CVE-2026-26263 is a high-severity SQL injection vulnerability (CWE-89) affecting the GLPI asset and IT management software. Specifically, versions 11.0.0 through 11.0.5 have an unauthenticated time-based blind SQL injection flaw in the Search engine component. This allows an attacker to inject malicious SQL commands remotely without prior authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is resolved in GLPI version 11.0.6.

Successful exploitation can lead to complete compromise of the affected GLPI instance, including unauthorized data disclosure, data modification, and denial of service. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

Upgrade GLPI to version 11.0.6 or later, where this SQL injection vulnerability is fixed. Since the vendor advisory confirms the fix in 11.0.6, applying this official update is the recommended remediation. Patch status is confirmed by the vendor's versioning information. No other mitigation or temporary workaround is indicated.