cve recordexploit reported

CVE-2026-66066

CVSS—

Severitynone

Weakness—

EPSS27.9%98.1th percentile

Exploited1 KEV source

patch window

Called exploited 26 days after disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

CVE publishedJul 30, 2026
First KEV listingAug 25, 202626d
Last sightingSep 3, 20269d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Uniondoes not list it
VulnCheck KEVcommercial researchlisted Aug 25, 2026
CIRCLaggregator, mirrors the abovedoes not list it

Sources1 of 3

Listings differ by—

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

reported exploitationSep 3, 2026www.trellix.com/blogs/research/the-bug-report-august-2026-ed
reported exploitationAug 31, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-6
reported exploitationAug 25, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-6

3 public reports collected from VulnCheck and CIRCL, first on Aug 25, 2026. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2026-66066

CVE-2026-66066Aug 3, 2026critical

KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)

A critical vulnerability, designated CVE-2026-66066 and nicknamed "KindaRails2Shell," has been identified in Ruby on Rails (Rails), a widely used framework for web applications. The flaw could allow unauthenticated attackers to read arbitrary files from a server and, in some configurations, achieve full remote code execution.