CVE-2026-34185

CVE-2026-34185 is a SQL injection vulnerability affecting Hydrosystem Control System across most scripts and input parameters. The flaw enables authenticated attackers to inject arbitrary SQL commands without any protective measures in place, potentially achieving complete database compromise. This issue was remediated in version 9.8.5. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring low complexity and valid credentials. The impact is severe across all three dimensions: attackers can achieve high confidentiality, integrity, and availability breaches, enabling full database control and potential lateral movement within affected systems. Exploitation status indicators suggest limited current activity. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is inactive on threat intelligence hot lists. While the EPSS score of 0.00032 indicates relatively low probability of exploitation compared to other CVEs, organizations running unpatched versions remain at risk and should prioritize updating to version 9.8.5 or later.