A critical SQL injection vulnerability has been identified in PROCON-WEB SCADA affecting the 'GetGridData' endpoint. The endpoint lacks proper input sanitization, enabling remote unauthenticated attackers to execute arbitrary SQL commands. No authentication is required to exploit this vulnerability, making it particularly dangerous. The flaw affects industrial control system (ICS) SCADA software, which is commonly used in critical infrastructure environments. Successful exploitation could lead to unauthorized data access, data manipulation, or further compromise of the underlying system. The vulnerability has been assigned CVE-2026-16462 and is documented by both NVD and CERT VDE.