Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-94492: Yonyou U8cloud 5.x permits remote data access

CVE-2026-94492 · published 27 days ago

Summary

The OpenAPI component in Yonyou U8cloud version 5.x can be tricked into running unintended database commands when a specially crafted request is sent. This could let an attacker read, change, or delete data from the system without being on the internal network. Apply the vendor’s security update or restrict access to the OpenAPI endpoint until a fix is installed.

Original advisory text

A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-74Injection

CWE-89SQL Injection

Timeline

Published22 Sep 2026

Updated19 Oct 2026

First seen22 Sep 2026

Sources

CVE-2026-94492 · NVD

Track software like this

Free during beta