CVE-2026-57739 describes an improper neutralization of special elements used in an SQL command (Blind SQL Injection) in AcyMailing SMTP Newsletter by AcyMailing Newsletter Team. The vulnerability allows remote attackers to execute SQL injection attacks without authentication or user interaction, potentially exposing sensitive data. It affects all versions up to and including 10.11.0. The CVSS 3.1 score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a confidentiality impact rated high, integrity impact none, and availability impact low. No official patch or remediation level is currently stated, and no known exploits are reported in the wild.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited availability impact. Since it is a Blind SQL Injection, attackers can infer data from the database without direct error messages. The vulnerability is exploitable remotely without authentication or user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying workarounds such as disabling or restricting access to the vulnerable component, employing web application firewalls with SQL injection detection rules, and monitoring for suspicious database queries. Avoid exposing the affected service to untrusted networks.