PT-2026-3888 · Aes · Aes

Published 2026-01-22 · Updated 2026-02-26 · CVE-2025-27378

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AES (affected versions not specified)

Description AES contains a SQL injection issue because of an inactive configuration that bypasses the latest SQL parsing logic. Without this configuration enabled, specially crafted input can be mishandled, potentially allowing attackers to inject and execute arbitrary SQL queries. The issue arises when the

sql.parsing

configuration is not active. Exploitation involves submitting crafted input to the system, which, due to the bypassed parsing logic, is interpreted as SQL code and executed.

Recommendations Activate the latest SQL parsing logic in the configuration to prevent crafted input from being mishandled and exploited by attackers. As a temporary workaround, consider restricting or disabling input parameters that are directly used in SQL queries until the configuration is updated.

Fix

SQL injection

RCE

Weakness Enumeration

CWE-89

CWE-20

Related Identifiers

CVE-2025-27378

Affected Products

Aes

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-27378 · Security Note
• https://altium.com/platform/security-compliance/security-advisories · Vendor Advisory
• https://t.me/CVEtracker/42712 · Telegram Post
• https://twitter.com/lsof/status/2014166738523304156 · Twitter Post
• https://t.me/cveNotify/153370 · Telegram Post
• https://twitter.com/cracbot/status/2016103966824960019 · Twitter Post
• https://twitter.com/TheHackerWire/status/2014147132757008794 · Twitter Post
• https://t.me/cveNotify/149499 · Telegram Post
• https://twitter.com/CVEnew/status/2014153669701444072 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014164069071155296 · Twitter Post
• https://twitter.com/CveFindCom/status/2014150848104866003 · Twitter Post