VulnSocial

CVE-2023-28432Active Exploitation(minio / minio)

LOWCVSS 7.5 · HIGHCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for minio minio systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

minio CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2023-05-12. Apply updates per vendor instructions.

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • minio

Threat summary

  • Active exploitation appears in 1 classified signals
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 1 signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-02-20); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
minio
Products
minio

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-02-20: 1Mentions · 2026-03-02: 1Active Exploitation · 2026-02-20: 1Technical Details · 2026-03-02: 102-2003-02
Signal classification2 categories
Active Exploitation
150.0%
General
150.0%
Classification over time
DateTotalLabels
2026-02-201
Active Exploitation1
2026-03-021
General1
Full discourse2 posts
  • International Cyber Digest@IntCyberDigest
    Active Exploitation

    ‼️ One of the world's largest oral-care companies, Straumann Group ($20B), has been breached by Bytetobreach via CVE-2023-28432. Nearly all sensitive data was exposed in an unsecured MinIO instance on AWS, including: - Cybersecurity audits and docs 😶 - Customer data - Employee records (wages, contracts, etc.) - Internal confidential documents and emails

    Post summary

    Straumann Group was breached via CVE-2023-28432, with sensitive data exposed in an unsecured MinIO instance on AWS.

    84622937520.0K
    88.5K followersView on X
  • Audn AI@audn_ai
    General

    🛡️ PenTest tip: explore CVE-2023-28432 – Linux kernel memory corruption issue. Use it as a sandbox exercise to sharpen your exploit‑development skills. #PenTesting #CVE CVE-2023-28432 (ref:1772485332681) 😃 I love digging into real‑world exploits!

    Post summary

    The tweet advises pentesters to explore CVE‑2023‑28432 as a sandbox exercise, noting it is a Linux kernel memory corruption vulnerability, but offers no PoC, exploit code, patch, or active exploitation details.

    000001
    12 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appminiominio---

Explore more

Back to dashboardminio CVEsminio vulnerabilities