VulnSocial

CVE-2026-40677Patch

LOWCVSS 7.7 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leading to arbitrary code execution.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 11 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 10 signals
  • Technical details provided in 9 signals
  • General: 2 classified signals
  • Disclosure: 1 classified signal
  • Peaked 3d ago at 4 mentions (2026-06-10); latest day: 1
  • 11 total mentions across 5 days

Deep dive

Activity timeline11 mentions / 5d
01234Mentions · 2026-06-09: 2Mentions · 2026-06-10: 4Mentions · 2026-06-11: 1Mentions · 2026-06-12: 3Mentions · 2026-06-16: 1PoC Mentioned / Linked · 2026-06-16: 1Patch / Workaround · 2026-06-09: 2Patch / Workaround · 2026-06-10: 4Patch / Workaround · 2026-06-11: 1Patch / Workaround · 2026-06-12: 3Technical Details · 2026-06-09: 2Technical Details · 2026-06-10: 3Technical Details · 2026-06-11: 1Technical Details · 2026-06-12: 306-0906-1006-1106-1206-16
Signal classification3 categories
Patch
872.7%
General
218.2%
Disclosure
19.1%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-092
Patch2
2026-06-104
Patch4
2026-06-111
Disclosure1
2026-06-123
General1Patch2
2026-06-161
General1
Full discourse11 posts
  • Daily CyberSecurity@the_yellow_fall
    General

    Researcher MrBruh found CVE-2026-40677 in AMD's update utility, reported it properly, and was denied a $10,000 bounty after AMD changed its own rules. CVE-2026-40677 AMD #CVE202640677 #AMD #BugBounty #MrBruh #Cybersecurity https://meterpreter.org/cve-2026-40677-amd-bug-bounty-dispute https://t.co/Hd15xQfBRZ

    Post summary

    The tweet reports a bug bounty dispute over CVE‑2026‑40677, highlighting that the researcher was denied a $10,000 bounty after AMD altered its award rules, with no exploitation or technical details provided.

    12050472
    12.8K followersView on X
  • geek@akibablog@akibablog
    Disclosure

    AMD Ryzen Masterなどに脆弱性CVE-2026-40677。任意のコード実行の恐れ。アップデートを | ニッチなPCゲーマーの環境構築Z https://www.nichepcgamer.com/archives/amd-ryzen-master-vulnerability-cve-2026-40677.html インストール時に同梱されるAMD Auto Updaterアプリケーション

    Post summary

    The post reports the discovery of CVE‑2026‑40677 affecting AMD Ryzen Master and Auto Updater, highlights a risk of arbitrary code execution, and urges users to apply an update.

    030002.4K
    85.0K followersView on X
  • JAPAH@japahttv
    Patch

    AMD corrigiu falha crítica após 124 dias, mas negou US$ 10 mil ao pesquisador MrBruh. Vulnerabilidade CVE-2026-40677 permitia execução remota. Fonte: MrBruh, TechSpot e AMD. https://t.co/9CJATNFgi6

    Post summary

    AMD issued a patch for CVE-2026-40677 after 124 days; the vulnerability allowed remote execution, but no PoC, exploit, or active exploitation reports are mentioned.

    0101025
    1.1K followersView on X
  • CyberX@CyberXlx9q
    General

    ‼️AMD fixed a critical auto-updater vulnerability that could have enabled remote code execution via a man-in-the-middle attack—but reportedly denied the researcher a $10,000 bug bounty after a 124-day remediation process. The flaw was serious enough to receive CVE-2026-40677 and a CVSS score of 7.7, yet the report was allegedly deemed “out of scope” under AMD’s bounty rules. A reminder that bug bounty programs aren’t just about payouts—they’re about incentivizing responsible disclosure and strengthening trust between vendors and researchers. 💭 If a vulnerability gets patched, assigned a CVE, and publicly acknowledged, should the researcher be rewarded regardless of scope technicalities? https://www.tomshardware.com/tech-industry/cyber-security/amd-denies-researcher-a-usd10-000-bug-bounty-after-fixing-critical-auto-updater-vulnerability-security-flaw-took-124-days-to-patch #CyberSecurity #BugBounty #AMD #VulnerabilityDisclosure #Infosec

    Post summary

    AMD patched a critical auto‑updater flaw (CVE‑2026‑40677, CVSS 7.7) and denied the researcher a $10,000 bounty after a 124‑day remediation, underscoring questions about scope rules in bug‑bounty programs.

    00010127
    151 followersView on X
  • nal.@nal_NikAkh
    Patch

    AMDユーザさんはお気をつけて。 AMD Ryzen Masterなどに脆弱性CVE-2026-40677。任意のコード実行の恐れ。アップデートを https://www.nichepcgamer.com/archives/amd-ryzen-master-vulnerability-cve-2026-40677.html

    Post summary

    AMD Ryzen Master users are cautioned about CVE-2026-40677, an arbitrary code execution vulnerability, with an update recommended.

    0001096
    50 followersView on X
  • ThreatCluster@threatcluster
    Patch

    AMD fixed remote code execution flaw CVE-2026-40677 in its AMD Auto Updater that allowed man-in-the-middle installation of malicious executables after a 124-day disclosure process, according to an AMD security bulletin and researcher MrBruh. https://threatcluster.io/cluster/amd-denies-bounty-for-critical-vulnerability-after-long-dela-8d28fb6e

    Post summary

    The report confirms AMD released a patch for CVE‑2026‑40677, a remote code execution flaw in its Auto Updater that permitted man‑in‑the‑middle attacks.

    0000055
    330 followersView on X
  • セキュリティ・トレンド bot だった@sec_trend
    Patch

    AMD Ryzen Masterなどに脆弱性CVE-2026-40677。任意のコード実行の恐れ。アップデートを https://www.nichepcgamer.com/archives/amd-ryzen-master-vulnerability-cve-2026-40677.html #izumino_trend

    Post summary

    AMD Ryzen Master vulnerability CVE-2026-40677 could allow arbitrary code execution; users are urged to apply the update.

    0000074
    2.0K followersView on X
  • yamadatarou@orenikkinanona
    Patch

    AMD Ryzen Masterなどに脆弱性CVE-2026-40677。任意のコード実行の恐れ。アップデートを | ニッチなPCゲーマーの環境構築Z https://www.nichepcgamer.com/archives/amd-ryzen-master-vulnerability-cve-2026-40677.html

    Post summary

    The article highlights a vulnerability (CVE‑2026‑40677) in AMD Ryzen Master that could allow arbitrary code execution, and it urges users to apply an update to mitigate the risk.

    0000050
    802 followersView on X
  • ohhara_P🧐Slow life in the isekai@ohhara_shiojiri
    Patch

    AMD Ryzen Masterなどに脆弱性CVE-2026-40677。任意のコード実行の恐れ。アップデートを | ニッチなPCゲーマーの環境構築Z https://www.nichepcgamer.com/archives/amd-ryzen-master-vulnerability-cve-2026-40677.html

    Post summary

    The article warns of a CVE‑2026‑40677 vulnerability in AMD Ryzen Master that could allow arbitrary code execution, and advises users to install the vendor’s update to mitigate the risk.

    0000071
    2.0K followersView on X
  • しーにゃ♪@公式@Syynya
    Patch

    AMD Ryzen Masterなどに脆弱性CVE-2026-40677。任意のコード実行の恐れ。アップデートを | ニッチなPCゲーマーの環境構築Z https://www.nichepcgamer.com/archives/amd-ryzen-master-vulnerability-cve-2026-40677.html 『影響を受けるアプリケーションは『AMD Ryzen Master』、『AMD Management Console』(AMC)、『AMD µProf』の3種類』

    Post summary

    The post alerts about CVE‑2026‑40677 in AMD Ryzen Master and related apps, warns of arbitrary code execution risk, and urges users to apply the available update.

    0000052
    909 followersView on X
  • Kujikujira@midvilkujira
    Patch

    AMD Ryzen Masterなどに脆弱性CVE-2026-40677。任意のコード実行の恐れ。アップデートを | ニッチなPCゲーマーの環境構築Z https://www.nichepcgamer.com/archives/amd-ryzen-master-vulnerability-cve-2026-40677.html

    Post summary

    The post highlights CVE-2026-40677 affecting AMD Ryzen Master, notes the risk of arbitrary code execution, and advises users to apply the available update.

    0000057
    142 followersView on X

Explore more

Back to dashboard