CVE-2026-5964 is a SQL Injection vulnerability in Digiwin EasyFlow .NET affecting versions 6.1.*, 6.6.*, and 8.1.1. It allows unauthenticated remote attackers to inject malicious SQL commands due to improper neutralization of special elements in SQL queries (CWE-89). The vulnerability can lead to unauthorized database access and manipulation. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in unauthorized disclosure, modification, or deletion of database information, severely compromising the confidentiality, integrity, and availability of the affected system's data. Because no authentication is required, the attack surface is broad, increasing risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing application-layer protections such as web application firewalls (WAFs) to detect and block SQL injection attempts. Restricting database permissions and monitoring for suspicious activity may also help reduce risk.