Security readout for executives and security teams
Plain-English summary
CVE-2026-23492 affects Pimcore admin search. A logged-in attacker can abuse an incomplete SQL injection fix to infer database data through blind techniques. The issue is fixed in Pimcore 12.3.1 and 11.5.14. Treat this as urgent for internet-accessible or broadly accessible Pimcore admin environments.
Executive priority
Prioritize patching within the next maintenance window, faster for internet-facing admin portals. The vulnerability can expose or affect database contents after authenticated access, making it material for systems managing customer, product, or experience data.
Technical view
Pimcore versions before 12.3.1 and 11.5.14 contain blind SQL injection in the Admin Search Find API. The earlier CVE-2023-30848 fix removed SQL comments and caught syntax errors, but did not prevent payloads that avoid comments. CVSS is 8.8, network exploitable, low complexity, low privileges, no user interaction.
Likely exposure
Exposure is limited to Pimcore deployments running affected versions with authenticated access to the admin interface. Risk rises where admin access is internet-facing, shared widely, or protected only by weak credentials.
Exploitation context
The sources do not report active exploitation, and this CVE is not marked KEV in the provided bundle. Exploitation requires authentication and uses blind SQL injection, meaning attackers infer database information without direct error output.
Researcher notes
This is CWE-89 SQL injection in Pimcore’s Admin Search Find API. The key nuance is an incomplete prior fix for CVE-2023-30848: filtering comments and catching syntax errors did not eliminate blind SQL injection paths. Do not assume prior remediation fully addressed the issue.
Mitigation direction
- Upgrade Pimcore 12.x deployments to 12.3.1 or later.
- Upgrade Pimcore 11.x deployments to 11.5.14 or later.
- Limit Pimcore admin interface access to trusted networks and users.
- Review Pimcore’s security advisory for any updated vendor guidance.
Validation and detection
- Inventory Pimcore versions across all environments.
- Flag versions before 12.3.1 in the 12.x branch.
- Flag versions before 11.5.14 in the 11.x branch.
- Confirm admin interface access is restricted to authorized users.
- Review authentication and admin search activity for anomalies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-23492 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/pimcore/pimcore/security/advisories/GHSA-qvr7-7g55-69xjCVE reference · x_refsource_CONFIRM
- https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.