This vulnerability (CVE-2026-56068) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in JetEngine versions <= 3.8.10.2. It allows unauthenticated attackers to inject SQL commands, which can compromise the confidentiality of the database and cause limited availability impact. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with high confidentiality impact and low availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability is exploitable remotely without authentication, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as restricting access to vulnerable endpoints or employing web application firewalls with SQL injection detection rules tailored to JetEngine. Monitor vendor channels for updates and patches.