This vulnerability (CVE-2026-49076) is an instance of CWE-89, improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. It affects Jetimpex Inc.'s JetEngine product versions up to 3.8.9.1, allowing unauthenticated attackers to inject SQL commands. The CVSS 3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). The vulnerability does not affect data integrity. Because the attack requires no authentication and can be performed remotely, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable service and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the affected versions publicly if possible.