CVE-2026-89196

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.

• CWE-89

• https://cert-portal.siemens.com/productcert/html/ssa-508506.html

Published

Oct 13, 2026

Last Modified

Oct 15, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89186Use of Cache Containing Sensitive Information in ZenHive mpp…6.3
• CVE-2026-8919Permissive Cross-domain Security Policy with Untrusted Domai…7.2
• CVE-2026-89190The Robin Image Optimizer WordPress plugin before 2.0.8 doe…4.3
• CVE-2026-89191Unsanitised input in the "template name" field of SQLView KR…6.8
• CVE-2026-89193The Robin Image Optimizer WordPress plugin before 2.0.8 doe…7.5
• CVE-2026-89195The Site Setup Wizard WordPress plugin through 1.5.8 does no…8.6
• CVE-2026-89197A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
• CVE-2026-89198A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
• CVE-2026-89199A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
• CVE-2026-8920Improper Restriction of Communication Channel to Intended En…8.5
• CVE-2026-89200A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…6.7
• CVE-2026-89201A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…7.5