Description
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection.

This issue affects enVision: before 260655.
Published: 2026-09-28
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: SQL Injection
Action: Immediate Patch
AI Analysis

Impact

Improper neutralization of special elements used in an SQL command creates a SQL injection flaw in Iron Mountain Archiving Services Inc.'s enVision. The flaw allows an attacker to inject arbitrary SQL statements, potentially compromising the confidentiality, integrity, or availability of the underlying database. The specific weakness is a classic SQL injection (CWE‑89).

Affected Systems

Iron Mountain Archiving Services Inc. offers the enVision archiving platform. Versions of enVision prior to build 260655 are affected and therefore require attention.

Risk and Exploitability

The CVSS score of 8.8 indicates high risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. While the exact attack vector is not detailed in the report, it is inferred that the vulnerability can be exercised via web inputs that are incorporated into SQL statements without proper sanitization. An attacker with access to the application interface could potentially execute arbitrary SQL commands against the backend database.

Generated by OpenCVE AI on September 28, 2026 at 15:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch that updates enVision to build 260655 or later.
  • If no patch is immediately available, limit the privileges of the database user used by enVision to the minimum required for normal operation, such as read‑only access for services that do not need to modify data.
  • Perform a thorough code review or run automated security scans to detect and remediate any remaining unsanitized user inputs in the application.

Generated by OpenCVE AI on September 28, 2026 at 15:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 28 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This issue affects enVision: before 260655.
Title SQLi in Iron Mountain's enVision
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-09-28T17:56:57.707Z

Reserved: 2026-09-08T08:02:38.216Z

Link: CVE-2026-86595

cve-icon Vulnrichment

Updated: 2026-09-28T17:56:50.473Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T14:17:21.030

Modified: 2026-09-28T18:17:25.817

Link: CVE-2026-86595

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T15:45:02Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')