CVE-2026-93484: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-93484 is a SQL injection vulnerability in Znuny, an open-source IT service management and ticketing system, affecting versions through 7.3.6 (7.x branch) and below 6.5.25 (6.x branch). The flaw arises from direct concatenation of user-supplied input into SQL queries within the ticket search functionality, enabling attackers to inject arbitrary SQL commands. It was published on October 15, 2026, with a patch available in the same timeframe. The vulnerability carries a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Znuny Advisories).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically in two Perl modules: Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB. The vulnerable ContentSearch parameter is expected to accept only the values "AND" or "OR", but its value is concatenated directly into the generated SQL query without any validation or use of parameterized queries. An authenticated attacker (low privileges required) can supply a crafted ContentSearch value via a network request to manipulate the underlying SQL statement, with no user interaction required and low attack complexity (GitHub Advisory, Znuny Advisories).

Successful exploitation allows an attacker to steal sensitive data from the ticket database (high confidentiality impact), modify or delete existing ticket records (high integrity impact), or potentially cause denial of service through resource-intensive injected queries. The vulnerability also carries a low secondary system impact on confidentiality and integrity, suggesting limited potential for lateral movement to adjacent systems. Given that Znuny is a helpdesk/ITSM platform, exposed data may include sensitive customer communications, internal IT records, and personally identifiable information (GitHub Advisory, Znuny Advisories).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the attack is rated as automatable (AU:Y in CVSS v4), meaning it could be scripted for mass exploitation if a PoC becomes public (Znuny Advisories).

1. Reconnaissance: Identify internet-facing Znuny instances running versions below 7.3.7 (7.x branch) or below 6.5.25 (6.x branch) using tools like Shodan or Censys, searching for Znuny login pages or HTTP response headers.
2. Authentication: Obtain low-privilege credentials to the Znuny instance (e.g., via a standard agent or customer account, which may be available through self-registration depending on configuration).
3. Locate the vulnerable endpoint: Navigate to the ticket search functionality, which internally invokes Kernel::System::Ticket::TicketSearch or Kernel::System::Ticket::ArticleSearchIndex::DB.
4. Inject malicious payload: Craft an HTTP request to the ticket search endpoint, supplying a malicious value for the ContentSearch parameter (e.g., AND 1=1 UNION SELECT ...) instead of the expected AND or OR value.
5. Extract or manipulate data: Use standard SQL injection techniques (UNION-based, error-based, or blind) to enumerate database tables, extract sensitive ticket data, modify records, or execute resource-intensive queries to cause denial of service (GitHub Advisory, Znuny Advisories).

• Network: Unusual or malformed HTTP requests to Znuny ticket search endpoints containing SQL keywords (e.g., UNION, SELECT, INSERT, DROP, --, 1=1) in the ContentSearch parameter; unexpected outbound database connections from the Znuny server.
• Logs: Znuny application logs or web server access logs showing repeated ticket search requests with anomalous ContentSearch values; database error messages logged due to malformed SQL queries.
• Database: Unexpected queries in the database slow query log or audit log originating from the Znuny application user; unauthorized changes to ticket records or new database objects created by the application account.
• Process: Unusual database activity such as large data exports or high CPU usage on the database server correlated with Znuny search requests.

Znuny has released patched versions addressing this vulnerability: upgrade to 7.3.7 or later for 7.x installations, or to 6.5.25 or later for 6.x installations. As a short-term workaround, implement input validation to strictly enforce that the ContentSearch parameter only accepts "AND" or "OR" values. Additionally, deploying a Web Application Firewall (WAF) with SQL injection detection rules can help block exploitation attempts until patching is complete (Znuny Advisories, GitHub Advisory).