CVE-2026-39987Vulnerability
Marimo Remote Code Execution Vulnerability
Reported by 3 independent sources · first reported by Infosecurity Magazine · last reported
Last reported 11 days ago
Fix due 7 May 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 98% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
6 reports, newest first · the exact sentence from each-
September 2026 CVE Landscape“CVE-2026-39987”
-
Human Attacker Hits Machine-Speed Exploitation of Marimo RCE“In a technical write-up published on September 11, Sysdig's Threat Research Team said the operator exploited CVE-2026-39987, a pre-authentication remote code execution flaw in the Marimo notebook platform, and showed no sign of using a large language model (LLM) at any stage.”
-
August 2026 CVE Landscape“CVE-2026-39987”
-
N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it“Marimo's unauthenticated terminal WebSocket, CVE-2026-39987, affects versions before 0.23.0 and is in CISA's Known Exploited Vulnerabilities catalog.”
-
July 2026 CVE Landscape“CVE-2026-39987”
-
Chinese Hacker Uses DeepSeek AI to Orchestrate Vulnerability Exploits“CVE-2026-39987 (CVSS rating: 9.8): Marimo Notebook vulnerability with manual active exploitation (command execution confirmed)”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-33824, CVE-2026-34486, CVE-2026-63030, CVE-2021-29441, CVE-2026-3055, CVE-2025-49113, CVE-2026-60004, CVE-2026-0300, CVE-2026-33017, CVE-2022-0847, CVE-2026-20316, CVE-2026-60137, CVE-2021-3156, CVE-2026-12569, CVE-2026-3395, CVE-2026-81578, CVE-2026-82078, CVE-2025-68613, CVE-2026-21858, CVE-2026-68820
Thanks — we review every report.