CVE-2026-19680

The EPSS score of 0.00311 for this SQL injection in Genetec Security Center is giving you false comfort if you're using it to deprioritize. Physical security platforms deploy in constrained network environments — behind VPNs, air gaps, or limited DMZs — and the EPSS model has internalized that exposure pattern. The low score reflects where these systems typically live, not how dangerous the vulnerability is if you actually encounter it. Treat this as a high-severity issue regardless of the exploitation probability model. A SQL injection in a physical security platform isn't a data disclosure problem — it's a pivot point. The database contains badge reader configurations, alarm schedules, credential stores, and often the door unlock commands themselves. An attacker who exploits this doesn't stop at database access; they get the blueprint for every physical control in your facility. This is precisely the class of vulnerability that scoring models systematically underweight because exploitation frequency doesn't capture targeting by state actors, corporate espionage operators, or physical red teams who specifically go after these systems. More concerning than the CVE itself: this patch only addresses the code Genetec ships. Security Center integrates with video management systems, HVAC controls, badge readers, and organizational identity providers — typically through custom connectors written once by systems integrators and then never touched again. Those integration scripts often bypass the patched web interface entirely and query the database directly with unsanitized construction. After applying this patch, you need to audit what else still connects to that database layer. Finally, understand your remediation timeline. Physical security platforms run on hardware controllers with change windows that production software doesn't require. The gap between patch availability and actual deployment is structurally longer than for web applications — meaning the effective exploitation window extends well past what standard patching cadences assume. If this system sits on the same network segment as the physical security infrastructure it monitors, you've already lost what network segmentation was supposed to protect.

Reviewed through automated stages and approved by a human before publication.