CVE-2026-2096

Executive Summary

CVE-2026-2096 is a critical Missing Authentication vulnerability in Flowring's Agentflow, an enterprise business process management (BPM) and workflow automation suite. The flaw permits unauthenticated remote attackers to read, modify, and delete arbitrary database contents by invoking a specific application functionality, effectively granting full database compromise without any credentialed access. Organizations running Agentflow deployments — particularly those in the Asia-Pacific region where the product has widespread adoption across manufacturing, logistics, and government sectors — are exposed to severe data integrity and confidentiality risks. With a CVSS score of 9.3 and no confirmed official patch currently available (only a partial workaround), this vulnerability demands immediate attention from security teams.

Technical Analysis

Agentflow is a Java-based workflow and BPM platform developed by Flowring, a Taiwanese enterprise software vendor. The vulnerable component resides within the application's database abstraction layer, which provides runtime database operations (queries, inserts, updates, deletes) to support dynamic workflow operations and form persistence.

The root cause is a Missing Authentication check (CWE-306) on a specific functional endpoint — the NVD description explicitly indicates that attackers can leverage "a specific functionality" without any authentication. While the exact endpoint has not been publicly disclosed, the vulnerability class strongly suggests a servlet or REST API endpoint that maps directly to database connection pool operations, likely accepting raw SQL or parameterized query templates from the HTTP request body.

The mechanism is as follows:

1. Endpoint Reachability: The vulnerable functionality is exposed via the application's HTTP listener (typically port 80/443 or an application server port such as 8080/8443). Because Agentflow is a web-based BPM suite, the endpoint is accessible from the network by default.

2. Missing Authentication Interceptor: The application's security filter chain — which should enforce authentication/authorization on all administrative and database-facing endpoints — fails to intercept requests to this particular functionality. This may be due to a misconfigured URL pattern in the servlet mapping, an error in the web.xml or Spring Security configuration, or an oversight where the endpoint was coded outside the security framework's scope.

3. Database Operation Execution: The functionality accepts parameters that directly map to database operations. An attacker can craft HTTP requests (GET or POST) that instruct the server to execute:

   • SELECT statements (read sensitive data)
   • UPDATE statements (modify workflow data, escalate privileges within the application)
   • DELETE statements (destroy business records, cause denial of service at the data layer)

   Because the application runs with database credentials embedded in its configuration (a common anti-pattern for BPM platforms requiring service accounts), the attacker inherits whatever database privileges Agentflow's connection pool possesses — typically full CRUD on the application schema, and potentially elevated privileges on the database server if the service account is over-privileged.

4. Blind vs. Non-Blind Exploitation: Depending on how query results are reflected in the HTTP response, exploitation may be non-blind (results returned directly to the attacker) or blind (requiring time-based or boolean-based inference to extract data). The CVSS metrics (C:H/I:H/A:H) suggest the vulnerability allows full impact across all security objectives, consistent with non-blind read/write/delete operations.

The vulnerability does not require any prior authentication, user interaction, or special network position — it is remotely exploitable over the network (AV:N) with low attack complexity (AC:L) and no privileges (PR:N).

Exploitation Scenarios

Scenario: Full Database Compromise via Unauthenticated HTTP Requests

Step 1 — Reconnaissance and Target Identification

An attacker begins by identifying exposed Agentflow instances. Using Shodan or similar internet scanning platforms, they query for:

http.title:"Agentflow"

This returns Agentflow login pages and application consoles. The attacker narrows candidates to those that respond to the application's standard health or status endpoints, confirming the platform version and build. Alternatively, an attacker targeting a specific organization performs a Google dork (inurl:agentflow) or leverages certificate transparency logs to discover subdomains hosting the BPM suite.

Step 2 — Endpoint Enumeration

The attacker maps the application's endpoint structure. Since the vulnerability involves "a specific functionality," the attacker probes common BPM endpoints and database abstraction paths:

• /AgentFlow/DBOperation
• /agentflow/api/db/execute
• /AfLogicServlet
• /action/dbQuery
• /admin/dataAccess

They also examine the application's JavaScript bundles and configuration files for exposed API route lists (a common information disclosure in Java web apps). Requests such as:

GET /AgentFlow/config/server_config.xml HTTP/1.1
Host: target.example.com

may reveal endpoint mappings and database configuration details.

Step 3 — Trigger and Weaponization

Once the vulnerable endpoint is identified, the attacker sends an unauthenticated request to execute SQL. For a non-blind vulnerability, the attacker issues:

POST /AgentFlow/dbFunction HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded

sqlQuery=SELECT+%2A+FROM+users+WHERE+username%3D'admin'&db=default

The server processes this directly against the database connection pool. The attacker begins with benign probes to confirm execution:

sqlQuery=SELECT+@@VERSION

If the response confirms database version and engine, the attacker escalates to data exfiltration:

sqlQuery=SELECT+username%2C+password_hash+FROM+af_user_accounts

For a blind scenario, the attacker uses conditional time-based payloads:

sqlQuery=SELECT+CASE+WHEN+(SELECT+COUNT(*)+FROM+information_schema.tables)>50+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END

This confirms database access one bit or boolean at a time, using response latency as the oracle.

Step 4 — Modification and Destruction

After confirming read access, the attacker pivots to write operations:

sqlQuery=UPDATE+af_user_accounts+SET+role%3D'administrator'+WHERE+username%3D'attacker_control_account'

This escalates the attacker to full application administrator privileges, enabling workflow tampering, task reassignment, and document access. The attacker may also inject a backdoor into the application's user table to maintain persistence.

Finally, destructive operations are trivial:

sqlQuery=DELETE+FROM+af_process_instances

or more aggressively:

sqlQuery=DROP+TABLE+af_audit_log

Step 5 — Post-Exploitation Impact

With full database control, the attacker:

• Exfiltrates all workflow data, documents, PII (employee/HR records, customer information), and business-process configurations.
• Modifies workflow rules to redirect approvals or payments to attacker-controlled accounts.
• Deletes audit logs to cover their tracks — a methodologically problematic move, since deleting the audit log destroys the evidence of the original intrusion.
• Potentially then exploits the database server for lateral movement into other systems (linked servers, shared credentials, database link extensions).

A coordinated APT would chain this with initial access via phishing or other means to establish full corporate compromise, using the database as a staging ground for credential dumping and network pivoting.

Impact Assessment

CVSS Decomposition (Score: 9.3 — Critical):

• Attack Vector (AV:N): Exploitable from the internet; no physical or local access required.
• Attack Complexity (AC:L): The attack does not require special conditions or race conditions; it is straightforward request crafting.
• Privileges Required (PR:N): No authentication needed — the core of this vulnerability.
• User Interaction (UI:N): No victim interaction required.
• Confidentiality (C:H): Complete database read access; all sensitive business data compromised.
• Integrity (I:H): Full write access to modify or corrupt database records.
• Availability (A:H): Full delete access enables catastrophic data loss; database server may be destabilized.

Business Impact:

• Operational Disruption: Agentflow is the backbone of workflow automation for many enterprises. Database deletion or corruption halts all automated processes, approval chains, HR onboarding, procurement, and document management.
• Data Breach Liability: Exposure of PII (employees, customers), financial records, and proprietary business data carries regulatory penalties under GDPR, Taiwan PDPA, and other data protection regimes. The unauthenticated nature of the breach amplifies severity in regulatory assessments.
• Compliance Failures: Organizations in regulated industries (finance, healthcare, government) face audit failures and potential revocation of operating licenses.
• Reputation and Financial Loss: Direct recovery costs, forensic investigation expenses, legal fees, and customer churn — plausibly in the seven to eight-figure USD range for large deployments.

Blast Radius:

• All Agentflow installations are vulnerable if not patched with the vendor's workaround.
• The product is widely deployed in Taiwan, Japan, Southeast Asia, and increasingly in other regions for BPM needs.
• Supply-chain risk: Agentflow may be embedded in larger vertical solutions (e.g., ERP sidecars, logistics platforms), broadening the attack surface beyond the software itself.

Detection Guidance

Sigma Rule

title: Agentflow CVE-2026-2096 Unauthenticated Database Access Attempt
id: 3f8a1c2d-9b4e-4a7f-8c5d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated requests to Agentflow database operation endpoints indicative of CVE-2026-2096 exploitation.
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection:
    cs-method:
      - 'GET'
      - 'POST'
    cs-uri-query|contains:
      - 'dbQuery'
      - 'dbOperation'
      - 'sqlQuery'
      - 'dataAccess'
      - 'executeQuery'
      - 'AfLogicServlet'
      - 'DBOperation'
    sc-status: 200
  filter_authenticated:
    cs-uri-query|contains:
      - 'jsessionid'
      - 'sessionId'
  condition: selection and not filter_authenticated
falsepositives:
  - Internal health checks or monitoring scripts that may use the same endpoints.
level: high

YARA Rule

rule Agentflow_CVE_2026_2096_ExploitPayload {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects exploit payloads targeting CVE-2026-2096 missing authentication in Agentflow"
        cve = "2026-2096"
        severity = "critical"
        date = "2026-05-15"

    strings:
        // SQL keywords commonly used in exploitation
        $sql_select = "SELECT" ascii nocase
        $sql_drop = "DROP TABLE" ascii nocase
        $sql_delete = "DELETE FROM" ascii nocase
        $sql_union = "UNION SELECT" ascii nocase
        $sql_pg_sleep = "pg_sleep" ascii nocase
        $sql_benchmark = "BENCHMARK" ascii nocase

        // Agentflow endpoint identifiers
        $af_dbfunc = "AgentFlow" ascii nocase
        $af_dbop = "dbQuery" ascii nocase
        $af_sql = "sqlQuery" ascii nocase

        // URL encoding patterns common in SQLi
        $url_encoded = "%20" ascii
        $url_single_quote = "%27" ascii
        $url_equals = "%3D" ascii

        // Database error strings
        $db_error_mysql = "mysql_fetch" ascii nocase
        $db_error_ora = "ORA-" ascii nocase
        $db_error_mssql = "SqlClient" ascii nocase

    condition:
        uint16be(0) == 0x4854 and  // HTTP
        (filesize < 100KB) and
        (2 of ($af_*) and 2 of ($sql_*)) or
        (any of ($sql_*) and any of ($url_*) and any of ($af_*)) or
        (any of ($db_error_*) and any of ($af_*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-2096 Agentflow Unauthenticated DB Operation Attempt"; flow:to_server,established; http.uri; content:"AgentFlow"; http.uri; content:"dbQuery"; http.uri; content:"sqlQuery"; http.method; content:"POST"; http.request_body; content:"SELECT"; http.request_body; content:"FROM"; pcre:"/sqlQuery\s*=\s*(SELECT|INSERT|UPDATE|DELETE|DROP|UNION)/i"; sid:2026209601; rev:1; classtype:attempted-admin; priority:1; reference:cve,2026-2096;)

Elastic Detection

sequence by host.name, source.ip with maxspan=30s
  [network where event.category == "network_traffic" and protocol == "http"
   and network.direction == "ingress" and destination.port in (80, 443, 8080, 8443)]
  [http where event.category == "web" and (
     url.path contains "AgentFlow" and (
        url.query contains "dbQuery" or url.query contains "sqlQuery" or url.path contains "DBOperation"))]
  [process where event.category == "process" and process.name != null and
   process.command_line contains "sqlQuery"]

Splunk SPL Query

index=web sourcetype=access_combined
| stats count by src_ip, uri_path, http_method, status
| where like(uri_path, "%AgentFlow%") OR like(uri_path, "%dbQuery%") OR like(uri_path, "%sqlQuery%")
| lookup cve_lookup cve_id AS _raw OUTPUTNEW cve_severity
| where cve_severity == "critical"
| search NOT uri_path="*login*" NOT uri_path="*logout*"
| stats values(uri_path) as attempted_endpoints, count by src_ip
| where count > 5
| eval threat_score = count * 10
| convert autounix epochtime now() as current_time
| where _time > relative_time(now(), "-72h@h")
| table _time, src_ip, attempted_endpoints, count, threat_score

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="100209" level="12">
    <decoded_as>web_server</decoded_as>
    <match>AgentFlow|agentflow</match>
    <regex>sqlQuery|dbQuery|DBOperation|dataAccess</regex>
    <description>Unauthenticated Agentflow database operation attempt - possible CVE-2026-2096 exploitation</description>
    <group>attack,reconnaissance,web_application,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="100210" level="15">
    <decoded_as>web_server</decoded_as>
    <match>AgentFlow|agentflow</match>
    <regex>UNION SELECT|DROP TABLE|DELETE FROM|INSERT INTO</regex>
    <description>Agentflow SQL injection and database manipulation payload detected - CVE-2026-2096 exploitation confirmed</description>
    <group>attack,sql_injection,web_application,</group>
    <mitre>
      <id>T1190</id>
      <id>T1213</id>
    </mitre>
    <if_sid>100209</if_sid>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 1/4 (PARTIAL — workaround/mitigation only, no official fix confirmed)

1) Immediate Mitigations (Hours 0–24)

• Restrict Network Access: Immediately place Agentflow application servers behind a firewall or WAF that restricts access to the application to known IP ranges only. If remote access is mandatory, force all access through a VPN.
• Apply Vendor Workaround: Implement the mitigation instructions published by Flowring at the official forum: https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939 . The advisory contains configuration modifications to disable or restrict the vulnerable functionality. Apply these changes in a staging environment first, then production.
• Web Application Firewall (WAF): Deploy or update WAF rules to block requests containing SQL keywords (SELECT, INSERT, UPDATE, DELETE, DROP, UNION) in query parameters destined for Agentflow endpoints. Validate the rules against legitimate traffic.
• Database Credential Minimization: Immediately rotate and restrict the database credentials used by Agentflow. If possible, change the account from a full-CRUD service account to a least-privilege account that mirrors the minimum functions required by legitimate application workflows. Limit login host to only the application server IP.

2) Patch/Upgrade Steps

• Monitor for Vendor Fix: The vendor has not released a versioned patch as of this writing. Continuously monitor Flowring's official advisory page, forum, and customer portal for an official fix. When a patched version becomes available, deploy it through the organization's standard patch management lifecycle, prioritizing production instances.
• Hotfix Evaluation: Evaluate whether the vendor's workaround can be formalized into a custom patch (e.g., by modifying the web.xml to add a security constraint intercepting the vulnerable URL pattern). Document any custom changes thoroughly to allow rollback and to track them for removal once the official patch arrives.
• Version Inventory: Audit all installations of Agentflow across the enterprise (including test/QA environments) to ensure the workaround is applied everywhere, not just in production.

3) Long-Term Hardening

• Network Segmentation: Isolate the Agentflow application server and its database server on separate VLANs with strict firewall rules. Do not expose the application directly to the internet unless absolutely necessary; require reverse-proxy or gateway.
• Egress Filtering: A compromised Agentflow instance should not be able to exfiltrate data to the internet. Configure the database server and application server to only initiate connections to required services.
• Database Audit Logging: Enable and thoroughly monitor database audit logs on the Agentflow database to detect SELECT, UPDATE, DELETE statements not originating from the application's known legitimate operations.
• Centralized Logging: Send all Agentflow web server access logs, application logs, and database audit logs to a central SIEM. Configure alerts for anomalies in authentication patterns, unusual SQL activity, and outbound data flows.
• Credential Management: Move Agentflow's database credentials to a secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) so that theft of the application's configuration files does not expose live database credentials.
• Incident Response Planning: Add this specific CVE to incident response playbooks. Develop a runbook for the scenario of full database compromise via an unauthenticated web vulnerability, including evidence preservation, containment, erasure, and recovery procedures.
• Vendor Relationship: Request from the vendor a formal CVE advisory and disclosure. Ask for a long-term commitment to proper secure development lifecycle practices, including authentication/authorization testing of all endpoints.

References

1. NVD Entry — CVE-2026-2096: https://nvd.nist.gov/vuln/detail/CVE-2026-2096 Official CVE metadata, NVD description, and CVSS score reference.

2. Flowring Vendor Advisory / Forum Post: https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939 Official vendor mitigation instructions. Security teams should monitor this thread for updates, including the eventual official patch.

3. CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html MITRE's description of the common weakness class underlying this vulnerability.

4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog While CVE-2026-2096 is NOT currently in the KEV catalog, security teams should check this source regularly, as active exploitation would trigger CISA's prioritization and mandate for federal agencies to patch within a defined timeline.

5. ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ MITRE ATT&CK mapping for the initial access vector exploited by this vulnerability, along with detection and mitigation guidance.

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence has been publicly documented as of this writing. The EPSS score (0.00519, 41.3% percentile) indicates a moderate probability of exploitation in the wild, but no confirmed incidents have been reported. Organizations should nonetheless treat this as a high-priority exposure given the severity and the absence of an official patch.