This vulnerability (CVE-2026-54185) is an SQL Injection issue classified under CWE-89 in THEMECO Cornerstone software versions before 7.8.8. It allows an attacker with network access and low privileges to inject SQL commands due to improper sanitization of input in the subscriber functionality. The CVSS 3.1 score is 8.5, reflecting a high severity with network attack vector, low attack complexity, no user interaction, and a scope change. The impact affects confidentiality (high) and availability (low), but not integrity. No known exploits in the wild or official remediation have been reported as of the published date.

Successful exploitation could allow an attacker to access sensitive data in the database (high confidentiality impact) and cause limited disruption to availability. Integrity is not impacted according to the CVSS vector. The vulnerability requires low privileges and no user interaction, making it relatively accessible for attackers with network access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor THEMECO's advisories for updates. Until a patch is available, consider restricting network access to the affected application and reviewing input validation controls related to subscriber SQL queries.