CVE-2026-7188

CVE-2026-7188 is a critical SQL injection flaw (CWE-89) in Armiya Information Technologies' Access Control System, caused by improper neutralization of special elements in SQL commands. Because the flaw is exploitable over the network with no privileges or user interaction required (per the CVSS 3.1 vector), an unauthenticated attacker can send crafted input to reach the backend database. Successful exploitation could allow reading or modifying sensitive stored data, such as access credentials, cardholder records, or entry logs, and potentially bypassing authentication in the access control workflow. Any deployment running Access Control System versions prior to Version 2 (Versiyon 2) is affected. There are currently no known public proofs of concept, no reports of in-the-wild exploitation, and the vulnerability is not listed in CISA's KEV catalog.

What to do: Upgrade Access Control System to Version 2 (Versiyon 2) or later. Until patched, restrict network access to the system (especially avoid internet exposure), and review database and application logs for signs of unusual or injected SQL queries.