MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24
view advisory published 2026-03-23
Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow unauthenticated RCE or SQLi.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32969US | — | — | ||
An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of speci… | ||||
| CVE-2026-32968US | — | — | ||
Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resu… | ||||
02
references
External citations — patches, advisories, analysis.
- Security Incident Management SIM#2026-02 - PDFself
- VDE-2026-024: MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24 - HTMLself
- CERT@VDE Security Advisories for MB connect lineexternal
- Product security incident reportsexternal
- VDE-2026-024: MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24 - CSAFself
03
remediations (2)
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.19.4.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.19.4.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan