Is CVE-2026-111389 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111389 being exploited in the wild.

How severe is CVE-2026-111389?

High severity, with a CVSS score of 7.7, published 16 October 2026.

Which products and versions are affected?

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, 16.x before 16.18.0.

Is there a fix for CVE-2026-111389?

Yes: fixed in HRMS 14.38.2, 15.64.0, 16.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111389 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111389?

Check whether you run Frappe HRMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111389: Frappe HRMS SQL injection in endpoint validation

CVE-2026-111389 · Severity: high · CVSS 7.7 · Published 2026-10-16

Frappe HRMS is a human resources management system built on the Frappe framework. A SQL injection vulnerability in several endpoints allows authenticated users, even with minimal privileges, to extract sensitive information from the database by sending specially crafted requests. This could lead to unauthorized access to employee records, payroll data, and other confidential HR information.

Vendors: Frappe.

Quick answers

Is CVE-2026-111389 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111389 being exploited in the wild.
How severe is CVE-2026-111389?: High severity, with a CVSS score of 7.7, published 16 October 2026.
Which products and versions are affected?: Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, 16.x before 16.18.0.
Is there a fix for CVE-2026-111389?: Yes: fixed in HRMS 14.38.2, 15.64.0, 16.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111389 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111389?: Check whether you run Frappe HRMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: HRMS 14.38.2, 15.64.0, 16.18.0

Technical details

The vulnerability is a SQL injection (CWE-89) caused by insufficient input validation on certain endpoints. It requires network access and valid authentication credentials, but does not require elevated privileges or user interaction. An authenticated attacker can craft malicious SQL payloads to extract sensitive data from the database; no modification or availability impact is present. Patches are available in versions 14.38.2, 15.64.0, and 16.18.0.

Affected products

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, 16.x before 16.18.0

Timeline

2026-10-01: disclosed
2026-10-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.