CVE-2026-40842 describes an SQL Injection vulnerability in the mbCONNECT24 product from MB connect line. The issue exists in the getWidgetTags function where special elements in a SQL SELECT command are not properly neutralized, allowing an unauthenticated remote attacker with low privileges to inject SQL commands. This can result in unauthorized access to sensitive data, causing a total loss of confidentiality. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1. No patch or official remediation level has been published yet. The product is not cloud-hosted, so mitigation requires vendor or user intervention.

Successful exploitation of this vulnerability can lead to a total loss of confidentiality by allowing attackers to execute arbitrary SQL commands remotely without authentication. This compromises sensitive data stored in the affected system. The vulnerability affects mbCONNECT24 and is exploitable by low privileged remote attackers. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected functionality or applying compensating controls if feasible.