CVE-2026-18198 is a high severity (CVSS 8.8) blind SQL injection in GOLDENHORN ONEIT from TAC Information Services Internal and External Trade Inc. The record says versions before the release named Göbeklitepe are affected. Confirm the fixed release with the vendor and the Turkish national advisory TR-26-0990.
What's affected
The NVD record says the issue affects GOLDENHORN ONEIT before the release named Göbeklitepe. That is the only version information in the record. The record lists no CPE product data, so scanners may not map it automatically.
The record points to the advisory TR-26-0990 from the Turkish national cyber security authority (siberguvenlik.gov.tr). When we tried to fetch that page, the content did not load, so this post does not repeat any detail beyond the record. Read the advisory directly for the exact versions and the vendor's remediation steps.
The vector is network based, needs low privileges and no user interaction, and rates confidentiality, integrity and availability impact as high. KEV status is false.
How to check if you're exposed
Find the version or release name of your GOLDENHORN ONEIT installation, which is usually shown in the application's about page or in the vendor's deployment records. Compare it with the Göbeklitepe release named in the record. If you cannot tell, ask TAC Information Services or your integrator which release you run.
Then identify who can reach the application. The record describes an attacker with low privileges, so list the accounts that can sign in, and whether the application is reachable from the internet.
Check web server and database logs for repeated requests with unusual delays or error patterns, which is how blind injection attempts often appear.
What to do now
- Confirm with the vendor which release you run and whether it is older than Göbeklitepe.
- Read advisory TR-26-0990 and follow the vendor's remediation instructions.
- Upgrade to the fixed release, testing in a staging copy first.
- Restrict access to the application to trusted networks until the upgrade is done.
- Run the database account used by the application with the least privileges that it needs.
- Review logs for signs of probing before and after the upgrade.
Why it matters
The weakness class is CWE-89, improper neutralization of special elements in an SQL command, better known as SQL injection. The application builds a database query using input from a request without separating code from data. In a blind variant, the attacker cannot see query results directly, but can infer data from differences in response behavior or timing.
That makes the attack slower, not harmless. Blind SQL injection can still read whole tables, alter records or, depending on database settings, do more. The usual defense is parameterized queries, and for operators it is patching, limiting reach, and using a database account with narrow rights. The record does not flag the CVE as exploited.
Quick check
What is a blind SQL injection?
It is an injection where the application does not return query output, so an attacker learns data indirectly from how the application responds.
Why does this post not give an exact fixed version number?
The record names a release called Göbeklitepe and the advisory page did not load for us. Check the vendor and the national advisory for the precise version.
Sources
Last reviewed: 18 October 2026.
