CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Called exploited the same day it was disclosed.
Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listingsame day
- Last KEV listing3d
- Last sighting5mo
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federallisted Mar 26, 2026
- EUVDENISA, European Unionlisted Mar 26, 2026
- VulnCheck KEVcommercial researchlisted Mar 23, 2026
- CIRCLaggregator, mirrors the abovelisted Mar 26, 2026, not counted
3 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationexpel.com/blog/the-ai-cve-exploitation-evidence-story-headli
- reported exploitationwww.ic3.gov/CSA/2026/260702.pdf
- reported exploitation45734016.fs1.hubspotusercontent-na1.net/hubfs/45734016/TeamP
- reported exploitationwww.recordedfuture.com/blog/march-2026-cve-landscape
- reported exploitationwww.cisa.gov/sites/default/files/feeds/known_exploited_vulne
- reported exploitationwww.kaspersky.com/blog/critical-supply-chain-attack-trivy-li
7 public reports collected from VulnCheck and CIRCL, first on Mar 23, 2026. Each links to its original source. We have not verified them.
Description
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have
Required action (CISA)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.