What is the CVSS score of CVE-2026-63046?

CVE-2026-63046 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache InLong are affected by CVE-2026-63046?

Apache InLong Agent Installer versions 2.0.0 through 2.3.x contain a critical remote code execution vulnerability enabling compromise of data processing infrastructure, risking data theft and…. A patch is available.

How to fix or mitigate CVE-2026-63046?

Within 24 hours, audit your infrastructure to identify all deployments of Apache InLong Agent Installer and document current versions in use; if version 2.0.0 through 2.3.x are detected, isolate affected systems from untrusted networks and restrict access to authorized personnel only. Within 7 days, apply the vendor-released patch by upgrading all affected InLong deployments to version 2.4.0, following Apache's official release notes and testing the upgrade in a staging environment first to ensure compatibility with your data pipeline configurations. Within 30 days, verify all systems have successfully upgraded to version 2.4.0 through automated inventory scanning, review agent host system logs for any suspicious command execution patterns during the vulnerability window, and document patching completion as evidence of remediation for compliance audits.

Apache InLong CVE-2026-63046

EUVD-2026-63849 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-08-21 apache

GHSA-jc7r-r7p4-f656

Apache Code Injection Apache Inlong

8.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable management interface assumed; PR:L because submitting module configs requires authenticated access; S:C for OS-level shell breakout from the application context.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 21, 2026 - 09:36 vuln.today

Patch available

Aug 21, 2026 - 09:16 EUVD

CVE Published

Aug 21, 2026 - 08:37 cve.org

HIGH

DescriptionCVE.org

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it.

[1] https://github.com/apache/inlong/pull/12151 .

[2] https://github.com/apache/inlong/pull/12155 .

Articles & Coverage 1

News 9 New Apache Vulnerabilities - 1 Critical, 8 High Severity Aug 22, 2026

AnalysisAI

Argument injection in Apache InLong's Agent Installer (versions 2.0.0 through 2.3.x) enables arbitrary shell command execution via the ModuleManager's ExcuteLinux.exeCmd() method, which applies no input filtering or whitelist validation. Any deployment running InLong agents within the affected version range is exposed to OS-level command execution on the agent host system. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must have access to submit module definitions or configurations to the InLong Agent Installer's ModuleManager component on an affected Linux host running Apache InLong version 2.0.0 through 2.3.x. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	No CVSS score or vector was provided in the available intelligence, and no EPSS probability figure is available, substantially limiting quantitative risk scoring. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary remediation is to upgrade Apache InLong to version 2.4.0 or later, as directed by the Apache security advisory at https://lists.apache.org/thread/2pgz70rz9ozfm7vm5c33po3yyspq846y. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit your infrastructure to identify all deployments of Apache InLong Agent Installer and document current versions in use; if version 2.0.0 through 2.3.x are detected, isolate affected systems from untrusted networks and restrict access to authorized personnel only. …

Threat intelligence, references, and detailed analysis are available after sign-in.