CVE-2026-5372

CVE-2026-5372 is a SQL injection vulnerability affecting the runZero Platform, specifically in the saved queries functionality introduced in version 4.0.260123.0. The flaw stems from improper neutralization of special elements in SQL commands (CWE-89), allowing attackers to inject malicious SQL code. This issue has been remediated in version 4.0.260123.1. The vulnerability carries a CVSS 3.1 score of 6.4 (Medium severity) with a network-based attack vector requiring high privileges and user interaction. While the attack complexity is high, successful exploitation could result in high-impact consequences including confidentiality, integrity, and availability compromise. The FAUCET Risk Score of 44.0 out of 100 indicates moderate overall risk. There is currently no evidence of active exploitation in the wild, and CVE-2026-5372 does not appear on the CISA KEV catalog or industry hot lists. The extremely low EPSS score of 0.00035 suggests minimal probability of exploitation in real-world scenarios. Organizations using affected versions should prioritize patching to version 4.0.260123.1 as part of standard maintenance procedures rather than emergency response protocols.