CVE-2026-38158 is a SQL injection vulnerability affecting ureport version 2.2.9. The vulnerability resides in the /ureport/datasource/previewData component, where insufficient input sanitization allows attackers to inject malicious SQL queries. This can lead to unauthorized access to sensitive database data and full compromise of the affected system's data confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability can result in unauthorized disclosure of sensitive database information, modification or deletion of data, and potential disruption of service. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting /ureport/datasource/previewData. Monitor for updates from the vendor regarding patches or official mitigations.