CVE-2026-26263

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6.

Affected products

Glpi, Red Os

Glpi-project Glpi

< 11.0.6

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

8.7% (95th percentile)

Weakness

CWE-89

NVD status

Analyzed

Published

2026-04-06

No exploit for CVE-2026-26263 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.