Trex MES: SQL injection allows command execution

Summary

Trex MES, a manufacturing execution system, contains an SQL injection vulnerability (CWE-89) that can be triggered over the network without authentication or user interaction. An attacker can read, modify or delete database data and, according to the CVE record, execute command lines on the affected system. The CVSS base score is 9.8 (critical). No fixed version and no vendor workaround are published yet, and the CVE record does not confirm active exploitation.

Affected

• Trex MES through 2026-09-29 (per CVE record; no version numbers published)
• Vendor and product as named in CVE-2026-18782; affected range defined by date only

Fixed in

Unknown.

Workaround

• No solution or workaround provided in the CVE record.
• Restrict network access to the MES web and API interfaces, allowing only VPN or management networks.
• Remove any direct internet exposure of the MES.
• Enforce network segmentation between ERP, MES and shop floor networks.
• Run the database account with least privilege.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC (ADP): exploitation none, automatable yes, technical impact total.
• No public exploit code has been confirmed at this time (secondary source, weak evidence).
• Related CVE-2026-18783 (missing authentication on REST API endpoint, CWE-306) is in the same CERT advisory; if both apply, credentials may not be needed.

Our recommendation

• Identify all Trex MES installations and check whether any are reachable from the internet.
• Immediately restrict access to the MES from untrusted networks and isolate it from the office network.
• Contact the vendor for a patch or advisory and check TR-26-1225 and the NVD entry for updates.
• Review web and database logs for anomalous queries.
• Verify whether CVE-2026-18783 also affects your installation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Hasanuyarrr/CVE-2026-18782-TREX-MES-Uygulamalarinda-SQL-Zafiyeti

Research sources

• CVE-2026-18782 record (opencve) app.opencve.io
• TR-CERT advisory TR-26-1225 siberguvenlik.gov.tr
• CVE-2026-18783 record (opencve) app.opencve.io
• Strix CVE-2026-18782 www.strix.ai
• TheHackerWire CVE-2026-18782 www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:51.