CVE-2025-26852 is a Critical (CVSS 10.0) SQL injection in DESCOR INFOCAD 3.5.1 and earlier. The record says it is fixed in version 3.5.2.0. If you run INFOCAD, upgrade to 3.5.2.0 or later and read the vendor changelog entry for details.
What's affected
Affected: DESCOR INFOCAD 3.5.1 and before. Fixed: version 3.5.2.0, according to the record and the vendor's changelog entry titled SQL injection.
The record gives no further detail about which screens or parameters are involved, and the vendor page I read is a short changelog item without technical depth. That is common for vendor fixed issues in commercial software: you get a version number and a category, not a map of the code.
The same release also addresses a separate authorization weakness, covered in CVE-2025-26853. If you are on 3.5.1 or older, both fixes arrive together in 3.5.2.0, so one upgrade closes both.
How to check if you're exposed
INFOCAD is a business application, so check with whoever administers it. In the application, look for the version in the about or system information page and compare it against 3.5.2.0.
If you run it on your own infrastructure, ask your vendor contact or integrator which build is deployed. Do not rely on the license or contract date, since upgrades do not always track renewals.
If you cannot confirm the version, treat the instance as exposed. The CVSS vector shows a network attack, low complexity, no privileges and no user interaction, with a changed scope, so any reachable instance is a candidate.
Check whether the application is reachable from the internet. A quick look at your firewall and reverse proxy rules is usually enough to tell.
What to do now
- Find every INFOCAD instance and record its version.
- Upgrade anything at 3.5.1 or older to 3.5.2.0 or later.
- While you wait for a maintenance window, restrict network access to the application to the networks that need it.
- Review the database account the application uses. Reduce it to the rights the application truly needs.
- Read the vendor changelog entry and ask the vendor whether a security advisory with more detail exists.
- Check application and database logs for unusual queries or errors around the time the system was exposed.
Why it matters
The record lists CWE-89. SQL injection lets input from outside change the meaning of a database query. Impact depends on what the application database holds and on the account it uses.
The record scores confidentiality, integrity and availability impact as high each, and sets scope to changed, which pushes the score to the maximum of 10.0. A changed scope means the damage can reach beyond the vulnerable component itself. For a facility management system that can include building, asset and personnel records. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
A top score deserves a quick response, but keep the claim honest: the record does not say the issue is exploited, and it gives no technical detail beyond the category. The fix is a normal upgrade.
Quick check
Is CVE-2025-26852 exploited in the wild?
The record's KEV flag is false and I found no advisory stating active exploitation. Treat the score as a reason to patch quickly, not as proof of attacks.
Does 3.5.2.0 fix the authorization issue too?
The record lists 3.5.2.0 as the fixed version for both this SQL injection and CVE-2025-26853, the broken authorization schema.
Sources
Last reviewed: 19 October 2026.
