Critical Exploitation of Ruby on Rails Vulnerability CVE-2026-66066 Confirmed

• •CVE-2026-66066 allows RCE via unauthenticated file reads in Ruby on Rails applications.
• •Over 7,100 vulnerable Ruby on Rails instances have been identified by VulnCheck.
• •Active exploitation has been confirmed, with significant increases in detection rates.

Threat actors are actively exploiting CVE-2026-66066, a critical Ruby on Rails vulnerability known as KindaRails2Shell, which allows unauthenticated attackers to read arbitrary files from servers, potentially leading to remote code execution (RCE). Disclosed on July 30, 2026, this flaw affects numerous applications using the libvips library for Active Storage image processing. VulnCheck identified over 7,100 exposed vulnerable instances, with exploitation attempts reported since late August 2026. Attackers can access sensitive information such as database passwords and API tokens, enabling lateral movement within networks. The exploit has been confirmed in the wild, with significant activity observed targeting various systems. As of September 1, 2026, the number of detections has risen sharply, indicating a growing threat landscape. Organizations using affected Ruby on Rails applications are urged to apply patches immediately.