Key points
- YS-infoware BA-Workflow versions before 3.6.2.7 contain a high-severity SQL injection flaw.
- The vulnerability allows authenticated remote attackers to read, modify, or delete database data.
- National Vulnerability Database records the issue as CVE-2026-113407 with a CVSS score of 8.7.
YS-infoware BA-Workflow instances running versions older than 3.6.2.7 are exposed to a significant data manipulation risk. The National Vulnerability Database has cataloged this issue as CVE-2026-113407, identifying a SQL injection weakness that compromises database integrity. This finding requires immediate attention from teams managing these workflow automation environments.
The flaw enables authenticated remote attackers to inject arbitrary SQL statements directly into the application. According to the NVD record, this capability allows adversaries to read sensitive information, modify existing records, or delete database contents entirely. The vulnerability is classified as high severity with a CVSS score of 8.7, reflecting its significant potential for data loss and corruption.
Technical context
The underlying weakness is mapped to CWE-89, which denotes SQL injection vulnerabilities. This category of flaws occurs when user-supplied input is not properly sanitized before being included in database queries. In this specific case, the failure to validate input within BA-Workflow allows malicious SQL commands to execute with the privileges of the authenticated user, bypassing intended application logic.
Affected environments
Only installations of YS-infoware BA-Workflow running versions prior to 3.6.2.7 are affected by this vulnerability. Organizations using newer updates are not subject to this specific risk. Teams must verify their current deployment version to determine if their infrastructure falls within the vulnerable range defined by the vendor and security databases.
Next steps
Administrators should audit their inventory to identify any BA-Workflow instances running versions before 3.6.2.7. If vulnerable versions are present, prioritize upgrading to the fixed release as soon as possible. Until an update is applied, restrict access to the application to trusted networks and monitor for unusual database activity that may indicate exploitation attempts.
Signals worth monitoring
Security teams should review database audit logs for unexpected query patterns or high volumes of data retrieval. Look for authentication events followed immediately by complex or malformed SQL syntax in application logs. Check for unusual changes to user permissions or mass deletions of records. Verify that database integrity checks run regularly and alert on schema modifications. Isolate compromised accounts immediately upon detection of suspicious queries.
What to do and how to stay safe: YS-infoware
- Inventory all BA-Workflow installations to confirm which versions are currently deployed across your network.
- Restrict network access to the application server to limit exposure to untrusted external sources.
- Enable detailed logging on the database server to capture and analyze incoming query structures.
- Monitor for unauthorized changes to critical data tables or user account privileges.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific version of BA-Workflow fixes the SQL injection vulnerability?
Versions 3.6.2.7 and later are not affected by CVE-2026-113407 according to the NVD record.
Is authentication required to exploit this vulnerability?
Yes, the NVD description states that authenticated remote attackers can inject arbitrary SQL statements.
What is the CVSS score for CVE-2026-113407?
The National Vulnerability Database assigns a CVSS score of 8.7, rating it as high severity.
