CVE-2026-66066

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

July 29, 2026

Last Seen

September 1, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical RCE Vulnerability in Rails Active Storage Disclosed79.5

On July 29, 2026, the Ruby on Rails security team published CVE-2026-66066, a critical arbitrary file read and remote code execution (RCE) vulnerability in Active Storage. Discovered by the Ethiack research team, this flaw affects default configurations of Rails 6.x, 7.x, and 8.x that utilize the vi...

Critical Exploitation of Ruby on Rails Vulnerability CVE-2026-66066 Confirmed72.9

Threat actors are actively exploiting CVE-2026-66066, a critical Ruby on Rails vulnerability known as KindaRails2Shell, which allows unauthenticated attackers to read arbitrary files from servers, potentially leading to remote code execution (RCE). Disclosed on July 30, 2026, this flaw affects numer...