This vulnerability arises from an improper neutralization of special elements used within SQL commands in Delinea Cloud Suite, allowing argument injection that can lead to unauthorized data access or modification. The weakness maps to CWE‑89, a flaw in input validation that enables attackers to craft malicious SQL statements. Such an injection could expose sensitive information or corrupt stored data.

Affected are all instances of Delinea Cloud Suite running versions prior to 25.2 HF1. This includes any deployment of the Cloud Suite that has not been upgraded to the 25.2 HF1 release or later. No other vendors or product lines are listed as impacted.

The CVSS score of 9.3 identifies the flaw as critical, and although the EPSS score is less than 1%, indicating low exploitation probability, the vulnerability remains a high‑risk target for attackers seeking data exposure. The likely attack vector is through web or API interfaces that accept unsanitized user input used in database queries. The absence from CISA’s KEV catalog does not reduce the potential impact for exposed systems.