CVE-2026-3490Disclosure

LOW

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

1.5/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-18); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-18: 1Mentions · 2026-06-26: 1PoC Mentioned / Linked · 2026-06-26: 1Technical Details · 2026-06-18: 106-1806-26
Signal classification2 categories
Disclosure
150.0%
PoC
150.0%
Referenced assets1 URL
Classification over time
DateTotalLabels
2026-06-181
Disclosure1
2026-06-261
PoC1
Full discourse2 posts
  • Kaitan ID Security@KaitanSecurity
    PoC

    🎯 picklescan Blocklist Bypass Earns a Perfect 10 — and Has a Proof of Concept CVE-2026-3490 is the most operationally dangerous vulnerability this week. picklescan, the widely-used Python tool for detecting malicious pickle files in ML pipelines, fails to…

    Post summary

    The post announces CVE-2026-3490 in picklescan, indicating a Proof of Concept exists, but it provides no exploit details, active exploitation claims, patch information, or deeper technical specifics.

    1000029
    82 followersView on X
  • ThreatAft@ThreatAft
    Disclosure

    🔐 🚨 CRITICAL: Picklescan Double Bypass — AI/ML Supply Chain at Risk CVE-2026-3490 (CVSS 10.0) + CVE-2026-53874 (CVSS 9.8) Universal blocklist bypass via pkgutil.resolve_name. 🔗 https://threataft.com/articles/cve-2026-3490-cve-2026-53874-picklescan-double-bypass-ai-supply-chain #CyberSecurity #ThreatIntel #infosec #AISecurity #ML

    Post summary

    The post announces two critical CVEs (CVE-2026-3490, CVE-2026-53874) with high CVSS scores, explains a blocklist bypass technique via pkgutil.resolve_name, but provides no PoC, exploit code, or mitigation details.

    0000071
    31 followersView on X

Explore more