CVE-2026-63359 describes an SQL Injection vulnerability in the Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) application. This vulnerability permits an unauthenticated attacker to send specially crafted requests that bypass the login page, enabling unauthorized access to other users' credentials and accounts. The attacker can also access sensitive personally identifiable information (PII) and extract additional data from the backend database. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and the product is not a cloud service.

Successful exploitation allows unauthenticated attackers to bypass authentication controls, compromise user accounts, access sensitive PII, and extract database contents. This poses a severe risk to user privacy and system integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application where possible and monitor for suspicious activity related to authentication bypass attempts.