CVE-2026-19926 is a remote SQL injection vulnerability affecting the open-ils.fielder OpenSRF Service component of Evergreen software versions up to 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. The flaw is triggered by manipulation of an unspecified function within the /osrf-gateway-v1 file. Successful exploitation can lead to unauthorized disclosure, modification, or destruction of data. Public exploit code is available, increasing the risk of exploitation. The vendor has released fixed versions 3.14.12, 3.15.12, 3.16.6, and 3.17-beta2 to remediate the vulnerability.

The vulnerability allows remote attackers to perform SQL injection attacks, which can lead to unauthorized data disclosure, data modification, and potential denial of service. The CVSS 3.1 score of 7.3 reflects a moderate severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The presence of public exploit code increases the likelihood of exploitation.

Upgrade affected Evergreen versions to 3.14.12, 3.15.12, 3.16.6, or 3.17-beta2 as these versions contain the official fix for this SQL injection vulnerability. No other mitigation is indicated by the vendor advisory. Patch status is confirmed by the provided version upgrade information.