This vulnerability (CVE-2026-33616) involves an unauthenticated blind SQL Injection in the mb24api endpoint of mbCONNECT24. The root cause is improper neutralization of special elements in a SQL SELECT command, allowing attackers to inject malicious SQL code remotely without authentication. The vulnerability can be exploited to extract confidential data from the backend database, resulting in a total loss of confidentiality. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact. No patch or vendor advisory is currently provided, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation results in a total loss of confidentiality of sensitive data accessible via the mb24api endpoint. The attacker does not require authentication and can remotely execute blind SQL Injection attacks to extract data. There is no impact on integrity or availability reported. No known exploits in the wild have been documented yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor MB connect line communications for updates. Until a patch is available, consider restricting network access to the mb24api endpoint or implementing web application firewall (WAF) rules to detect and block SQL Injection attempts targeting this endpoint.