CVE-2026-39987: Marimo Remote Code Execution Vulnerability. Marimo contains

Marimo Remote Code Execution Vulnerability. Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

• CISA KEV-listed (remediation due 2026-05-07)
• EPSS 99.6% (99.9% percentile)
• CVSS 9.3 critical

Related briefings

• A hacker let an AI agent pick and attack its own targets 2026-07-30

Linked threat actors

• knaithe

Browse the CVE database

Read the full analysis on IntelFusions