← Back to CVE Explorer

CVE-2026-63359

Full vulnerability record from the local CVENow database.

Description

The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information from the database.

Severity
CRITICAL
CVSS score
9.3 (v4.0)
Vulnerability status
Analyzed
Source identifier
9119a7d8-5eab-497f-8521-727c672e3725
Published
2026-07-23 20:17:20.367000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON 
{
  "id": "CVE-2026-63359",
  "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
  "published": "2026-07-23T20:17:20.367",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [
    {
      "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "exclusively-hosted-service"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information from the database."
    },
    {
      "lang": "es",
      "value": "Las aplicaciones Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) permiten a un atacante no autenticado enviar una solicitud especialmente diseñada para eludir la página de inicio de sesión, acceder a las credenciales de otros usuarios, tomar el control de otras cuentas de usuario, acceder a información de identificación personal sensible y volcar otra información de la base de datos."
    }
  ],
  "affected": [
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "affectedData": [
        {
          "vendor": "Appriss Insights",
          "product": "Victim Information Notification Exchange (VINE)",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "lessThan": "2026-05-07",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "2026-05-07",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "ssvcData": {
          "timestamp": "2026-07-13T19:39:57.177322Z",
          "id": "CVE-2026-63359",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-27T18:06:28.603981Z",
          "id": "CVE-2026-63359",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:equifax:victim_information_notification_exchange:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2026-05-07",
              "matchCriteriaId": "B6968B7D-70A3-4587-8A3C-9ABE8C5DA8E4"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-204-01.json",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63359",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}