External risk intelligence

Crocus SQL Injection Vulnerability Allows Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-52469

The vulnerability is a SQL injection in a specific application component (DeviceInfoMapper.xml). While the attack vector is network-based, the description does not clarify if the product is typically deployed as a public-facing web interface or an internal service, making public internet exposure plausible but not definitively common for this specific component.

SQL Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the Crocus application, specifically related to how it handles device information. This flaw could potentially allow unauthorized individuals to gain elevated access to systems. The main concern at this time is to determine if our organization uses the affected technology and, if so, to what extent.

Flaw allows unauthorized system access.
Critical flaw impacting potentially widespread systems.
Confirm relevance and exposure for this product.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to the DeviceInfoMapper.xml file. This could allow them to execute arbitrary SQL commands on the system, potentially leading to unauthorized access and modification of sensitive information.

No authentication required.
Attacker sends malicious data to a file.
Leads to privilege escalation and data compromise.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in Crocus could allow a remote attacker to escalate privileges when interacting with the DeviceInfoMapper.xml file. This could potentially affect the confidentiality, integrity, and availability of the underlying database.

Database access and integrity.
Via a crafted DeviceInfoMapper.xml file.
Unauthorized access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Crocus requires immediate attention to identify and secure affected systems. Application owners, in coordination with infrastructure and security teams, should prioritize locating all instances of the affected software. Confirming reachability and business criticality will inform risk-based remediation planning, potentially involving vendor engagement for patches or implementing temporary compensating controls.

Application owners and infrastructure teams own remediation.
Verify system reachability and business criticality first.
Plan remediation based on risk and potential vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Crocus?

Crocus is a software application designed for managing and mapping device information. It uses components like DeviceInfoMapper.xml to organize how the system interacts with and stores data about connected devices.

What does SQL injection mean for CVE-2026-52469?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In the context of CVE-2026-52469, it means the application does not properly sanitize input, allowing an attacker to inject their own database commands. This can bypass standard security controls, letting them modify data or escalate their privileges to gain unauthorized control over the system.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted data directly to the DeviceInfoMapper.xml file. The vulnerability does not require the attacker to have an existing account or credentials to interact with the application. Simply sending the malicious request is sufficient to execute the unauthorized commands.

Is my system at risk if I run Crocus?

Halo Surface Signal notes that while this is a network-based vulnerability, it is not definitively clear if Crocus is typically deployed as a public-facing interface or an internal service. Because the application processes data via the network, your risk depends on whether the affected component is reachable from the internet or restricted to your internal network environment.

How do I respond to this threat?

Your first step is to identify every instance of the Crocus software within your environment. Work with your infrastructure and application teams to determine which instances are accessible over the network. Once located, evaluate the business criticality of those systems to prioritize your efforts and reach out to the software vendor for available patches or guidance on implementing temporary security controls.

References

github.com/Y4y17/CVE/blob/main/Crocus/SQL%20Injection-1.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.