Skip to content
Fencer Vulns
high 8.6

CVE-2026-77874 json

IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

published 2026-09-24 45 d ago modified 2026-09-24 45 d ago also EUVD-2026-86012

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Patch / fix

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-77874 updated cvss 8.6

org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass

  • Red Hat build of Debezium 3 hibernate-core
    affected: workaround, no fix available
  • Red Hat JBoss Enterprise Application Platform 7 hibernate-core, jboss-eap-7/eap74-els-openjdk8-openshift-rhel8, jboss-eap-7/eap74-els-openjdk11-openshift-rhel8, jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 Red Hat OpenStack Platform 13 (Queens) opendaylight Red Hat Single Sign-On 7 hibernate-core
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apache Camel 4 for Quarkus 3 hibernate-core
    under investigation
  • Red Hat Build of Apache Camel 3.33.3.SP2 hibernate-core 7.2.19.Final-redhat-00002
    fixed: vendor fix RHSA-2026:70257
  • Red Hat build of Keycloak 26.4 rhbk/keycloak-rhel9 26.4-29, rhbk/keycloak-rhel9-operator 26.4-30, rhbk/keycloak-operator-bundle 26.4.17-2
    fixed: vendor fix RHSA-2026:95760
  • Red Hat build of Keycloak 26.4.17
    fixed: vendor fix RHSA-2026:95759
  • Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9 26.6-24, rhbk/keycloak-rhel9-operator 26.6-24, rhbk/keycloak-operator-bundle 26.6.8-2
    fixed: vendor fix RHSA-2026:95762
  • Red Hat build of Keycloak 26.6.8
    fixed: vendor fix RHSA-2026:95761
show 11 more
  • Red Hat build of Quarkus 3.27.5.SP2
    fixed: vendor fix RHSA-2026:69470
  • Red Hat build of Quarkus 3.33.3.SP2
    fixed: vendor fix RHSA-2026:69440
  • Red Hat OpenShift AI 2.25 rhoai/odh-trustyai-service-rhel9 1790933094
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.4 rhoai/odh-trustyai-service-rhel9 1791792525
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift AI 3.5 rhoai/odh-trustyai-service-rhel9 1791951741
    fixed: vendor fix RHSA-2026:86891
  • Red Hat Cryostat 4 hibernate-core
    not affected: component not present
  • Red Hat Build of Apache Camel 3.33.3.SP2 jimfs 1.1, jna 5.8.0, bcel 6.7.0, gax 2.74.1, icu4j 78.2, joni 2.2.6, +1616 more
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 9 guice-bom, guice-jmx, guice-jndi, google-guice, guice-parent, guice-grapher, +5 more Red Hat Enterprise Linux 10 google-guice 5.1.0-12.el10
    not affected: component not present
  • Red Hat Fuse 7 hibernate-core
    not affected: vulnerable code cannot be controlled by adversary
  • Red Hat JBoss Enterprise Application Platform 8 hibernate-core Red Hat JBoss Enterprise Application Platform Expansion Pack hibernate-core Red Hat JBoss Web Server 5 hibernate-core
    not affected: component not present
  • Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-modelmesh-rhel9 1790881700, rhoai/odh-operator-bundle 1792571069, rhoai/odh-vllm-cuda-rhel9 1791358976, +65 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1791535789, rhoai/odh-mlflow-rhel9 1791865967, rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-trainer-rhel9 1791869783, +99 more Red Hat OpenShift AI 3.5 rhoai/odh-cli-rhel9 1791945905, rhoai/rhai-cli-rhel9 1791945905, rhoai/odh-automl-rhel9 1791916705, rhoai/odh-mlflow-rhel9 1791947857, rhoai/odh-autorag-rhel9 1791903266, rhoai/odh-trainer-rhel9 1791952138, +112 more Red Hat OpenShift Dev Spaces devspaces/openvsx-rhel9, devspaces/pluginregistry-rhel9 Red Hat Satellite 6 candlepin, candlepin-selinux
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
45 d ago

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
NVD 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Affected products

  • IBM Enterprise Build of Quarkus

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.