cve recordzero dayexploit reported

CVE-2026-119757

CVSS—

Severitynone

Weakness—

EPSS0.54%45.5th percentile

Exploited1 KEV source

patch window

Called exploited the same day it was disclosed.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

CVE reservedOct 30, 2026
CVE publishedNov 5, 20266d
First KEV listingNov 5, 2026same day
Last sightingNov 5, 2026same day

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Uniondoes not list it
VulnCheck KEVcommercial researchlisted Nov 5, 2026
CIRCLaggregator, mirrors the abovelisted Nov 5, 2026, not counted

Sources1 of 3

Listings differ by—

Strongest claimconfirmed

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

reported exploitationNov 5, 2026www.binance.com/en/square/post/384812445203404
reported exploitationNov 5, 2026www.cve.org/CVERecord?id=CVE-2026-119757

2 public reports collected from VulnCheck and CIRCL, first on Nov 5, 2026. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2026-119757

CVE-2026-119757Nov 8, 2026high

BTCPay Server Insufficiently Protected Credentials Flaw Exploited Upon Disclosure

The vulnerability CVE-2026-119757 in BTCPay Server was identified as exploited on the same day it was published, leaving no window for remediation.