How to fix or mitigate CVE-2026-63359?

Within 24 hours, implement network-level access controls restricting VINE application access to known agency IP ranges, deploy a Web Application Firewall (WAF) with SQL injection detection rules, and evaluate taking the VINE application offline if alternative victim notification channels exist. Within 7 days, coordinate with Equifax/Appriss for interim technical guidance and implement additional input validation or query parameterization if provided by the vendor. No vendor-released patch identified at time of analysis; within 30 days, confirm patch availability status with Equifax/Appriss and immediately deploy any released patch upon receipt, conduct forensic audit of VINE database access logs to identify potential unauthorized access since vulnerability discovery, and notify all connected law enforcement and corrections agencies plus affected victims per applicable state notification laws.

VINE CVE-2026-63359

Q: What is the CVSS score of CVE-2026-63359?

CVE-2026-63359 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

Q: Which versions of VINE are affected by CVE-2026-63359?

A critical SQL injection vulnerability in Appriss Insights Victim Information Notification Exchange (VINE) platform-operated by Equifax and used by U.S.

EUVD-2026-48368 CRITICAL

SQL Injection (CWE-89)

2026-07-23 cisa-cg

GHSA-v49r-rx9c-9mwf

SQLi Microsoft Victim Information Notification Exchange Vine

9.3

CVSS 4.0 · Vendor: cisa-cg

Severity by source

Vendor (cisa-cg) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.4 CRITICAL

Unauthenticated network SQLi with low complexity (AV:N/AC:L/PR:N/UI:N); full read/write of credentials and PII gives C:H/I:H, with A:L reflecting possible SQL-level data manipulation but no confirmed service-disruption focus.

3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:45 vuln.today

CVE Published

Jul 23, 2026 - 18:48 cve.org

CRITICAL 9.3

DescriptionCVE.org

The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information from the database.

AnalysisAI

SQL injection in the Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications lets an unauthenticated remote attacker send a crafted request that bypasses the login page, exposes other users' credentials, enables full account takeover, and permits dumping of sensitive PII and other database contents. VINE is the notification platform used by U.S. corrections and law enforcement agencies to alert crime victims about offender status, so exposure of its data carries direct victim-safety implications. No public exploit identified at time of analysis, but the flaw is trivially exploitable (network, no authentication, low complexity) with a CVSS 4.0 base score of 9.3.

Technical ContextAI

The affected technology is the VINE web application stack (cpe:2.3:a:appriss_insights:victim_information_notification_exchange_(vine)), a hosted service and application suite that provides automated victim notification and offender-status lookup for justice agencies. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is concatenated into backend SQL queries without proper parameterization or escaping. The 'Microsoft' tag suggests a Microsoft SQL Server backend, where injection can be leveraged not only to read arbitrary tables (credentials, PII) but potentially to enumerate schema, exfiltrate bulk records, and manipulate authentication logic to bypass the login page entirely. Because authentication itself is bypassable via the injection, the SQL layer is reachable pre-authentication on an internet-facing endpoint.

RemediationAI

No vendor-released patch version is identified in the available data; the flaw appears to be handled through the vendor's hosted service, so organizations should contact Appriss Insights (Equifax) and monitor the CISA CSAF advisory (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-204-01.json) for the remediated build and confirm their instance has been patched. As compensating controls until confirmation, restrict access to the VINE application to known agency IP ranges or place it behind a VPN to remove unauthenticated internet exposure (trade-off: breaks public victim-lookup access if that is an intended function); deploy a WAF with SQL-injection signatures tuned to the login and query endpoints (trade-off: signature evasion is possible and may cause false positives); and, because credentials may already be exposed, force a password reset for all VINE user accounts and review database and authentication logs for anomalous queries or logins. Given the credential-theft and account-takeover impact, treat any previously exposed credentials as compromised and rotate them.