Vulnerability · Published Jun 11, 2026 · Assigned by TR-CERT

CVE-2026-11561SSTI in Soagen Informatics' Apinizer

Critical 9.8

In plain English

A critical-severity expression language injection in Apinizer from Soagen Informatics Technologies Software and Consulting Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.4%top 60.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection. This issue affects Apinizer: from 2026.04.0 before 2026.04.6.

Affected products (as reported)

Vendor	Product	Versions
Soagen Informatics Technologies Software and Consulting Inc.	Apinizer	2026.04.0 – before 2026.04.6

Weakness: CWE-917 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0365 government-resource