Apache InLong CVE-2026-63037

Exploitation requires the ability to send requests to an InLong Manager backend endpoint that accepts a user-controllable sort/ORDER BY parameter, on a version in the range 2.0.0 to before 2.4.0. The CVSS vector rates it AV:N/AC:L/PR:N/UI:N (network-reachable, no authentication, no user interaction), so per the provided vector it is unauthenticated; however, the Manager backend is normally an authenticated administrative interface, so whether the vulnerable endpoint is truly pre-auth should be confirmed with the vendor. Limiting factors: the target must be a Manager instance in the affected version range with network reachability to the attacker, and ORDER BY injection often permits only blind/inferential data extraction, which slows and complicates exploitation compared to a direct UNION-based read.

Signals conflict and should be weighed together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) implies trivial, unauthenticated, network-reachable full compromise, yet the EPSS probability is only 0.21% (11th percentile) and the vulnerability is not KEV-listed, indicating no observed or predicted mass exploitation. There is tension between the PR:N (unauthenticated) rating and the fact that the affected surface is the InLong Manager backend, which is normally an authenticated administrative control plane - the description does not state whether the vulnerable endpoint is reachable pre-authentication, so the true privilege requirement should be verified with the vendor. ORDER BY injection also often yields blind/boolean or error-based data extraction rather than clean full read/write, so the uniform C:H/I:H/A:H may overstate integrity and availability impact. Net assessment: a genuine high-severity data-exposure bug worth patching promptly, but the combination of low EPSS, no KEV, no known POC, and a niche product footprint places it below actively-exploited internet-facing CVEs in triage priority. No public exploit identified at time of analysis.

An attacker who can reach the InLong Manager backend submits a crafted sort/ORDER BY parameter to a list or query endpoint, appending a boolean- or error-based SQL payload that the backend concatenates directly into its query. By observing changes in result ordering or error responses, the attacker iteratively extracts sensitive Manager metadata (credentials, connection strings, pipeline configuration) from the database. No public POC was provided in the source data.