# CVE-2026-89180: Thinking Software Technology EFence SQL injection

Source: https://junglewise.ai/threats/cve-2026-89180-thinking-software-technology-efence-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89180 · Severity: high · CVSS 7.5 · Published 2026-09-14

EFence is a database security product developed by Thinking Software Technology. It contains a SQL injection vulnerability that allows unauthenticated attackers on the network to inject malicious SQL commands and read sensitive data stored in the database, potentially exposing confidential business information.

Technologies: [Thinking Software Technology EFence](https://junglewise.ai/threats/technologies/efence). Vendors: [Thinking Software Technology](https://junglewise.ai/threats/vendors/thinking-software-technology).

## Quick answers

**Is CVE-2026-89180 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89180 being exploited in the wild.

**How severe is CVE-2026-89180?** High severity, with a CVSS score of 7.5, published 14 September 2026.

**Which products and versions are affected?** Thinking Software Technology EFence 1.2.65 DB Ver:55 and earlier.

**Is there a fix for CVE-2026-89180?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89180 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-89180?** Check whether you run Thinking Software Technology EFence at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

EFence versions 1.2.65 DB Ver:55 and earlier contain a SQL injection vulnerability in an unauthenticated network-accessible component. The vulnerability allows remote attackers without credentials to inject arbitrary SQL commands to read database contents. No authentication is required and the attack is network-reachable with low complexity. The vulnerability impacts confidentiality by enabling unauthorized data access. A fix is available in version 1.2.67 DB Ver:57 and later.

## Affected products

- Thinking Software Technology EFence 1.2.65 DB Ver:55 and earlier

## Timeline

- 2026-09-14: disclosed

## References

- [https://www.twcert.org.tw/en/cp-139-11203-26db2-2.html](https://www.twcert.org.tw/en/cp-139-11203-26db2-2.html)
- [https://www.twcert.org.tw/tw/cp-132-11202-48c1b-1.html](https://www.twcert.org.tw/tw/cp-132-11202-48c1b-1.html)

## Related threats

- [Thinking Software Technology EFence arbitrary file upload](https://junglewise.ai/threats/cve-2026-80237-thinking-software-technology-efence-arbitrary-file-upload)
- [Thinking Software Technology EFence SQL injection](https://junglewise.ai/threats/cve-2026-80236-thinking-software-technology-efence-sql-injection)
- [Thinking Software Technology EFence arbitrary file upload](https://junglewise.ai/threats/cve-2026-80235-thinking-software-technology-efence-arbitrary-file-upload)