CVE-2026-5490

The CVE describes SQL injection requiring authentication, and the CVSS 8.8 will cause some teams to treat this as moderate severity. Don't make that mistake. The authentication requirement is a red herring that masks the real problem: this is SQL injection in an enterprise endpoint security product in 2026, when parameterized queries and static analysis have been standard for two decades. The presence of this vulnerability at all indicates a fundamental process failure in DriveLock's development pipeline—not a one-time mistake, but a failure to implement the most basic safeguards against a well-understood class of flaw. The privilege escalation vector compounds the risk significantly. An attacker with any valid DriveLock account can use this SQL injection to escalate to administrator, bypassing the application's permission model entirely. But here's what the CVE description doesn't tell you: DriveLock admin access is often a proxy for enterprise-wide access. These products run with high-privilege service accounts to function—they authenticate to Active Directory, enumerate local admin memberships, interface with backup and patch management systems. If DriveLock's service account has domain-tier permissions—which is common—then escalating from authenticated DriveLock user to DriveLock admin is one hop on a longer path to lateral movement across your infrastructure. The EPSS score of 0.00481 should not reassure you. EPSS models opportunistic attacker behavior against internet-facing assets; it doesn't account for targeted attacks against enterprise tooling where credentials are already compromised. An attacker who hasphished a DriveLock admin account, or harvested it from a compromised endpoint, isn't scanning— they're using this SQL injection as a pivot tool. The disclosure through ZDI also means DriveLock didn't find this internally; you should assume other similar flaws remain undiscovered in their codebase. Prioritize these actions: First, audit what permissions DriveLock's service account holds in Active Directory and across critical systems—that's your real blast radius. Second, treat the admin credentials as already compromised and rotate them immediately post-patch. Third, verify that static analysis tooling is actually scanning your DriveLock deployments for similar patterns. Fourth, assume this is one of multiple vulnerabilities and treat DriveLock as higher-risk than the CVSS suggests until you've completed the service account audit. The patch is necessary but insufficient; the organizational failures that allowed this flaw to ship require your own internal review of what else might be living in that codebase.

Reviewed through automated stages and approved by a human before publication.