cve recordexploit reported

CVE-2026-40242

CVSS—

Severitynone

Weakness—

EPSS0.72%52.3th percentile

Exploited1 KEV source

patch window

Called exploited 160 days after disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

CVE reservedApr 10, 2026
CVE publishedApr 10, 2026same day
First KEV listingSep 17, 20265mo
Last sightingSep 18, 20261d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Uniondoes not list it
VulnCheck KEVcommercial researchlisted Sep 17, 2026
CIRCLaggregator, mirrors the abovelisted Sep 17, 2026, not counted

Sources1 of 3

Listings differ by—

Strongest claimconfirmed

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

exploitedSep 18, 2026vulnerability.circl.lu/known-exploited-vulnerabilities-catal
published proof of conceptApr 10, 2026Telegram/azLV8BVN7oG3TROgln-jCTMw5r1pt6lKfNlckhfBfrofK-k
seenApr 17, 2026bsky.app/profile/beikokucyber.bsky.social/post/3mjpt4c54pr2p
seenApr 10, 2026bsky.app/profile/cve.skyfleet.blue/post/3mj6ev3mnrn2o
confirmedApr 17, 2026github.com/projectdiscovery/nuclei-templates/tree/main/http/

5 public reports collected from VulnCheck and CIRCL, first on Apr 10, 2026. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2026-40242

CVE-2026-40242Oct 4, 2026high

getarcane arcane SSRF Flaw Added to VulnCheck KEV

CVE-2026-40242, a Server-Side Request Forgery in getarcane arcane, was added to the VulnCheck KEV catalogue on September 17, 2026. It has been publicly exploited since April 10, 2026.