This vulnerability (CVE-2026-40844) affects the mbCONNECT24 product and involves improper neutralization of special elements used in an SQL command (CWE-89). Specifically, an unauthenticated attacker with low privileges can perform SQL Injection in the dashboard view, exploiting a flaw in how SQL SELECT commands are constructed. The CVSS 4.0 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No official remediation or patch has been documented yet.

Exploitation of this vulnerability can result in a total loss of confidentiality, meaning sensitive data accessible via the SQL database could be disclosed to the attacker. The vulnerability does not require authentication and can be triggered remotely, increasing the risk. There is no indication of integrity or availability impacts. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider restricting access to the dashboard view and monitoring for unusual database query activity. Avoid exposing the vulnerable interface to untrusted networks if possible.