A CVSS 9.8 SQL injection vulnerability in UMAI Vision's Traffic Analysis System lets unauthenticated attackers reach the backend database over the network with no user interaction required.
What Is It
CVE-2026-4978 is an improper neutralization of special elements used in an SQL command, classic SQL injection, tracked as CWE-89, in the UMAI Vision Traffic Analysis System. It was published on 2026-07-30 and reported through USOM, Turkey's national cyber incident response center.
The CVSS v3.1 base score is 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That breaks down to network-reachable, low attack complexity, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability alike.
Why It Matters
Everything an attacker needs is already in the vulnerability itself. No credentials, no phishing step, no local foothold; just network access to the affected system. The impact scores are maxed across the board, meaning a successful injection can read, alter, and disrupt the data the system holds.
CISA's SSVC assessment flags the issue as automatable: yes with technical impact: total. Automatable means an attacker can reliably script the reconnaissance and exploitation steps across many targets, which is exactly the profile that turns a single disclosure into opportunistic mass scanning.
There is no CISA KEV entry for CVE-2026-4978, and the SSVC record lists exploitation as none: no confirmed in-the-wild activity as of this writing. That is a snapshot, not a guarantee, and the automatable rating makes it a poor thing to bet on.
What's Vulnerable
UMAI Vision Traffic Analysis System. The vendor advisory data lists affected versions as 29 up to but not including 34, while the CVE description states the issue affects versions from 30 before 34. Versions 34 and later are not listed as affected. Note the discrepancy between the two ranges; operators running version 29 should treat themselves as in scope until the vendor clarifies. No CPE entries have been assigned yet.
The NVD record currently carries a vulnerability status of Deferred.
Patch Status
Both affected-version ranges stop short of version 34, which implies a fix landed in that release, but the source material does not explicitly confirm version 34 as a published patch, and operators should verify availability with the vendor before planning around it. No specific required action or remediation deadline is published in the supplied source material beyond upgrading past the affected range. Consult the USOM advisory below for vendor guidance.
Sources
- NVD, CVE-2026-4978: https://nvd.nist.gov/vuln/detail/CVE-2026-4978
- USOM / siberguvenlik.gov.tr advisory TR-26-0703: https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0703
- CISA Known Exploited Vulnerabilities Catalog (searched for CVE-2026-4978; no entry): https://www.cisa.gov/known-exploited-vulnerabilities-catalog