Critical 9.3
KEV-listed
CVE-2026-39987
Human Attacker Exploits Marimo RCE CVE-2026-39987
Vendor / product: Marimo
Event date: 2026-04-09
Public PoC: Yes
First tracked by RiskWire: 2026-09-14
CISA KEV catalog
Added to KEV
Federal remediation due
2026-05-07 (136 days overdue)
Ransomware campaign use
Unknown
CISA description
Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Sources & citations (4)
- Human Attacker Hits Machine-Speed Exploitation of Marimo RCE infosecurity-magazine.com · 2026-09-14
- Hackers Exploit Marimo RCE to Steal AWS Credentials and Reach Bastion Host in 8 Seconds cybersecuritynews.com · 2026-09-15
- Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds gbhackers.com · 2026-09-15
- Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds thehackernews.com · 2026-09-15
References
See CVE-2026-39987 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →