{"id":"CVE-2026-0603","title":"A flaw was found in Hibernate","summary":"A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrCl…","severity":"high","cvss":8.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cwe":["CWE-89"],"published":"2026-01-23","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0603","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:4915","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:4916","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:4917","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:4924","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:6011","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:6012","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-0603","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427147","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:4915","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4916","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4917","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4924","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6011","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6012","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-0603","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427147","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0603.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0603"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0603"}],"tags":["nvd","exploit-available","csaf","vex","red-hat","cve.org"],"epss":0.0087,"epssPercentile":0.56779,"ingestedAt":"2026-06-30T17:40:12.450Z","exploits":{"github":1,"githubRepos":["https://github.com/EQSTLab/CVE-2026-0603"],"checkedAt":"2026-09-21T15:27:49.817Z"},"exploitAvailable":true,"vendor":"Red Hat","product":"Red Hat JBoss EAP 7.4 ELS for RHEL 8","affected":["amq_broker 7","build_of_optaplanner 8","fuse 7","jboss_enterprise_application_platform 7","process_automation 7","single_sign_on 7","jboss_enterprise_application_platform_7_1_eus_for_rhel_7_server","jboss_enterprise_application_platform_7_3_eus_for_rhel_7_server","jboss_eap_7_4_els_for_rhel_7_server","jboss_eap_7_4_els_for_rhel 8","jboss_eap_7_4_els_for_rhel 9","jboss_enterprise_application_platform 7.4.24"],"patched":["jboss_enterprise_application_platform_7_1_eus_for_rhel_7_server","jboss_enterprise_application_platform_7_3_eus_for_rhel_7_server","jboss_eap_7_4_els_for_rhel_7_server","jboss_eap_7_4_els_for_rhel 8","jboss_eap_7_4_els_for_rhel 9","jboss_enterprise_application_platform 7.4.24"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-01-24T04:55:25.177681Z"},"slug":"CVE-2026-0603","body":"## Overview\n\nA flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:6012** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6012)\n- **RHSA-2026:6011** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6011)\n- **RHSA-2026:4915** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4915)\n- **RHSA-2026:4916** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 8 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4916)\n- **RHSA-2026:4917** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 9 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4917)\n- **RHSA-2026:4924** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.4.24 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4924)\n- **Red Hat VEX** · Important · affected: Red Hat AMQ Broker 7, Red Hat build of OptaPlanner 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Process Automation 7, Red Hat Single Sign-On 7 · no fix planned: Red Hat build of OptaPlanner 8, Red Hat Fuse 7, Red Hat Process Automation 7, Red Hat Single Sign-On 7, … · updated 2026-09-12 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0603.json)","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":45.7,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":4925,"id":"CVE-2026-0603","ts":1788887216241,"field":"exploit_available","old":"false","new":"true"},{"seq":3808,"id":"CVE-2026-0603","ts":1788886338153,"field":"exploit_available","old":"true","new":"false"},{"seq":2648,"id":"CVE-2026-0603","ts":1788883014006,"field":"exploit_available","old":"false","new":"true"},{"seq":1677,"id":"CVE-2026-0603","ts":1788882418267,"field":"exploit_available","old":"true","new":"false"},{"seq":785,"id":"CVE-2026-0603","ts":1788881851834,"field":"exploit_available","old":"false","new":"true"}]}