CVE-2026-66649

An unauthenticated SQL injection vulnerability exists in Directory Pro versions up to 2.5.8, allowing attackers to manipulate database queries and potentially gain unauthorized access to sensitive data. The critical severity of this flaw (CVSS 9.3) necessitates immediate attention from organizations using affected versions, particularly those handling sensitive information or user data. It is essential for system administrators and security teams to prioritize patching or mitigating this vulnerability to prevent exploitation.