This vulnerability (CVE-2026-66593) is an unauthenticated SQL injection (CWE-89) in the Security & Malware scan by CleanTalk product, affecting versions up to and including 2.184. The flaw allows attackers to inject malicious SQL commands without any authentication, resulting in a high confidentiality impact and some availability impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

The vulnerability allows unauthenticated attackers to execute SQL injection attacks, potentially exposing sensitive data (high confidentiality impact) and causing limited disruption to availability. There is no reported impact on data integrity. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected application and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable component to untrusted networks if possible.