CVE-2026-114358: Critical SQLi in Radius Xenia M2M

CVE-2026-114358 concerns an SQL injection vulnerability in the password recovery functionality of Radius Xenia M2M Platform's web management interface. The issue stems from insufficient validation of user-supplied input. An unauthenticated remote attacker could send specially crafted SQL queries to the system without needing valid credentials.

According to NVD data, the vulnerability has a CVSS score of 9.3, classified as critical. Successful exploitation could allow unauthorized access to sensitive data, enumeration of the database structure, or modification of records. The flaw was published on October 29, 2026. No evidence is reported of exploit repositories or confirmed active exploitation. Social media discussion remains limited, with few posts and interactions in the last 24 hours, indicating early visibility without further technical details beyond NVD.

Organizations using M2M platforms with web management interfaces should check whether Radius Xenia is present in their technology stack, as the affected version is not reported in the available data. Pending an official fix, it is advisable to limit exposure of the management interface to trusted networks, monitor access logs for the password recovery function, and follow vendor advisories to apply the patch as soon as it becomes available.