CVE-2026-62390 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-62390 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-62390 is a critical SQL injection vulnerability in Apache Kylin, affecting a backend API responsible for refreshing the table catalog.

Technical Detail

The flaw stems from improper neutralization of special elements in SQL commands within the table catalog refresh API endpoint. An attacker who can reach this API can inject malicious SQL syntax into the dynamically generated query, potentially enabling unauthorized data access, data manipulation, or extraction of sensitive information from the underlying database. Depending on the database configuration and privileges granted to the Kylin service account, exploitation could extend to command execution at the database layer.

Exploitation Status

No known exploit code has been observed or reported at this time. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit, meaning no public proof-of-concept or active exploitation has been confirmed as of July 21, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability.

What To Do

Apply the latest available patch from the Apache Kylin project immediately, prioritizing any internet-facing or network-accessible deployments. Given the CVSS score of 9.8, this should be treated as a high-priority remediation regardless of current exploitation status. If patching cannot be completed immediately, restrict network access to the affected table catalog refresh API endpoint through firewall rules or API gateway controls, limiting exposure to trusted internal hosts only. Monitor database query logs for anomalous or malformed SQL patterns originating from Kylin service accounts as a detection signal. Review the Apache Kylin security advisories and release notes for version-specific guidance and confirm the exact affected version range before deploying fixes.