This vulnerability (CVE-2026-40836) affects mbCONNECT24 and involves an unauthenticated SQL Injection in the inmessage model. The issue arises from improper neutralization of special elements in a SQL DELETE command, enabling a low privileged remote attacker to read the entire database and delete entries in a non-critical table. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). No patch or official remediation level has been published yet.

Exploitation of this vulnerability can lead to total loss of confidentiality of the database contents and some loss of integrity due to deletion of entries in a non-critical table. There is no indication of impact on availability. The attacker requires low privileges and no user interaction, making the attack feasible remotely. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor MB connect line advisories for updates. Until a fix is available, restricting network access to the affected service and applying compensating controls may reduce exposure.