CVE-2026-0603

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 8.3EPSS 1%

Published 2026-01-23Updated 2026-01-23

Media 1324

Vulnerability details

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CNAredhat

EPSS score history

Sources

3 links

PoC links are not available for guest users. Login to view them.

CVEShield RedHat Vuln DB CVE Organization

Profile

CVSS

8.3

EPSS

Published

2026-01-23

Updated

2026-01-23

CNA

redhat

Vendors

No vendors listed.

CPEs

cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7

cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7

cpe:/a:redhat:jboss_enterprise_application_platform:7.4

cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7

cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8

cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9

cpe:/a:redhat:amq_broker:7

cpe:/a:redhat:optaplanner:::el6

cpe:/a:redhat:jboss_data_grid:8

cpe:/a:redhat:jboss_fuse:7

cpe:/a:redhat:jboss_enterprise_application_platform:8

cpe:/a:redhat:jbosseapxp

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift_devspaces:3

cpe:/a:redhat:jboss_enterprise_bpms_platform:7

cpe:/a:redhat:satellite:6

cpe:/a:redhat:red_hat_single_sign_on:7

cpe:/a:redhat:jboss_enterprise_application_platform:7

cpe:/a:redhat:jboss_enterprise_application_platform::el7

cpe:/a:redhat:red_hat_single_sign_on:7.6

cpe:/a:redhat:rhosemc:1.0::el8

cpe:/a:redhat:red_hat_single_sign_on:7.6::el8

cpe:/a:redhat:red_hat_single_sign_on:7.6::el9

cpe:/a:redhat:red_hat_single_sign_on:7.6::el7

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated