CVE-2026-52470 describes an SQL injection vulnerability in Crocus version 1.3.44. The flaw exists in the handling of the RecordStateMapper.xml file, enabling a remote attacker to escalate privileges by injecting malicious SQL commands. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CVSS v3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation allows a remote attacker to escalate privileges on the affected system, potentially leading to full compromise including unauthorized data access, modification, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the vulnerable component and monitor for suspicious activity related to SQL injection attempts targeting the RecordStateMapper.xml file.