CVE-2026-113406: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in YS-infoware BA-Workflow

CVE-2026-113406 is a SQL Injection vulnerability in YS-infoware's BA-Workflow product. Authenticated remote attackers can exploit improper neutralization of special elements in SQL commands to execute arbitrary SQL statements. This can compromise the confidentiality, integrity, and availability of the database. The vulnerability affects all versions starting from 0 up to but excluding 3.6. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers with authentication to read, modify, and delete database contents, potentially leading to data breaches, data loss, and disruption of application functionality. The high CVSS score reflects significant risk to data security and system stability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious activity related to SQL injection attempts.