cve recordzero dayexploit reported

CVE-2026-51990

CVSS—

Severitynone

Weakness—

EPSS0.93%60.4th percentile

Exploited1 KEV source

patch window

Called exploited 6 days before disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

CVE reservedJun 8, 2026
CVE publishedSep 16, 20263mo
First KEV listingSep 10, 20266d
Last sightingSep 10, 2026same day

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Uniondoes not list it
VulnCheck KEVcommercial researchlisted Sep 10, 2026
CIRCLaggregator, mirrors the abovelisted Sep 14, 2026, not counted

Sources1 of 3

Listings differ by—

Strongest claimconfirmed

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

reported exploitationSep 10, 2026www.gendigital.com/blog/insights/research/one-click-backdoor

1 public report collected from VulnCheck and CIRCL, first on Sep 10, 2026. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2026-51990

CVE-2026-51990Sep 13, 2026critical

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Threat actors identified as UNC3569, a group suspected of operating on behalf of China, have been observed actively exploiting a critical vulnerability in Tencent's Sogou Input Method for Windows. The flaw, tracked as CVE-2026-51990, is a one-click remote code execution (RCE) vulnerability that allows attackers to deploy the GrayRabbit backdoor.