Is CVE-2026-26710 being exploited in the wild?

At the time of the last update, CVE-2026-26710 was not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS probability of exploitation in the next 30 days is 0.52 percent. Recheck the catalog regularly.

How do I fix CVE-2026-26710?

Upgrade Carmelo Simple Food Order System to the fixed version named in the vendor advisory listed under Technical References. If you cannot patch right away, limit network access to the affected component and monitor it closely until you can.

How serious is CVE-2026-26710?

It is rated critical with a CVSS base score of 9.8. The flaw can be reached over the network, needs no login, and needs no user interaction. In CTEM terms, combine that with how exposed and important the affected system is to set the real priority.

CVE-2026-26710: Carmelo Simple Food Order System SQL Injection (CVSS 9.8)

Quick answer

Direct answer

CVE-2026-26710 is a critical severity sql injection in Carmelo Simple Food Order System with a CVSS score of 9.8. Apply the vendor fix and confirm exposure on internet facing and business critical assets first.

Risk scores

CVSS base score

9.8CRITICAL

EPSS probability

0.52%

Higher than 43 percent of all CVEs

CISA KEV

Not listed

CVSS metric	What it means
Attack vector (AV:N)	Network: reachable remotely
Attack complexity (AC:L)	Low complexity
Privileges required (PR:N)	No privileges required
User interaction (UI:N)	No user interaction
Scope (S:U)	Scope unchanged
Confidentiality (C:H)	High confidentiality impact
Integrity (I:H)	High integrity impact
Availability (A:H)	High availability impact

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

About Carmelo Simple Food Order System

CVE-2026-26710 affects Carmelo Simple Food Order System, a product from Carmelo. Before acting, confirm where Carmelo Simple Food Order System runs in your estate, who owns it and whether it is reachable from the internet, because exposure decides real risk more than the score alone.

What the flaw is

In plain terms: code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/edit-orders.php.

The weakness class is SQL Injection. Untrusted input changes the meaning of a database query.

Based on its CVSS vector, the flaw can be reached over the network, needs no login, and needs no user interaction. Apply the vendor fix and confirm exposure on internet facing and business critical assets first.

Affected versions and timeline

Field	Detail
Product	Carmelo Simple Food Order System
Affected versions	Simple Food Order System 1.0
Published	Mar 2, 2026
Last modified	Jun 17, 2026
Added to CISA KEV	Not listed
Assigning CNA	cve@mitre.org

How to detect it

Inventory every instance of Carmelo Simple Food Order System and record the running version against the affected range above.
Check external attack surface scans for internet facing instances of the component.
Review logs on affected systems for unusual requests, errors or new processes around the vulnerable function.
Confirm with an authenticated vulnerability scan once your scanner has a check for this CVE.

How to fix it

Apply the fixed version of Carmelo Simple Food Order System named in the vendor advisory.
If patching must wait, restrict network access to the affected service and put it behind authentication or a web application firewall rule.
Rescan after the change to prove the exposure is gone, then close the ticket.

CTEM action plan

CTEM stage	What to do for this CVE
Scope	Add every business service that depends on Carmelo Simple Food Order System to the current CTEM cycle.
Discover	Find all instances, including shadow and cloud deployments, and record versions and exposure.
Prioritize	Rank using EPSS and CVSS together with asset exposure and business impact.
Validate	Confirm the flaw is reachable and exploitable in your environment and that compensating controls work.
Mobilize	Assign the fix to the asset owner with a due date matched to the priority, then verify closure.