CVE-2026-5963 is a SQL Injection vulnerability in Digiwin EasyFlow .NET affecting versions 6.1.*, 6.6.*, and 8.1.1. The flaw allows unauthenticated remote attackers to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This can result in unauthorized access and manipulation of the underlying database. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows unauthenticated remote attackers to read, modify, and delete database contents, potentially compromising the confidentiality, integrity, and availability of the affected system's data. This can lead to significant data breaches and operational disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing network-level protections such as restricting access to the affected application to trusted networks and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable versions to untrusted networks.