CVE-2026-8402: SQLi in Exagate's SYSGUARD 6001

Synopsis

A blind SQL injection vulnerability affects Eksagate SYSGUARD 6001 versions from 2.0.2 up to but not including 6.1.16.0. The flaw is reachable over the network with no authentication required, meaning any attacker who can reach the service can send crafted input to manipulate the underlying database queries without triggering visible error responses. Successful exploitation gives an attacker the ability to read, modify, and destroy data in the database, and to disrupt availability of the service. A patched-image rebuild at version 6.1.16.0 is available on HarborGuard for affected environments, though customers should note the vendor has indicated the product is no longer actively supported.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the SYSGUARD 6001 service over the network, as the vulnerability is exposed via a network-accessible interface (AV:N).

• AuthenticationNot required

  No account or credentials of any kind are needed to send malicious SQL payloads to the vulnerable endpoint (PR:N).

• Victim interactionNot required

  The attacker does not need any action from a user or operator to trigger the injection; the exploit is fully self-contained (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free, requiring no race conditions, special memory layout, or environmental prerequisites (AC:L).

Blast Radius

• An attacker reads arbitrary data from the underlying database, including stored credentials, session tokens, and any records the application manages.
• An attacker modifies or deletes persisted database rows, corrupting application state or destroying stored records.
• An attacker disrupts availability of the SYSGUARD 6001 service by issuing destructive or resource-exhausting SQL operations against the database.
• Because the vendor has stated the product is no longer supported, future vulnerability disclosures in the same product line will not receive official remediation beyond the 6.1.16.0 release.