CVE-2026-6887

CVE-2026-6887 is a SQL injection vulnerability affecting Borg SPM 2007, a legacy sales and project management solution from BorG Technology Corporation that reached end-of-support in 2008. The flaw permits unauthenticated remote attackers to inject arbitrary SQL commands into the application, potentially enabling unauthorized access to read, modify, or delete sensitive database contents. The vulnerability carries a CVSS 3.1 score of 9.8 (Critical) due to its network-based attack vector, low complexity, and lack of authentication or user interaction requirements. The attack has a complete impact on confidentiality, integrity, and availability of affected systems, making this a high-severity risk for any organization still operating this legacy platform. There are currently no indicators of active exploitation in the wild, as this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.000810000 suggests minimal likelihood of exploitation relative to other CVEs, and community attention appears limited given the product's obsolete status. However, organizations still using this legacy system should prioritize patching or decommissioning immediately.