This vulnerability (CVE-2026-40840) affects the mbCONNECT24 product from MB connect line. It arises from improper neutralization of special elements in an SQL SELECT command within the VerifyCreateLicences function, enabling an unauthenticated, low privileged remote attacker to perform SQL Injection. This can lead to unauthorized access to sensitive data, resulting in a total loss of confidentiality. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. No official remediation or patch is currently documented.

An attacker exploiting this vulnerability can gain unauthorized access to sensitive information stored in the backend database, resulting in a total loss of confidentiality. The vulnerability does not affect integrity or availability according to the CVSS vector. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the affected service and monitoring for suspicious activity related to SQL Injection attempts. Avoid exposing the VerifyCreateLicences function to untrusted networks if possible.