CVE-2026-115738: Trellix DLP on-prem extensions SQL injection…

Summary

SQL injection flaw in DLP on-prem extensions (version details omitted) lets an attacker who has a low-privilege login remotely send crafted SQL queries to the product, which can expose database data. The bug is reached over the network and needs a login, but no user interaction.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Read the original description

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries.

cve.now Index

15Pcve.now Index 15 of 100 · methodology v3 · provisional

Exploitation0/40No signal
Exposure3/25Reachable over the network · Unknown: No advisory context yet
Reach?/20Unknown. No tracked technology or package matched
Severity7.1/10CVSS 7.1
No patch5/5No patch listed yet

What would change the score

Would score about 70 if added to CISA KEV
Would score about 65 if CISA's SSVC rates exploitation active
Would score about 34 if advisories confirm default setups are exposed

How the score works · Leaderboard

Timeline

Nov 5, 2026, 3:06 PM UTCCVE published
Nov 5, 2026, 3:12 PM UTCFirst seen by cve.now
Nov 5, 2026, 4:16 PM UTCCISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
Nov 5, 2026, 4:21 PM UTCRecord last updated

Affected versions

Trellix DLP on-prem extensions
Version range not reported

Evidence 1

Link
support.trellix.com · s/article/000015949

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL…