Organisations urged to patch Omnispace Agora to mitigate critical SQL injection and unauthenticated code execution risks

Organisations running Omnispace Agora Project versions older than 26.10.0 face a severe operational risk due to a newly disclosed vulnerability. The National Vulnerability Database records this issue as CVE-2026-63146, assigning it a critical severity rating of 9.3. This flaw allows unauthenticated attackers to execute remote code on systems where the software is installed, potentially compromising the underlying infrastructure entirely.

The risk

The vulnerability stems from how the application handles configuration data during the installation process. According to the NVD record, unescaped values controlled by attackers are written directly into the config.inc.php file. This occurs through the File::updateConfigFile() and DbInstall::dbControl() functions. The issue is compounded by an SQL injection weakness enabled by the PDO::ATTR_EMULATE_PREPARES setting, which supports stacked queries. Attackers can exploit this SQL injection to re-trigger the installer mechanism. This allows them to inject arbitrary PHP code into the configuration file, achieving full remote code execution on the host system without needing valid credentials.

Who is exposed

Any organisation using Omnispace Agora Project versions before 26.10.0 is exposed to this threat. The vulnerability is present in the installation routine, meaning systems that have already been installed may still be vulnerable if the installer can be re-triggered. Small businesses and enterprises relying on this specific version of the software for their operations are at immediate risk. The NVD record confirms that all versions prior to 26.10.0 contain this code injection weakness.

Cost and compliance

The source material does not provide specific details regarding financial costs, regulatory fines, or compliance implications associated with this vulnerability. There is no information in the NVD record about data breaches, customer impact, or legal liabilities resulting from CVE-2026-63146. Organisations must determine their own compliance posture based on their internal security policies and industry regulations.

What happens next

Managers should immediately verify which versions of Omnispace Agora are deployed across their network. If any systems are running versions before 26.10.0, they should be isolated to prevent exploitation. Teams should monitor for unusual installer activity or unexpected changes to configuration files. No fix has been confirmed yet in the source material.

Questions to ask your suppliers

Teams should ask vendors whether they have confirmed exposure to this specific vulnerability in their managed services. Managers need to know if the supplier has a process for verifying software versions across client environments. It is important to determine who within the organisation is responsible for applying security updates and how quickly they can respond.

Check whether the supplier provides regular reporting on software patch levels and vulnerability assessments. Ensure that communication channels are established for urgent security alerts so that operational decisions can be made promptly. Verify that the supplier understands the critical nature of unauthenticated remote code execution flaws and has protocols in place to mitigate such risks before they impact business operations.

Background: National Vulnerability Database

The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.

Read the full guide: National Vulnerability Database Explained: How NVD Works for You

What to do and how to stay safe: Omnispace

• Verify the version of Omnispace Agora installed on all servers and identify any instances running versions before 26.10.0.
• Monitor system logs for unexpected re-triggering of installation scripts or modifications to configuration files.
• Restrict network access to installation endpoints to prevent unauthenticated remote exploitation.
• Once the vendor provides an update, apply the patch immediately to resolve the code injection vulnerability.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-63146?

The National Vulnerability Database rates CVE-2026-63146 as critical with a CVSS score of 9.3.

Which versions of Omnispace Agora are affected?

All versions of Omnispace Agora Project before 26.10.0 are affected by this vulnerability.

How do attackers exploit this flaw?

Attackers exploit an SQL injection issue to re-trigger the installer and inject arbitrary PHP code into the config.inc.php file.