External risk intelligence

ERP System API SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-107103

The vulnerability affects an API endpoint within an ERP system. ERP systems frequently expose API endpoints for integration and remote access, making them common targets for internet-facing service exposure.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in an enterprise resource planning (ERP) system's API endpoint allows unauthenticated remote attackers to execute SQL injection attacks by sending specially crafted input. This could potentially lead to unauthorized access or manipulation of sensitive data within the ERP system.

Affects ERP systems via API endpoint vulnerabilities.
Matters for protecting sensitive business data integrity.
Confirm relevance and assess potential system exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target an ERP system by sending malicious input to an exposed API endpoint. This endpoint lacks proper validation, allowing specially crafted data to be processed. Successful exploitation could enable an attacker to execute SQL injection attacks against the system.

Unauthenticated network access required.
Crafted input to API endpoint triggers vulnerability.
Risk of SQL injection attacks.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to a vulnerable API endpoint in the ERP system, potentially leading to SQL injection attacks when supported by the advisory.

ERP system data could be affected.
Specially crafted input could be supplied.
Unauthorized data access or manipulation may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in an ERP system's API endpoint, allowing for SQL injection, likely falls under the responsibility of the application owners and infrastructure teams. The first practical step is to identify all instances of the affected ERP system, determine their reachability from the internet or other untrusted networks, and confirm which are business-critical. Once these instances are cataloged, the accountable owner should be engaged to prioritize and plan remediation efforts based on the assessed risk and potential operational impact.

Application and infrastructure teams own the issue.
Verify external exposure and business criticality first.
Plan remediation based on identified exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ERP system affected by CVE-2026-107103?

This software is an Enterprise Resource Planning system, which acts as a central hub for managing core business processes like finance, human resources, and supply chain operations. Because these systems consolidate sensitive organizational data and often include API components for integrating with other business tools, they are essential for day-to-day operations and require high levels of protection against unauthorized access.

What is SQL injection in the context of this CVE?

CVE-2026-107103 involves a weakness known as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, the ERP system fails to properly check or clean data provided by users before including it in database queries. This allows an attacker to inject their own database commands, potentially letting them view, change, or delete sensitive information stored within the system.

How does an attacker trigger this vulnerability?

An attacker triggers the vulnerability by sending specially crafted input directly to a vulnerable API endpoint within the ERP software. This process does not require the attacker to have an existing account or password, as the flaw resides in how the system processes unauthenticated requests. It is important to note that sending standard, legitimate requests to the API will not trigger this issue; the input must be specifically designed to manipulate the underlying SQL query.

Why should I worry about my ERP system's exposure?

According to the Halo Surface Signal, this vulnerability is particularly relevant because ERP systems frequently expose API endpoints to enable remote access and integration, increasing the likelihood that they are reachable from the internet. If your system is internet-facing, it is more accessible to remote attackers. You should prioritize verifying whether these specific API endpoints are reachable from outside your trusted network perimeter.

What are the first steps to address this CVE?

Start by identifying all instances of the ERP system running in your environment. Catalog which instances are critical to business operations and assess their network reachability, specifically checking if the affected API endpoints are exposed to the internet or untrusted networks. Once you have a clear picture of your environment, engage the appropriate application or infrastructure owners to plan and prioritize remediation efforts based on that risk assessment.

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.