Apache InLong CVE-2026-63039

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are stated - remote, unauthenticated exploitation over the network against affected Apache InLong 2.0.0-2.3.x instances, with no user interaction. The primary limiting factor is reachability: the attacker must be able to reach the vulnerable InLong endpoint, so instances confined to internal/management networks are far less exposed than internet-facing ones. Note the advisory does not name the exact vulnerable feature, endpoint, or parameter, so the precise entry point is unconfirmed from available data; the PR:N (no privileges) claim should be validated against the actual affected code path in PR #12080.

The signals are mixed and worth weighing carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes a remote, unauthenticated, low-complexity attack with full CIA impact - a textbook critical. However, the EPSS score is only 0.19% (9th percentile), the CVE is not on CISA KEV, and no public PoC is identified, which tempers the practical urgency: this reads as a serious latent flaw rather than one under active mass exploitation. InLong is a specialized big-data platform, so the affected surface is narrower than a ubiquitous web server, and management/console endpoints are often deployed on internal networks - which may explain the low EPSS relative to the high CVSS. Net assessment: prioritize patching for any internet-exposed or multi-tenant InLong deployment, but the absence of KEV/PoC means this is not an emergency drop-everything item for well-segmented internal instances. Note the description does not specify which endpoint or parameter is vulnerable or whether any authentication is required in practice - the PR:N in the vector should be verified against the actual affected code path.

An attacker with network access to an InLong instance sends a crafted request containing malicious SQL syntax in a string parameter that is concatenated into a backend query. Because the vector indicates no authentication or user interaction is required, the attacker can extract sensitive data (credentials, pipeline configurations), modify records, or disrupt the database. No public exploit is identified at time of analysis, so exploitation would require an attacker to craft their own payload against the vulnerable parameter.