CVE-2026-34018

CVE-2026-34018 is an SQL injection vulnerability affecting CubeCart versions prior to 6.6.0, allowing unauthenticated attackers to execute arbitrary SQL statements against vulnerable systems. The vulnerability carries a CVSS severity rating of 9.8 (CRITICAL) due to its network-accessible attack vector, low complexity, and lack of required privileges or user interaction, resulting in complete compromise of confidentiality, integrity, and availability. The exploitation landscape indicates minimal current activity, with no evidence of active exploitation in the wild and an EPSS score of 0.0003 suggesting low probability of near-term exploitation. No known exploit code is publicly available on the KEV catalog, and community attention remains limited as indicated by the vulnerability's inactive status on threat intelligence hotlists. Organizations running CubeCart should prioritize upgrading to version 6.6.0 or later to remediate this critical risk.