CVE-2026-54187 is an unauthenticated SQL Injection vulnerability (CWE-89) in Jetimpex Inc.'s JetEngine product affecting versions up to 3.8.10.1. The vulnerability allows remote attackers to inject SQL commands without requiring authentication, resulting in a high impact on confidentiality and a low impact on availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation level has been published as of the data provided.

The vulnerability allows unauthenticated remote attackers to perform SQL Injection attacks, which can lead to unauthorized disclosure of sensitive data (high confidentiality impact). The availability impact is low, meaning the system may experience some disruption but not complete denial of service. Integrity impact is not affected. The vulnerability affects the confidentiality of the database underlying JetEngine.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or mitigations recommended by the vendor. Monitor vendor channels for updates and apply patches promptly once available.