This vulnerability (CVE-2026-40824) is an SQL Injection flaw classified under CWE-89 in MB connect line's mbCONNECT24 product. It specifically affects the userid parameter in the accountstatus view, where special characters are not properly neutralized in a SQL UPDATE command. An attacker with high privileges but no authentication can exploit this to read the entire database and alter data in a non-critical table. The vulnerability impacts confidentiality severely and integrity to a lesser extent. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high confidentiality impact. There is no vendor-provided patch or remediation level at this time, and no known active exploitation has been reported.

Exploitation of this vulnerability can lead to a total loss of confidentiality of the database contents and partial loss of data integrity by modifying values in a non-critical table. This could expose sensitive information and corrupt some data, although critical tables are not affected according to the description. The vulnerability requires high privileges but no authentication or user interaction, and it is exploitable remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor MB connect line advisories for updates. Until a patch is available, restricting access to the affected parameter and applying network-level controls to limit exposure may reduce risk. No vendor advisory states that no action is required or that the issue is mitigated.