CVE-2026-9209 mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx
Unauthenticated attackers can execute arbitrary SQL commands via exposed Login.aspx endpoints, leading to remote code execution with LocalSystem privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9209?
CVE-2026-9209 is a critical SQL injection vulnerability in mJobTime, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.
Which versions are affected by CVE-2026-9209?
How do I fix CVE-2026-9209?
No fix has been published for CVE-2026-9209 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-9209 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9209 exists.
Sources
Also known as GHSA-fw9h-fgmp-7fx3.