CVE-2026-65547 is a SQL Injection vulnerability (CWE-89) in Constant Contact Creative Mail affecting versions up to 1.6.9. The vulnerability arises from improper neutralization of special elements used in SQL commands related to subscriber data, allowing an attacker with low privileges and no user interaction to execute unauthorized SQL queries. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation level has been published yet.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to execute unauthorized SQL commands, potentially leading to disclosure of sensitive subscriber information and partial disruption of service. The impact affects confidentiality (high) and availability (low), with no impact on data integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the affected application, applying web application firewalls with SQL injection protections, and monitoring for suspicious database activity related to subscriber queries.