{"metadata": {"vulnerability": "CVE-2026-75604", "count": 86, "kinds": {"milestone": 16, "sighting": 48, "kev": 0, "other": 22}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0329", "record": "NCSC-2026-0329", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-17T23:49:03.450Z", "date_only": false, "value": "2026-08-17T23:49:03.450Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-75604", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-25T22:00:00Z", "date_only": false, "value": "2026-08-25T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3027", "record": "WID-SEC-W-2026-3027", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-08-25T22:00:00Z", "date_only": false, "value": "2026-08-25T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3027", "record": "WID-SEC-W-2026-3027", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-25T22:00:00Z", "date_only": false, "value": "2026-08-25T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3027", "record": "WID-SEC-W-2026-3027", "field": "vulnerabilities.0.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-25T22:00:03.476Z", "date_only": false, "value": "2026-08-25T22:00:03.476506Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99693", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "f16e0e9f-01ba-42f8-a1d7-ab089aedca34", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rafabd1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 19:35:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 Next.js Windows RCE proof of concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99693", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-26T01:58:09.366Z", "date_only": false, "value": "2026-08-26T01:58:09.366034Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtxaajmfdv2q", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "7d7e12d0-5a01-42e1-bd24-5c97bb4c61e4", "content": "Two critical Next.js vulnerabilities, including CVE-2026-75604 (CVSS 9.0), enable unauthenticated remote code execution. Patch to 15.5.24 or 16.3.3 now.\n\n#NextJS #RCE #CyberSecurity #CVE202675604 #WebSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mtxaajmfdv2q"}, {"timestamp": "2026-08-26T09:57:12.094Z", "date_only": false, "value": "2026-08-26T09:57:12.094284Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0329", "record": "NCSC-2026-0329", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-08-26T09:57:12.094Z", "date_only": false, "value": "2026-08-26T09:57:12.094284Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0329", "record": "NCSC-2026-0329", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-26T09:57:12.094Z", "date_only": false, "value": "2026-08-26T09:57:12.094284Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0329", "record": "NCSC-2026-0329", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-08-26T12:15:03.731Z", "date_only": false, "value": "2026-08-26T12:15:03.731017Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0329", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "6b233393-779d-49de-9d00-40c4a7bc0aff", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0329"}, {"timestamp": "2026-08-26T14:00:05.641Z", "date_only": false, "value": "2026-08-26T14:00:05.641284Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99785", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "f633fca3-c312-40d0-b837-dcceee889034", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-26 11:54:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99785", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-26T20:29:43.469Z", "date_only": false, "value": "2026-08-26T20:29:43.469190Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mtz6e6kiuo24", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "ed85a847-7bea-45ea-895a-8be7442dd899", "content": "\ud83d\udea8 CVE-2026-75604 (Critical, CVSS 9.0): pre-auth RCE in Next.js via path traversal in Windows cache. Affects Windows versions before 15.5.24, 16.3.3 and some canary (Pages + App Router without Cache Components).\n\ud83d\udc49 Update now: 15.5.24 / 16.3.3 /  16.4.0-canary.7 \nbuff.ly/LdWZiJF", "url": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mtz6e6kiuo24"}, {"timestamp": "2026-08-26T22:00:00Z", "date_only": false, "value": "2026-08-26T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3027", "record": "WID-SEC-W-2026-3027", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-08-26T22:00:00Z", "date_only": false, "value": "2026-08-26T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3027", "record": "WID-SEC-W-2026-3027", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-08-27T00:00:07.016Z", "date_only": false, "value": "2026-08-27T00:00:07.016659Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/5OcvQ0Kvc7EZmNnx124YGJsJb961fNxRCYGvYNIkiajBUhEy", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "65834bdc-621e-4537-8cd6-4442d23a8f11", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-27T01:00:32.738Z", "date_only": false, "value": "2026-08-27T01:00:32.738052Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0329", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "b2c75c07-4b34-48e4-bd4e-579dda1b0545", "content": "Vercel heeft twee kwetsbaarheden verholpen in Next.js, een React framework voor het ontwikkelen van (web)applicaties. Een kwaadwillende kan de kwetsbaarheid met kenmerk CVE-2026-75604 misbruiken voor het uitvoeren van willekeurige code op de applicatieserver. De kwetsbaarheid is alleen aanwezig in Next.js-applicaties die op een Windows-omgeving worden gehost en die een Pages- en App-router gebruiken zonder de Cache Component.\n\nNaast deze kwetsbaarheid is er ook een andere kwetsbaarheid verholpen die kwaadwillenden in staat stelt willekeurige code uit te voeren. Hiertoe dient een malafide mediabestand aan een kwetsbare applicatie te worden aangeboden. Deze kwetsbaarheid heeft ten tijde van publicatie nog geen CVE-kenmerk toegekend gekregen.", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0329"}, {"timestamp": "2026-08-27T05:11:08.101Z", "date_only": false, "value": "2026-08-27T05:11:08.101+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3027", "record": "WID-SEC-W-2026-3027", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-27T10:16:34.911Z", "date_only": false, "value": "2026-08-27T10:16:34.911295Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/obivan/statuses/117166951267868054", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "9c563650-d14e-4fb3-b9c2-930dc60d3c4b", "content": "Next.js Windows RCE PoC https://github.com/rafabd1/CVE-2026-75604-poc", "url": "https://infosec.exchange/users/obivan/statuses/117166951267868054"}, {"timestamp": "2026-08-27T10:16:47.865Z", "date_only": false, "value": "2026-08-27T10:16:47.865530Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mu2mkwk4fq42", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "98c2e18b-eee0-4860-9220-7792f9ba39b7", "content": "Next.js Windows RCE PoC https://github.com/rafabd1/CVE-2026-75604-poc", "url": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mu2mkwk4fq42"}, {"timestamp": "2026-08-27T11:24:17.291Z", "date_only": false, "value": "2026-08-27T11:24:17.291602Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mu3rucitqc2n", "record": "cve-2026-75604", "field": "creation_timestamp", "uuid": "d1509c8d-2807-48e2-aa56-86d74d90aa25", "content": "Thursday's fuck up - It's been a while since I've had fresh meat from Next.js - and here's such a beautiful critical vulnerability RCE - github.com/rafabd1/CVE-... #cve #exploit #poc #redteam #nextjs #cve-2026-75604 #critical #windows #rce", "url": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mu3rucitqc2n"}, {"timestamp": "2026-08-27T12:00:07.429Z", "date_only": false, "value": "2026-08-27T12:00:07.429107Z", "kind": "sighting", "label": "Seen", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "632c089f-8149-45d7-a31c-1b470a6832c5"}, {"timestamp": "2026-08-27T12:00:10.254Z", "date_only": false, "value": "2026-08-27T12:00:10.254408Z", "kind": "sighting", "label": "Seen", "source": "Telegram/qhr7w023-vn7u1_ejg3FfnGZ1vCO9Tv-EvHPiDFbLb3J-JQ", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "af535502-8911-428a-aec2-930caac33316"}, {"timestamp": "2026-08-27T16:25:54.244Z", "date_only": false, "value": "2026-08-27T16:25:54.244190Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mu3b72nco42i", "record": "cve-2026-75604", "field": "creation_timestamp", "uuid": "efba5206-ca69-4b08-8ce9-77b95719d6d8", "content": "Critical Next.js & libheif RCE Vulnerabilities: Inside the August 2026 AVIF Zero-Day Exploit\u00a0Chain\n\nCritical Next.js RCE vulnerabilities affect AVIF image optimization and Windows servers. Learn about\u2026\n\nhttps://thecybersecguru.com/news/recommended-url-slug-nextjs-rce-avif-libheif-cve-2026-75604/", "url": "https://bsky.app/profile/thecybersecguru.com/post/3mu3b72nco42i"}, {"timestamp": "2026-08-27T18:44:38.004Z", "date_only": false, "value": "2026-08-27T18:44:38.004000Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mu3iwqpz542c", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "90bede7d-09b7-4656-8069-5ae1578e4bcb", "content": "#NextJS: Two Critical Vulnerabilities in NextJS allow unauthenticated #RCE: one through crafted AVIF images, another via path traversal on Windows (CVE-2026-75604). \nUpgrade your NextJS immediately to v15.5.24 or 16.3.3!:\n\ud83d\udc47", "url": "https://bsky.app/profile/securestep9.bsky.social/post/3mu3iwqpz542c"}, {"timestamp": "2026-08-27T19:00:42.064Z", "date_only": false, "value": "2026-08-27T19:00:42.064265Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "8ba80c9d-f2c8-4c5c-ae73-3b93b2c2c79a", "content": "Credit: Hacktron\nVercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem.\n\nThe Windows path traversal, tracked as CVE-2026-75604&", "url": "https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html"}, {"timestamp": "2026-08-27T20:25:08.652Z", "date_only": false, "value": "2026-08-27T20:25:08.652362Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mu3okvouo527", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "916bf366-5a92-4acb-89f9-061a2afe4aa3", "content": "\ud83e\udd16 Next.js patches two critical unauth RCE flaws: crafted AVIF image (heap overflow in libheif, CVSS 9.5) and Windows path traversal CVE-2026-75604 (CVSS 9.0). Fixed in 15.5.24 / 16.3.3.\nhttps://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mu3okvouo527"}, {"timestamp": "2026-08-27T22:00:05.890Z", "date_only": false, "value": "2026-08-27T22:00:05.890900Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/captainsmok3r_official/493", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "a5672d7a-c897-4f5d-bf75-300aa27aa39e", "content": "poc: https://github.com/rafabd1/CVE-2026-75604-poc", "url": "https://t.me/captainsmok3r_official/493", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-27T22:00:05.937Z", "date_only": false, "value": "2026-08-27T22:00:05.937513Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/captainsmok3r_official/492", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "300383d1-d600-4ed2-9ca3-c082754ea266", "content": "two critical Next.js vulnerabilities, including CVE-2026-75604 (CVSS 9.0), enable unauthenticated remote code execution. Patch to 15.5.24 or 16.3.3 now.", "url": "https://t.me/captainsmok3r_official/492"}, {"timestamp": "2026-08-28T08:41:10.543Z", "date_only": false, "value": "2026-08-28T08:41:10.543898Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mu4xp2d6lp2k", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "0d5eb292-41be-402f-9ab6-4c4a7614b3e7", "content": "\ud83e\udd16 Next.js: Vercel patches two critical unauthenticated RCEs \u2014 crafted AVIF images and a Windows path traversal (CVE-2026-75604). Upgrade affected versions.\nhttps://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mu4xp2d6lp2k"}, {"timestamp": "2026-08-28T09:30:07.075Z", "date_only": false, "value": "2026-08-28T09:30:07.075701Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mu52gkyljp2i", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "b06e5731-a1a6-4deb-85dd-b30b68a1a732", "content": "\ud83d\udce2 [VULN] Next.js : deux failles critiques permettent une ex\u00e9cution de code \u00e0 distance sans authentification - CVE-2026-75604\n\nLe 25 ao\u00fbt 2026, Vercel a publi\u00e9 plusieurs nouvelles versions de Next.js : 15.5.24 et 16.3.3. L'objectif ?\n\n#CVE #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mu52gkyljp2i"}, {"timestamp": "2026-08-28T15:00:05.299Z", "date_only": false, "value": "2026-08-28T15:00:05.299603Z", "kind": "sighting", "label": "Seen", "source": "Telegram/TyxHaxNOYZewY16WupfPzLILXONmDjxPuLwVALABem5R50xg", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "20e12dd1-72e2-4572-a93f-5fc776271654"}, {"timestamp": "2026-08-29T00:00:16.348Z", "date_only": false, "value": "2026-08-29T00:00:16.348599Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/qhr7w023-vn7u1_ejg3FfnGZ1vCO9Tv-EvHPiDFbLb3J-JQ", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "17432d4d-1331-4785-a47c-48955f5572fa", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-29T00:00:29.027Z", "date_only": false, "value": "2026-08-29T00:00:29.027890Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "11c59c19-e37f-428d-9b98-24e5aee94938", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-29T12:23:13.069Z", "date_only": false, "value": "2026-08-29T12:23:13.069191Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mu7ukyfmsb2e", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "c8bf4bb2-9a33-4a1e-8a07-ed08fd0a4477", "content": "Next.js patched two critical flaws that let an unauthenticated attacker run code on the server.\n\nApps on Vercel are already fixed. Self-hosted deployments are not.\n\nUpdate to 15.5.24 or 16.3.3 now. (CVE-2026-75604)", "url": "https://bsky.app/profile/suriq.io/post/3mu7ukyfmsb2e"}, {"timestamp": "2026-08-29T16:16:16.344Z", "date_only": false, "value": "2026-08-29T16:16:16.344597Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/116769913619325742/statuses/117178773943525377", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "f0805f68-5553-4f75-9222-99daa079c168", "content": "Next.js patched two critical flaws that let an unauthenticated attacker run code on the server.\nApps on Vercel are already fixed. Self-hosted deployments are not.\nUpdate to 15.5.24 or 16.3.3 now. (CVE-2026-75604)\nhttps://suriq.io/blog/nextjs-critical-flaws-self-hosted-rce\n#CVE #CloudSecurity #infosec #cybersecurity", "url": "https://infosec.exchange/ap/users/116769913619325742/statuses/117178773943525377"}, {"timestamp": "2026-08-29T23:00:20.812Z", "date_only": false, "value": "2026-08-29T23:00:20.812516Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Wo1B2qy3supRi9RLVnMbQ41knoxctT-bVTE1SmDL-J33mLU", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "543eac21-29b2-420b-bf7e-54178d68c73a"}, {"timestamp": "2026-08-31T00:00:40.225Z", "date_only": false, "value": "2026-08-31T00:00:40.225506Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Wo1B2qy3supRi9RLVnMbQ41knoxctT-bVTE1SmDL-J33mLU", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "002af1a0-790d-424a-b39d-9bb930ddd3d7", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-31T12:45:02.790Z", "date_only": false, "value": "2026-08-31T12:45:02.790538Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/next.js-disponibili-poc-per-2-vulnerabilita", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "0b1efb63-2b85-4d19-8538-f0be6f0c139b", "url": "https://www.acn.gov.it/portale/w/next.js-disponibili-poc-per-2-vulnerabilita"}, {"timestamp": "2026-08-31T20:11:31.738Z", "date_only": false, "value": "2026-08-31T20:11:31.738877Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mufpoa26uu2c", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "b3a83add-323c-4e7e-88c1-609feb40327d", "content": "~Checkpoint~\nAttacks hit airports, healthcare and government while actively exploited flaws enable remote code execution.\n-\nIOCs: CVE-2026-82078, CVE-2026-18885, CVE-2026-75604\n-\n#Ransomware #ThreatIntel #Vulnerabilities", "url": "https://bsky.app/profile/cyfar.ca/post/3mufpoa26uu2c"}, {"timestamp": "2026-09-01T21:23:30.859Z", "date_only": false, "value": "2026-09-01T21:23:30.859Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-75604", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-01T21:23:30.859Z", "date_only": false, "value": "2026-09-01T21:23:30.859Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-75604", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-01T22:17:12Z", "date_only": false, "value": "2026-09-01T22:17:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P293-QW3H-JR36", "record": "GHSA-P293-QW3H-JR36", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-01T22:17:12.697Z", "date_only": false, "value": "2026-09-01T22:17:12.697", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-75604", "record": "FKIE_CVE-2026-75604", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-01T23:02:33.816Z", "date_only": false, "value": "2026-09-01T23:02:33.816747Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muijoyhfph2z", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "b70ef44f-64a3-4540-b048-74621ec579cd", "content": "\ud83d\udd34 CVE-2026-75604 - Critical (9)\n\nNext.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75604/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muijoyhfph2z"}, {"timestamp": "2026-09-02T06:00:05.299Z", "date_only": false, "value": "2026-09-02T06:00:05.299042Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackingTeamGrupoOfficial/48675", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "f510f956-0408-4614-b9d0-dc5ff528442a", "content": "CVE-2026-75604 Next.js Windows RCE \n*\nPoC", "url": "https://t.me/HackingTeamGrupoOfficial/48675"}, {"timestamp": "2026-09-02T12:30:04.966Z", "date_only": false, "value": "2026-09-02T12:30:04.966565Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mujwsxkzri2t", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "8c02ef6d-da10-4767-9407-34545080c330", "content": "CVE-2026-75604 - next.js\nIf you run a Next.js web app on a Windows server and use certain routing features, an attacker can trick the system into accessing files outside its safe area, exposing secret data and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nextjs #vercel #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mujwsxkzri2t"}, {"timestamp": "2026-09-02T18:00:05.700Z", "date_only": false, "value": "2026-09-02T18:00:05.700898Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/proxy_bar/3613", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "785a0377-1a13-4f8f-a4ad-ecbd60e2096e", "content": "CVE-2026-75604 Next.js Windows RCE \n*\nPoC", "url": "https://t.me/proxy_bar/3613"}, {"timestamp": "2026-09-03T00:00:40.377Z", "date_only": false, "value": "2026-09-03T00:00:40.377498Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/proxy_bar/3613", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "4990a651-edc7-4b7a-a625-193016f371ea", "content": "CVE-2026-75604 Next.js Windows RCE \n*\nPoC", "url": "https://t.me/proxy_bar/3613", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-03T00:00:53.591Z", "date_only": false, "value": "2026-09-03T00:00:53.591941Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackingTeamGrupoOfficial/48675", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "19b257fa-11a3-4d57-9e00-819a0616c626", "content": "CVE-2026-75604 Next.js Windows RCE \n*\nPoC", "url": "https://t.me/HackingTeamGrupoOfficial/48675", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-03T03:56:24.826Z", "date_only": false, "value": "2026-09-03T03:56:24.826443Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-75604", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-03T03:56:24.826Z", "date_only": false, "value": "2026-09-03T03:56:24.826443Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-75604", "record": "FKIE_CVE-2026-75604", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-03T16:00:05.234Z", "date_only": false, "value": "2026-09-03T16:00:05.234877Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/critical_bug/1824", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "be1f004e-3556-4ecf-ac7b-af4f60c414a4", "content": "\ud83d\udd34 \u041f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0437\u044a\u0451\u0431! \u041e\u0434\u0438\u043d \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u0441\u043b\u0435\u0448 \u2014 \u0438 Next.js-\u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE \u043d\u0430 Windows\n\nCVE-2026-75604 | CVSS 9.0 | CWE-22 | \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f\n\n\u0412 Next.js \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 Windows-\u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u043c \u043a\u0435\u0448\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 Pages Router \u0438 App Router \u0431\u0435\u0437 Cache Components.\n\n\u041a\u043e\u0440\u043d\u0435\u0432\u0430\u044f \u043f\u0440\u0438\u0447\u0438\u043d\u0430 \u2014 \u0440\u0430\u0437\u043b\u0438\u0447\u0438\u0435 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0443\u0442\u0435\u0439. Next.js \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b /, # \u0438 ?, \u043d\u043e \u043d\u0435 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u043b \u043b\u0438\u0442\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u0441\u043b\u0435\u0448 \\. \u0414\u043b\u044f Linux \u044d\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0441\u0438\u043c\u0432\u043e\u043b \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430, \u0430 Windows \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0435\u0433\u043e \u043a\u0430\u043a \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u044c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441 ..\\ \u043c\u043e\u0433\u043b\u0438 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 incremental cache \u0438 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c\u0441\u044f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c build-\u0444\u0430\u0439\u043b\u0430\u043c.\n\n\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0442\u0430\u043a:\n\ncache path traversal \u2192 \u0447\u0442\u0435\u043d\u0438\u0435 server-reference-manifest.json \u2192 \u0443\u0442\u0435\u0447\u043a\u0430 AES-\u043a\u043b\u044e\u0447\u0430 Server Actions \u2192 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0430 bound arguments \u2192 React Flight gadget \u2192 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JavaScript \u0432 Node.js \u2192 \u0437\u0430\u043f\u0443\u0441\u043a \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u041e\u0421\n\n\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0430 \u0443\u0442\u0435\u0447\u043a\u0430 .next/server/server-reference-manifest.json. \u0412 \u044d\u0442\u043e\u043c \u0444\u0430\u0439\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f encryptionKey, \u043a\u043e\u0442\u043e\u0440\u044b\u043c Next.js \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u0442 \u0437\u0430\u043c\u043a\u043d\u0443\u0442\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 Server Actions. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u043a\u043b\u044e\u0447 \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e closure-bound Server Action \u0438\u0437 HTML-\u0444\u043e\u0440\u043c\u044b, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0445 \u043a\u0430\u043a \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u0439:\n\n- Next.js \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430 Windows;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f Pages Router \u0438 App Router;\n- Cache Components \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0439 \u043a\u0435\u0448;\n- \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 ISR-\u043c\u0430\u0440\u0448\u0440\u0443\u0442 Pages Router \u0438 \u043a\u0435\u0448\u0438\u0440\u0443\u0435\u043c\u044b\u0439 App Router route;\n- \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u044b\u0439 closure-bound Server Action.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\n- Next.js >= 13.4 \u0438 < 15.5.24;\n- Next.js >= 16.0 \u0438 < 16.3.3.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 15.5.24 \u0438 16.3.3. Vercel \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0433\u043e workaround \u043d\u0435\u0442: Windows-\u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0438 \u0437\u0430\u043d\u043e\u0432\u043e \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\n\n\u0414\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0435 HTTP-\u043f\u0443\u0442\u0438 \u043d\u0430 %5C, ..%5C \u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a /_next/data/, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u0440\u0440\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0441 \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u043c\u0438 POST-\u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u043a Server Actions. \u041d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0445\u043e\u0441\u0442\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b cmd.exe \u0438\u043b\u0438 PowerShell, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u043e\u0442 node.exe, \u0438 \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 Next.js.\n\n\u0420\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435: https://eh.su/reports/cve-2026-75604-unauthenticated-rce-v-next-js-cherez-windows-path-traversal-i-server-actions#editor\n\n#NextJS #CVE202675604 #RCE #PathTraversal #ServerActions #React #NodeJS #AppSec #CyberSecurity", "url": "https://t.me/critical_bug/1824"}, {"timestamp": "2026-09-03T19:00:05.519Z", "date_only": false, "value": "2026-09-03T19:00:05.519469Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/100974", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "ccc996fc-9e19-4bd1-b147-e47f70280184", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-75604\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a FORTBRIDGE-UK\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HTML\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-03 17:28:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nResearch lab and exploit chain for CVE-2026-75604: path traversal in the Next.js incremental cache, to RCE on Windows.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/100974", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-04T00:00:42.549Z", "date_only": false, "value": "2026-09-04T00:00:42.549415Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/critical_bug/1824", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "9fc66a32-98d0-4034-8372-c70c4ef7d8be", "content": "\ud83d\udd34 \u041f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0437\u044a\u0451\u0431! \u041e\u0434\u0438\u043d \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u0441\u043b\u0435\u0448 \u2014 \u0438 Next.js-\u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE \u043d\u0430 Windows\n\nCVE-2026-75604 | CVSS 9.0 | CWE-22 | \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f\n\n\u0412 Next.js \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 Windows-\u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u043c \u043a\u0435\u0448\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 Pages Router \u0438 App Router \u0431\u0435\u0437 Cache Components.\n\n\u041a\u043e\u0440\u043d\u0435\u0432\u0430\u044f \u043f\u0440\u0438\u0447\u0438\u043d\u0430 \u2014 \u0440\u0430\u0437\u043b\u0438\u0447\u0438\u0435 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0443\u0442\u0435\u0439. Next.js \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b /, # \u0438 ?, \u043d\u043e \u043d\u0435 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u043b \u043b\u0438\u0442\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u0441\u043b\u0435\u0448 \\. \u0414\u043b\u044f Linux \u044d\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0441\u0438\u043c\u0432\u043e\u043b \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430, \u0430 Windows \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0435\u0433\u043e \u043a\u0430\u043a \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u044c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441 ..\\ \u043c\u043e\u0433\u043b\u0438 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 incremental cache \u0438 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c\u0441\u044f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c build-\u0444\u0430\u0439\u043b\u0430\u043c.\n\n\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0442\u0430\u043a:\n\ncache path traversal \u2192 \u0447\u0442\u0435\u043d\u0438\u0435 server-reference-manifest.json \u2192 \u0443\u0442\u0435\u0447\u043a\u0430 AES-\u043a\u043b\u044e\u0447\u0430 Server Actions \u2192 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0430 bound arguments \u2192 React Flight gadget \u2192 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JavaScript \u0432 Node.js \u2192 \u0437\u0430\u043f\u0443\u0441\u043a \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u041e\u0421\n\n\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0430 \u0443\u0442\u0435\u0447\u043a\u0430 .next/server/server-reference-manifest.json. \u0412 \u044d\u0442\u043e\u043c \u0444\u0430\u0439\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f encryptionKey, \u043a\u043e\u0442\u043e\u0440\u044b\u043c Next.js \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u0442 \u0437\u0430\u043c\u043a\u043d\u0443\u0442\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 Server Actions. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u043a\u043b\u044e\u0447 \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e closure-bound Server Action \u0438\u0437 HTML-\u0444\u043e\u0440\u043c\u044b, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0445 \u043a\u0430\u043a \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u0439:\n\n- Next.js \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430 Windows;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f Pages Router \u0438 App Router;\n- Cache Components \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0439 \u043a\u0435\u0448;\n- \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 ISR-\u043c\u0430\u0440\u0448\u0440\u0443\u0442 Pages Router \u0438 \u043a\u0435\u0448\u0438\u0440\u0443\u0435\u043c\u044b\u0439 App Router route;\n- \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u044b\u0439 closure-bound Server Action.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\n- Next.js >= 13.4 \u0438 < 15.5.24;\n- Next.js >= 16.0 \u0438 < 16.3.3.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 15.5.24 \u0438 16.3.3. Vercel \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0433\u043e workaround \u043d\u0435\u0442: Windows-\u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0438 \u0437\u0430\u043d\u043e\u0432\u043e \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\n\n\u0414\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0435 HTTP-\u043f\u0443\u0442\u0438 \u043d\u0430 %5C, ..%5C \u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a /_next/data/, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u0440\u0440\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0441 \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u043c\u0438 POST-\u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u043a Server Actions. \u041d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0445\u043e\u0441\u0442\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b cmd.exe \u0438\u043b\u0438 PowerShell, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u043e\u0442 node.exe, \u0438 \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 Next.js.\n\n\u0420\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435: https://eh.su/reports/cve-2026-75604-unauthenticated-rce-v-next-js-cherez-windows-path-traversal-i-server-actions#editor\n\n#NextJS #CVE202675604 #RCE #PathTraversal #ServerActions #React #NodeJS #AppSec #CyberSecurity", "url": "https://t.me/critical_bug/1824", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-04T05:00:04.558Z", "date_only": false, "value": "2026-09-04T05:00:04.558929Z", "kind": "sighting", "label": "Seen", "source": "Telegram/tSCLRB07b57aatS-p2DSf41QV3GSxdafymdAv19o1xopakU", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "23b9a1fb-c25b-4953-a285-18006f236b60"}, {"timestamp": "2026-09-04T13:52:03.292Z", "date_only": false, "value": "2026-09-04T13:52:03.292255Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newshoundai.bsky.social/post/3mup4dehpbj2b", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "4ff401ba-832b-44b3-8015-10a2e34b36af", "content": "The first vulnerability is a Windows path traversal issue identified as CVE-2026-75604 with a CVSS score of 9.0. It affects versions 13.4 through 15.5.23 as well as 16.0 through 16.3.2. This flaw stems from a path traversal weakness that fails to properly restrict file access to a designated", "url": "https://bsky.app/profile/newshoundai.bsky.social/post/3mup4dehpbj2b"}, {"timestamp": "2026-09-04T19:54:40.089Z", "date_only": false, "value": "2026-09-04T19:54:40.089Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-75604", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-04T19:54:40.089Z", "date_only": false, "value": "2026-09-04T19:54:40.089Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-75604", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-05T01:00:38.447Z", "date_only": false, "value": "2026-09-05T01:00:38.447352Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/tSCLRB07b57aatS-p2DSf41QV3GSxdafymdAv19o1xopakU", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "2a8900c6-7e0b-48aa-96ed-340f21410dd8", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-08T20:51:40Z", "date_only": false, "value": "2026-09-08T20:51:40Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P293-QW3H-JR36", "record": "GHSA-P293-QW3H-JR36", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-08T20:51:40Z", "date_only": false, "value": "2026-09-08T20:51:40Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P293-QW3H-JR36", "record": "GHSA-P293-QW3H-JR36", "field": "modified"}, {"timestamp": "2026-09-08T22:10:53.960Z", "date_only": false, "value": "2026-09-08T22:10:53.960919Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mv222zokri2z", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "5d067518-4c8a-4013-9345-ab2d0e5bf5b8", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers\nCVSS 9 \u00b7 EPSS 1.1%\nhttps://beta.vulnsea.com/cve/CVE-2026-75604\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mv222zokri2z"}, {"timestamp": "2026-09-09T21:09:13.080Z", "date_only": false, "value": "2026-09-09T21:09:13.080", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-75604", "record": "FKIE_CVE-2026-75604", "field": "lastModified"}, {"timestamp": "2026-09-16T09:01:53.071Z", "date_only": false, "value": "2026-09-16T09:01:53.071246Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/releaseport.com/post/3mvmrpjbrwa2g", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "12fd9d24-8144-4e11-9bb1-80dc49e8d240", "content": "OpenMAIC 1.0.3 patches CVE-2026-75604\nSecurity enhancements mitigate token abuse, XSS, and redirect attacks while improving\nUpgrade carefully.\n\n\u2192 releaseport.com/r/thu-maic-openmaic/v1-0-3", "url": "https://bsky.app/profile/releaseport.com/post/3mvmrpjbrwa2g"}, {"timestamp": "2026-09-18T10:42:33.765Z", "date_only": false, "value": "2026-09-18T10:42:33.765307Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mvry4uyk2j23", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "083ba3e8-2a65-442d-9f7d-c401ba56f099", "content": "Public exploit code exists for CVE-2026-75604, a Next.js RCE affecting Windows-hosted apps that process untrusted input. Disclosed and exploited in short order, so patching is not optional. Windows Next.js deployments are rarer than you'd think, but they exist.", "url": "https://bsky.app/profile/cybersecurity.page/post/3mvry4uyk2j23"}, {"timestamp": "2026-09-24T23:46:48.229Z", "date_only": false, "value": "2026-09-24T23:46:48.229685Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mwcgv7x6x22t", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "daa734f5-f69c-435c-8e4e-c38b5e6ec0d7", "content": "\u300cNext.js\u300d\u306b\u8907\u6570\u306e\u6df1\u523b\u306a\u8106\u5f31\u6027 - \u30ea\u30ea\u30fc\u30b9\u4e88\u5b9a\u3092\u524d\u5012\u3057\n\n\u30a6\u30a7\u30d6\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u300cNext.js\u300d\u306b\u8907\u6570\u306e\u6df1\u523b\u306a\u8106\u5f31\u6027\u304c\u78ba\u8a8d\u3055\u308c\u305f\u3002\u958b\u767a\u30c1\u30fc\u30e0\u3067\u306f\u5f53\u521d\u4e88\u5b9a\u3092\u524d\u5012\u3057\u3057\u3001\u4fee\u6b63\u7248\u3092\u63d0\u4f9b\u3057\u3066\u3044\u308b\u3002\n\n\u958b\u767a\u30c1\u30fc\u30e0\u306f\u3001\u300cNext.js 16.3.3\u300d\u300c\u540c15.5.24\u300d\u306b\u3064\u3044\u30662026\u5e748\u670826\u65e5\u306e\u30ea\u30ea\u30fc\u30b9\u3092\u76ee\u6a19\u306b\u6e96\u5099\u3092\u9032\u3081\u3001\u8106\u5f31\u6027\u300cCVE-2026-75604\u300d\u3092\u89e3\u6d88\u3059\u308b\u4e88\u5b9a\u3060\u3063\u305f\u304c\u3001\u3042\u3089\u305f\u306b\u5225\u306e\u8106\u5f31\u6027\u304c\u5224\u660e\u3057\u305f\u3053\u3068\u3092\u53d7\u3051\u30011\u65e5\u65e9\u30448\u670825\u65e5\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u516c\u958b\u3057\u305f\u3002\n\n\u300cCVE-2026-75604\u300d\u306f\u3001\u8a8d\u8a3c\u3092\u5fc5\u8981\u3068\u3059\u308b\u3053\u3068\u306a\u304f\u3001\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3055\u308c\u308b\u304a\u305d\u308c\u304c\u3042\u308b...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mwcgv7x6x22t"}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": true, "value": "2026-09-25", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": true, "value": "2026-09-28", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": true, "value": "2026-09-30", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "vendor_advisories.3.published_at"}, {"timestamp": "2026-10-02T00:00:00Z", "date_only": false, "value": "2026-10-02T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "last_revision_date"}, {"timestamp": "2026-10-02T00:00:00Z", "date_only": false, "value": "2026-10-02T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-02T00:00:00Z", "date_only": true, "value": "2026-10-02", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1291", "record": "CERTFR-2026-AVI-1291", "field": "vendor_advisories.2.published_at"}, {"timestamp": "2026-10-02T00:00:00Z", "date_only": false, "value": "2026-10-02T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-05T00:00:00Z", "date_only": true, "value": "2026-10-05", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1291", "record": "CERTFR-2026-AVI-1291", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": true, "value": "2026-10-08", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1291", "record": "CERTFR-2026-AVI-1291", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2026-10-08T00:43:42.265Z", "date_only": false, "value": "2026-10-08T00:43:42.265495Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-LG90193", "record": "CLEANSTART-2026-LG90193", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-08T14:25:46Z", "date_only": false, "value": "2026-10-08T14:25:46Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-LG90193", "record": "CLEANSTART-2026-LG90193", "field": "modified"}, {"timestamp": "2026-10-09T00:00:00Z", "date_only": false, "value": "2026-10-09T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1291", "record": "CERTFR-2026-AVI-1291", "field": "last_revision_date"}, {"timestamp": "2026-10-09T00:00:00Z", "date_only": false, "value": "2026-10-09T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1291", "record": "CERTFR-2026-AVI-1291", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-09T00:00:00Z", "date_only": false, "value": "2026-10-09T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1291", "record": "CERTFR-2026-AVI-1291", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-09T01:29:07.337Z", "date_only": false, "value": "2026-10-09T01:29:07.337137Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mxft54xqiz24", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "38713a1c-8843-43b6-a5e1-dc617dc9be36", "content": "CVE-2026-75604 Next.js: el scanner dec\u00eda limpio\n\n\u00bfTu scanner dice que est\u00e1s limpio? Revis\u00e1 CVE-2026-75604 Next.js: versiones, el caso Windows y c\u00f3mo cubrir los 14 d\u00edas de brecha del aviso p\u00fablico\n\n#cve202675604 #nextjs #vercel #dependabot #seguridad", "url": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mxft54xqiz24"}, {"timestamp": "2026-10-14T11:13:24.019Z", "date_only": false, "value": "2026-10-14T11:13:24.019753Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fishwalkerit.bsky.social/post/3mxtg4ieltx22", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "2793c515-7a3e-4752-bc11-6da831ae9282", "content": "L\u1ed7 h\u1ed5ng RCE ch\u01b0a x\u00e1c th\u1ef1c tr\u00ean Next.js ch\u1ea1y Windows (CVE-2026-75604, CVSS 9.0): n\u00e2ng c\u1ea5p ngay l\u00ean 15.5.24 ho\u1eb7c\u00a016.3.3\n\nVercel v\u1eeba c\u00f4ng b\u1ed1 l\u1ed7 h\u1ed5ng CVE-2026-75604 tr\u00ean framework Next.js v\u1edbi \u0111i\u1ec3m CVSS 9.0 \u2014 k\u1ebb t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n \u0111\u0103ng nh\u1eadp v\u1eabn c\u00f3 th\u1ec3 th\u1ef1c thi m\u00e3 l\u1ec7nh t\u00f9y \u00fd tr\u00ean server. L\u1ed7 h\u1ed5ng \u1ea3nh\u2026", "url": "https://bsky.app/profile/fishwalkerit.bsky.social/post/3mxtg4ieltx22"}, {"timestamp": "2026-10-16T19:00:08Z", "date_only": false, "value": "2026-10-16T19:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105595", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "84d05ac6-400f-4cd7-858e-7c420f67cb1a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ZeroDayEvil\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 26  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 1\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-16 18:34:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udee1\ufe0f Official AI Security Tool module for CVE-2026-75604 (Next.js Unauthenticated RCE PoC in Windows-Hosted Environments).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105595", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-27T07:25:20Z", "date_only": false, "value": "2026-10-27T07:25:20Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-TQ64674", "record": "CLEANSTART-2026-TQ64674", "field": "modified"}, {"timestamp": "2026-10-28T00:36:13.867Z", "date_only": false, "value": "2026-10-28T00:36:13.867741Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-TQ64674", "record": "CLEANSTART-2026-TQ64674", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}], "metrics": {"as_of": "2026-10-31T12:42:04.206Z", "anchors": {"origin": {"timestamp": "2026-08-25T22:00:00Z", "date_only": false, "value": "2026-08-25T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3027", "record": "WID-SEC-W-2026-3027", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-25T22:00:00Z", "date_only": false, "value": "2026-08-25T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3027", "record": "WID-SEC-W-2026-3027", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-08-25T22:00:03.476Z", "date_only": false, "value": "2026-08-25T22:00:03.476506Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99693", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "f16e0e9f-01ba-42f8-a1d7-ab089aedca34", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rafabd1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 19:35:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 Next.js Windows RCE proof of concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99693", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 3.476, "hours": 0.0009655555555555555, "days": 4.023148148148148e-05, "min_seconds": 3.476, "max_seconds": 3.476, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-25T22:00:00Z", "date_only": false, "value": "2026-08-25T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3027", "record": "WID-SEC-W-2026-3027", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-08-25T22:00:03.476Z", "date_only": false, "value": "2026-08-25T22:00:03.476506Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99693", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "f16e0e9f-01ba-42f8-a1d7-ab089aedca34", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rafabd1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 19:35:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 Next.js Windows RCE proof of concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99693", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 5755324.206001, "hours": 1598.701168333611, "days": 66.61254868056713, "min_seconds": 5755324.206001, "max_seconds": 5755324.206001, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-25T22:00:00Z", "date_only": false, "value": "2026-08-25T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3027", "record": "WID-SEC-W-2026-3027", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T12:42:04.206Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 5755320.730001, "hours": 1598.7002027780554, "days": 66.61250844908565, "min_seconds": 5755320.730001, "max_seconds": 5755320.730001, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-25T22:00:03.476Z", "date_only": false, "value": "2026-08-25T22:00:03.476506Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99693", "record": "CVE-2026-75604", "field": "creation_timestamp", "uuid": "f16e0e9f-01ba-42f8-a1d7-ab089aedca34", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rafabd1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 19:35:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 Next.js Windows RCE proof of concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99693", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-31T12:42:04.206Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}