impact: Remote attackers may bypass authorization in user management.
  • Affected Systems: SourceCodester Water Billing Management System 1.0, /classes/Users.php?f=save.
  • Immediate Action: Remove public access to the user management endpoint.
  • Mitigation: Apply vendor or project remediation; review user account changes and access logs.

CVE-2026-10249: Online Blood Bank Management System SQL Injection

  • Impact: Remote SQL injection via request ID parameter.
  • Affected Systems: itsourcecode Online Blood Bank Management System 1.0, /admin/viewrequest.php.
  • Immediate Action: Restrict admin access and inspect request-processing logs.
  • Mitigation: Patch immediately; look for suspicious database reads or writes.

CVE-2026-10208: Online Hospital Management System Login SQL Injection

  • Impact: Remote attackers can inject SQL during login.
  • Affected Systems: code-projects Online Hospital Management System 1.php, login_1.php.
  • Immediate Action: Treat exposed login pages as high risk and place them behind access controls.
  • Mitigation: Patch the application and review authentication logs for brute force or injection patterns.

CVE-2026-48827: Apache MINA SSHD sshd-git Path Traversal

  • Impact: Authenticated SSH users may access repositories outside the intended git root.
  • Affected Systems: Applications using org.apache.sshd:sshd-git; Apache MINA SSHD 2.18.0 fixes it, and 3.0.0-M1 to M3 are also affected.
  • Immediate Action: Identify any product embedding sshd-git and restrict SSH git access until patched.
  • Mitigation: Upgrade to 2.18.0 or 3.0.0-M4; do not rely on filesystem permissions alone.

CVE-2026-48209: OTRS Reflected XSS in Ticket Actions

  • Impact: Authenticated attackers can execute script in an agent’s session via crafted ticket links.
  • Affected Systems: OTRS 7.0.x; ((OTRS)) Community Edition 6.x and earlier; likely downstream products.
  • Immediate Action: Warn agents not to open untrusted ticket URLs and inspect recent ticket activity.
  • Mitigation: Patch OTRS promptly; consider temporary link filtering and session revocation for exposed users.

Previously Alerted

What to Do Now

  1. Patch or isolate immediately any internet-facing OTRS, Solr, DELMIA, SSH git, or public web app instance listed above.
  2. Rotate credentials for Solr bootstrap users and any admin or privileged accounts that may have been exposed.
  3. Disable risky endpoints such as admin panels, login pages, delete functions, and user-management routes until fixes are deployed.
  4. Verify exposure by checking versions, bootstrap methods, SQL modes, and whether sshd-git or affected modules are in use.
  5. Hunt for compromise in auth logs, database logs, account creation events, and unexpected admin changes.

Verification steps: confirm exact versions, confirm whether NO_BACKSLASH_ESCAPES is enabled, confirm whether Solr BasicAuth was bootstrapped with bin/solr auth enable, and confirm whether sshd-git is present in any deployed application.

Monitoring recommendations: watch for unusual logins, new admin users, session hijacking indicators, database errors, suspicious SSH repository access, and changes to security configuration files.

Related Resources

  • Internal blog post on emergency patch prioritization for public-facing applications: to be published
  • Internal blog post on credential rotation after exposed admin access: to be published
  • Official vendor advisories for OTRS, Apache Solr, Apache MINA SSHD, DELMIA, and affected web applications

Keep reading