This vulnerability (CVE-2026-40835) affects the mbCONNECT24 product from MB connect line. It arises from improper neutralization of special elements in an SQL SELECT command in the saveObjectFromData function, enabling an unauthenticated, low privileged remote attacker to perform SQL Injection. Exploitation could result in total loss of confidentiality of the affected system's data. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No vendor advisory or patch information is currently available.

Successful exploitation of this SQL Injection vulnerability can lead to a total loss of confidentiality, meaning an attacker could access sensitive data stored in the backend database without authorization. The vulnerability is exploitable remotely without authentication, increasing the risk exposure. There is no indication of impact on integrity or availability from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting network access to the affected service to trusted users only and monitor for unusual activity related to SQL queries. Avoid exposing mbCONNECT24 interfaces to untrusted networks. Do not rely on generic mitigations without vendor confirmation.