Threat reportVulnerabilityTL-2026-3510
CVE-2026-108065: Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce
CVE-2026-108065 (TL-2026-3510) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-14. It has no confirmed attribution, affects Channel Software WebAlliance eCommerce, references 1 CVE (CVE-2026-108065), maps to 6 MITRE ATT&CK techniques (T1059, T1190, T1213), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-3510
- Threat ID
- TL-2026-3510
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- distribution, manufacturing, retail, technology
- Detection rules
- 9
- Indicators of compromise
- 6
Malware and tooling in CVE-2026-108065
Malware and tooling: Rapid7, curl
How CVE-2026-108065 works
The sUserID parameter of the GetUser method in the /preapproval.asmx SOAP web service of Channel Software WebAlliance eCommerce is not sanitized, allowing unauthenticated SQL injection (CWE-89) with stacked queries against Microsoft SQL Server. Rapid7 published a PoC; the vendor did not respond and no fixed version is reported.
Channel Software WebAlliance eCommerce is a B2B e-commerce and digital catalog platform used by distributors and manufacturers. Rapid7 security consultant Marcus Chang discovered the flaw on 2026-07-13 during a red team engagement (via Rapid7's Vector Command service) and disclosed it publicly on 2026-10-14 after the vendor failed to respond to contact attempts between 2026-08-28 and 2026-10-09.
The vulnerable component is the SOAP endpoint /preapproval.asmx. In the GetUser method, the sUserID parameter does not properly escape user-supplied input (the PoC curl example also references sCustID). An unauthenticated attacker closes the string literal with a single quote and, because the backend is Microsoft SQL Server, can append stacked queries using the pattern 90'; { MSSQL statement } ;-- inside the <tem:sUserID> element of a SOAP request.
Rapid7 demonstrates blind, time-based detection by issuing IF IS_SRVROLEMEMBER('sysadmin') = 1 WAITFOR DELAY '00:00:02';-- to test whether the application's database login holds the sysadmin role. Impact described in the disclosure: reading sensitive database content (PII, passwords); execution of system commands if the database user has administrative privileges; and upload of ASPX files via SQL Ole Automation if the database is collocated with the web server, which yields code execution as a web shell.
CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected versions are not specified in the disclosure and no fixed version has been reported. No in-the-wild exploitation and no network IOCs (IPs, domains, hashes) were reported. Rapid7's published mitigation is to block access to /preapproval.asmx. No BeaconBeagle lookup was applicable because no network IOCs exist.
MITRE ATT&CK techniques used in TL-2026-3510
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Collection
T1213 Data from Information Repositories
Persistence
Impact
T1565.001 Stored Data Manipulation
Reconnaissance
Affected products and versions in CVE-2026-108065
- Channel Software — WebAlliance eCommerce
Vulnerable versions: Not specified in disclosure
Remediation for CVE-2026-108065
Patches
- No fixed version reported; vendor did not respond to disclosure attempts
Immediate actions
- Block access to /preapproval.asmx (vendor-independent mitigation published by Rapid7), e.g. at the web server, reverse proxy or WAF
- Review IIS and WAF logs for requests to /preapproval.asmx containing single quotes, stacked-query syntax, WAITFOR DELAY, or Ole Automation procedure names
- Check the web root for unexpected .aspx files
Workarounds
- Block or restrict network access to /preapproval.asmx
Longer-term hardening
- Run the application database login with least privilege (not sysadmin)
- Keep Ole Automation Procedures and xp_cmdshell disabled in SQL Server
- Avoid collocating the database and web server
- Engage Channel Software for a fixed release
CVEs associated with CVE-2026-108065
Weaknesses (CWE) in CVE-2026-108065
Timeline of CVE-2026-108065
- Marcus Chang (Rapid7) discovers the SQL injection in WebAlliance eCommerce during a red team engagement via Rapid7's Vector Command service
- Rapid7 makes initial vendor disclosure contact with Channel Software
- Rapid7 sends first follow-up to the vendor; no response
- Rapid7 sends second follow-up to the vendor; no response
- Rapid7 sends third follow-up to the vendor; no response
- Rapid7 sends final notice of the 2026-10-14 public disclosure date; vendor still silent
- Rapid7 publishes the advisory and PoC for CVE-2026-108065; no fixed version or in-the-wild exploitation reported
Sources cited for CVE-2026-108065
- Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce (Rapid7)
- NVD - CVE-2026-108065
- CVSS v3.1 Calculator (FIRST)
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command
- MITRE ATT&CK T1190 Exploit Public-Facing Application
- OWASP SQL Injection
- Ole Automation Procedures server configuration option (Microsoft)
Detection coverage for TL-2026-3510
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3510 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.