VulnSocial

CVE-2026-64959

LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-10-19: 210-19
Referenced assets2 URLs
Full discourse2 posts
  • ThreatWire@ThreatWire_

    🚨 CRITICAL: Apache Kylin 5.0.5 fixes 21 CVEs. The worst, CVE-2026-64959, is rated critical by Apache. The exact cause: certain backend cache API endpoints miss required authentication, which can lead to execution of injected SQL. Affects Kylin 5.0.0 through 5.0.4. What Apache says: • Impact is greatest for Kylin services directly exposed to a public network, which it calls uncommon • In-house deployments are mostly not impacted • Fix: upgrade to 5.0.5 What is confirmed as of Oct 19: • 21 CVEs announced Oct 16 • Only CVE-2026-63618 has an NVD score so far: CVSS 3.1 7.5 • Not in CISA KEV • No public PoC and no exploitation reported Do now: upgrade to 5.0.5, keep Kylin API and backend endpoints off the internet, check logs for unexpected requests to the cache and metadata APIs. Full list of all 21 Kylin CVEs with Apache severity, what is confirmed vs unknown, and the checklist: https://www.threatwire.tech/news/apache-kylin-5-0-5-fixes-21-cves-including-critical-cve-2026-64959 #ApacheKylin #CVE #InfoSec #SQLInjection #Apache

    12041510
    1.9K followersView on X
  • Daily CyberSecurity@Daily_CyberSec

    Apache fixes 12 Apache Kylin vulnerabilities, including critical CVE-2026-64959, plus Apache Airflow SSH flaws. Upgrade Kylin to 5.0.5 now. #ApacheKylin #ApacheAirflow #ApacheAnswer #CVE202664959 #CVE202668571 #CVE202694134 #SQLInjection #CyberSecurity https://securityonline.info/apache-kylin-vulnerabilities-airflow-answer/

    00000385
    13.0K followersView on X

Explore more

Back to dashboard