CVE-2026-34185 SQL Injection in AlanWeb SCADA
An authenticated attacker can inject arbitrary SQL commands into AlanWeb SCADA, potentially gaining full control over the database.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34185?
CVE-2026-34185 is a high-severity SQL injection vulnerability in Control System AlanWeb SCADA, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database.
This issue was fixed in AlanWeb SCADA version 9.8.5
Weakness: CWE-89
Which versions are affected by CVE-2026-34185?
It affects 1 product.
Products include Hydrosystem.poznan Control System.
How do I fix CVE-2026-34185?
No fix has been published for CVE-2026-34185 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-34185 being exploited?
There is no known exploitation of CVE-2026-34185 in the wild and no public exploit code.
Other vulnerabilities in Control System AlanWeb SCADA
Sources
Also known as GHSA-p6w4-7rrj-xwqx.