CVE-2026-40529 is an SQL injection vulnerability in KANATA Limited's CMS ALAYA affecting versions 7.4.1.4 and earlier. The vulnerability arises from improper neutralization of special elements used in SQL commands, enabling attackers with administrative interface access to read or modify database information. The CVSS 3.0 base score is 4.7, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level.

An attacker with access to the administrative interface can exploit this SQL injection vulnerability to obtain or alter data stored in the CMS ALAYA database. This could lead to unauthorized disclosure, modification, or disruption of data. However, exploitation requires administrative privileges, limiting the scope of impact. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative interface access to trusted users only and monitor for suspicious activity related to database queries. Avoid exposing the administrative interface to untrusted networks.