# CVE-2026-5964: Digiwin EasyFlow .NET SQL injection

Source: https://junglewise.ai/threats/cve-2026-5964-digiwin-easyflow-net-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-20. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2026-5964 · Severity: critical · CVSS 9.8 · Published 2026-04-20

Digiwin EasyFlow .NET, an enterprise workflow management system, contains a critical security flaw. An unauthenticated attacker can remotely access the underlying database to view, change, or delete sensitive business information. This could lead to a total loss of data confidentiality and integrity, potentially disrupting business operations and exposing proprietary data.

## Quick answers

**Is CVE-2026-5964 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5964 being exploited in the wild.

**How severe is CVE-2026-5964?** Critical severity, with a CVSS score of 9.8, published 20 April 2026.

**Which products and versions are affected?** Digiwin EasyFlow .NET V6.1.x, V6.6.x, V8.1.1, V8.1.2.

**Is there a fix for CVE-2026-5964?** A patch was published on 2026-01-20: Patch released prior to public advisory Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5964 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5964?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability (CWE-89) exists in Digiwin EasyFlow .NET due to improper neutralization of special elements in SQL commands. The flaw allows a remote, unauthenticated attacker to send specially crafted requests to the application to execute arbitrary SQL queries. Successful exploitation grants the attacker full access to the database, enabling them to read, modify, or delete any stored data. The vulnerability affects versions V6.1.x, V6.6.x, V8.1.1, and V8.1.2. Users are advised to update to version 8.1.3 or later, or apply the patch released on 2026/01/20.

## Affected products

- Digiwin EasyFlow .NET V6.1.x, V6.6.x, V8.1.1, V8.1.2

## Timeline

- 2026-04-20: disclosed
- 2026-04-20: advisory
- 2026-01-20: patched: Patch released prior to public advisory

## References

- [https://www.twcert.org.tw/en/cp-139-10832-05f3a-2.html](https://www.twcert.org.tw/en/cp-139-10832-05f3a-2.html)
- [https://www.twcert.org.tw/tw/cp-132-10831-a734d-1.html](https://www.twcert.org.tw/tw/cp-132-10831-a734d-1.html)