KEV-listed
CVE-2026-33634
TeamPCP Exploitation of CVE-2026-33634 in Aqua Security Trivy
Vendor / product: Aqua Security Trivy
Event date: 2026-03-19
Public PoC: Yes
First tracked by RiskWire: 2026-08-27
CISA KEV catalog
Added to KEV
Federal remediation due
2026-04-09 (164 days overdue)
Ransomware campaign use
Unknown
CISA description
Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Named threat actors
TeamPCPUNC6780Vect
Sources & citations (1)
- KELA research leads to alleged TeamPCP Members Arrested markets.businessinsider.com · 2026-08-27
References
See CVE-2026-33634 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →