Futurum Software User Authentication Module: Blind SQL injection before authentication
Summary
The user authentication module of Futurum Software, a cloud-based business management platform for multi-level marketing businesses, contains a blind SQL injection flaw (CVE-2026-14571, CVSS v4.0 9.1). Input is not sufficiently validated in queries to the private area's database, and a faulty WAF configuration allows the protection to be bypassed with crafted HTTP requests. An unauthenticated remote attacker could run arbitrary database queries, extract the database structure and access sensitive customer data, including personally identifiable information.
Affected
- Futurum Software User Authentication Module, versions before May 2026 (according to the CVE record; exact build numbers unknown)
Fixed in
- The vendor has fixed the vulnerability in the user authentication module. Exact fixed version: Unknown.
Workaround
- Unknown. Do not rely on the WAF as a mitigation, as it can be bypassed.
Exploitation
- INCIBE lists exploitation as not known.
- No public proof of concept was found in the limited research.
- EPSS: 0.25% (percentile 17).
Our recommendation
- If your organisation uses Futurum Software, ask the vendor to confirm that the fix applies to your tenant and to state the affected period.
- Ask whether any customer data was accessed and review which personal data the platform stored.
- Assess with legal advice whether a reportable data breach under the revised Swiss FADP has occurred.
- If you do not use this product, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT notice INCIBE-2026-802 www.incibe.es
- VulDB CVE-2026-14571 vuldb.com
- OffSeq radar CVE-2026-14571 radar.offseq.com
- CVE database entry (threatint) cve.threatint.com
- Strix AI CVE-2026-14571 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:16.
Original description (NVD)
A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms to be bypassed solely by sending manipulated HTTP requests. Successful exploitation of the vulnerability could allow an unauthenticated attacker to execute arbitrary queries against the database, extract its complete structure and gain access to sensitive customer information, including personally identifiable information (PII).
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.