HOMEVULNERABILITIESCVE-2026-4289
HIGH

CVE-2026-4289

CWE-74Published: March 17, 2026· Updated: Mar 17, 2026

7.3
CVSS v3.1
EPSS:0.03%probability of exploitation in 30 daysPercentile:7.5th

Official Description

A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the file /rest/preSetTemplate/getRecByTemplateId. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD Source

Technical Analysis

CVE-2026-4289 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityLow
IntegrityLow
AvailabilityLow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2026-4289

Microsoft Patches Exploited Exchange Server Vulnerability
SecurityWeek· Jun 11, 2026

The company warned about zero-day attacks exploiting the Exchange Server vulnerability CVE-2026-42897 on May 14. The post Microsoft Patches Exploited Exchange Server Vulnerability appeared first on SecurityWeek. [xlite_meta score:56 src:SecurityWeek xlite_fp:6dee2300f03ba6043abdb9c64638436233a2d7ef838f62971c8f979b1dcba4b8]

Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild
SecurityWeek· May 15, 2026

Microsoft has shared mitigations for CVE-2026-42897 until a permanent patch can be released for affected Exchange Server versions. The post Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild appeared first on SecurityWeek. [xlite_meta score:56 src:SecurityWeek xlite_fp:480a9903e95f83573fc52cd43bbed0aa03e5132cee560e0f856c61ed8a0b2f52]

CISA Adds One Known Exploited Vulnerability to Catalog
CISA Alerts· May 15, 2026

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-42897 Microsoft Exchange Server Cross-Site Scripting Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks aga [xlite_meta score:48 src:CISA Alerts xlite_fp:8f0d5bd54e46fb5cfabc3cb725c0c0ee2419ebe6537724dd750301af3e78921a]

On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email
The Hacker News· May 15, 2026

Microsoft has disclosed a new security vulnerability impacting on-premise versions of Exchange Server that it said has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-42897 (CVSS score: 8.1), has been described as a spoofing bug stemming from a cross-site scripting flaw. An anonymous researcher has been credited with discovering and reporting the issue. " [xlite_meta score:53 src:The Hacker News xlite_fp:95ff4d745c5e9e7617e09fd7122676eb6df7eb4870ce004c59f429fb6feda4ea]

All References (4)

Quick Facts

CVE IDCVE-2026-4289
CVSS Score7.3 / 10
SeverityHIGH
WeaknessCWE-74
CISA KEVNo
EPSS (30d)0.03%
PublishedMar 17, 2026

Related CVEs (CWE-74)

Recommended Actions

  • Apply vendor patches immediately
  • Monitor CVE-2026-4289 in threat intel feeds
  • Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.