CVE-2018-12464: Micro Focus Secure Messaging Gateway SQL Injection in Web Admin and Quarantine

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote SQL injection with a CVSS score of 9.8, very high EPSS, public exploit code, and a documented path to remote code execution make this an urgent pre-auth risk.

What it is

The web administration and quarantine components of Micro Focus Secure Messaging Gateway contain a SQL injection flaw that lets an unauthenticated remote attacker run arbitrary SQL against the database. Because it can be used to create an administrative account and chained with CVE-2018-12465 for remote code execution, it is a serious pre-auth entry point into the gateway.

Impact

An attacker can execute arbitrary SQL statements, including creating an administrative account, and then combine this with CVE-2018-12465 to achieve unauthenticated remote code execution.

Attack surface

Reachable over the network through the web administration and quarantine interfaces with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.80672, 99.6th percentile) and public references include an Exploit-DB entry, indicating mature public exploitation.

What to do

• Upgrade Micro Focus Secure Messaging Gateway to version 471 or later; versions prior to 471 are affected.
• If immediate patching is not possible, restrict network access to the web administration and quarantine interfaces to trusted management networks only.
• Apply input validation and parameterized queries to the web administration and quarantine components as a defense-in-depth measure.
• Monitor for and remove any unauthorized administrative accounts created through the SQL injection.
• Review the vendor knowledge base article 7023132 for any additional guidance.

Detection

• Inspect web server and application logs for SQL injection patterns in requests to the administration and quarantine endpoints.
• Alert on creation of new administrative accounts, especially from unexpected source IPs or outside change windows.
• Monitor database logs for anomalous SQL statements originating from the web application.
• Correlate activity with CVE-2018-12465 exploitation attempts to detect the full attack chain.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.