CVE-2026-63359CWE-89sql-injection

CVE-2026-63359

Critical · published July 24, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
54.4
In the wild
Unconfirmed
What it is

The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information from the database.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00748 · 54.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-07-24T00:17Z
Affected products (1)
ProductVersionsFixed in
equifax/victim_information_notification_exchange< 2026-05-072026-05-07
References (2)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-204-01.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2026-63359 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 23 JUL 18:48Z
    Appriss Insights VINE SQLI
    cvelistv5