CVE-2026-39987

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

April 11, 2026

Last Seen

October 16, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical WSO2 API Manager Vulnerability Under Active Exploitation80.8

A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffi...

Pre-Auth RCE Vulnerability in Marimo Exposed78.0

Marimo, a Python notebook platform, has a pre-authorization remote code execution vulnerability (CVE-2026-39987) affecting all versions prior to 0.23.0. The flaw allows unauthenticated attackers to gain shell access via the /terminal/ws WebSocket endpoint, executing arbitrary commands with root priv...

Critical RCE Vulnerability in Marimo Exploited Within 10 Hours of Disclosure78.0

A critical pre-authentication remote code execution (RCE) vulnerability in Marimo, an open-source Python notebook platform, was disclosed on April 8, 2026, and exploited within 9 hours and 41 minutes. The vulnerability, tracked as CVE-2026-39987, allows unauthenticated attackers to gain full control...

Human Attacker Exploits Marimo RCE at Machine Speed74.0

A human attacker exploited CVE-2026-39987, a pre-authentication remote code execution vulnerability in Marimo notebooks, achieving a rapid transition from an open WebSocket to SSH access in just eight seconds. The attacker utilized a hand-rolled Python toolkit, bypassing detection mechanisms designe...