External risk intelligence

MCMS SQL Injection in PageAction Verify Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-88414

The vulnerability exists in a web application endpoint (a .do action) intended for page verification. Such web-based application endpoints in content management systems are commonly deployed as internet-facing services to facilitate public web traffic and site interaction.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

MCMS software, specifically versions 6.1.1 through 6.2.1, has a critical vulnerability that could allow unauthorized access and modification of data if exploited. The issue is located in a page verification function that is accessible via the web.

Software has a critical flaw.
Protects against unauthorized data access.
Confirm relevance to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could target an unauthenticated user by sending a crafted request to the PageAction.verify endpoint. This endpoint, found in MCMS, is susceptible to SQL injection due to improper handling of input. Successful exploitation could allow an attacker to manipulate the database, potentially leading to unauthorized access, data modification, or denial of service.

No authentication or specific user privileges needed.
Triggered via a GET request to a specific endpoint.
Risk of unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in a page verification endpoint could allow an attacker to manipulate database queries. This may lead to unauthorized access to, modification of, or deletion of sensitive information stored within the system's database.

Database information.
Malicious SQL queries sent over the network.
Unauthorized access or data manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the SQL injection vulnerability in the MCMS PageAction.verify endpoint, application owners and platform teams are likely responsible for remediation. The immediate first step is to identify all instances of the affected MCMS versions, determine their exposure and business criticality, and confirm ownership before planning coordinated action.

Application and platform teams own remediation.
Verify MCMS deployment and exposure.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MCMS?

MCMS is a content management system used by organizations to build, publish, and manage digital web content. It functions as a backend platform that stores information in a database and serves it to users. Versions 6.1.1 through 6.2.1 are the specific releases identified in this advisory as having a security weakness in how they process page verification requests.

What does SQL injection mean in CVE-2026-88414?

This vulnerability is classified as CWE-89, which stands for Improper Neutralization of Special Elements used in an SQL Command. Simply put, the software fails to properly filter or sanitize the data it receives from a user. This allows an attacker to insert their own malicious database commands into the request, tricking the application into running unauthorized queries that could expose, modify, or delete data.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted GET request to the 'PageAction.verify' endpoint on a vulnerable MCMS server. Because the vulnerability exists in this specific verification function, it requires the application to be active and processing web traffic. Requests that do not interact with this exact 'verify.do' path do not trigger this specific SQL injection path.

Is my system at risk?

According to Halo Surface Signal, this vulnerability resides in a web application endpoint commonly exposed to the internet to support public site functionality. If your instance of MCMS is internet-facing, it is more accessible to external actors. You should evaluate whether your deployment is reachable from outside your internal network to determine your level of exposure.

What should I do first to address this?

Your first step is to conduct an inventory to locate every instance of MCMS 6.1.1 through 6.2.1 running in your environment. Once you have identified these systems, assess their specific network visibility and the sensitivity of the data they manage. Use this information to prioritize which instances require immediate attention or containment while you plan for the necessary software updates.

References

github.com/15536818056/CVE/issues/1

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.