The vulnerability CVE-2026-7188 affects Armiya Information Technologies Ltd. Co. Access Control System prior to version 2. It is caused by improper neutralization of special elements used in SQL commands, leading to SQL injection (CWE-89). This allows an unauthenticated attacker to execute arbitrary SQL commands remotely, potentially compromising the database confidentiality, integrity, and availability. The CVSS v3.1 base score is 9.8, with attack vector network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, leading to full compromise of the database contents, unauthorized data disclosure, data modification, or denial of service. The vulnerability is remotely exploitable without authentication and requires no user interaction, making it highly severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any recommended temporary mitigations from the vendor or restrict network access to the affected system to trusted sources only.