VulnSocial

CVE-2026-46488Disclosure

MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

Back to dashboard
4.0/ 10 priority

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-06-23); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-23: 2Mentions · 2026-09-15: 1Active Exploitation · 2026-09-15: 1Patch / Workaround · 2026-06-23: 1Technical Details · 2026-06-23: 206-2309-15
Signal classification3 categories
Disclosure
133.3%
Patch
133.3%
Active Exploitation
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-232
Disclosure1Patch1
2026-09-151
Active Exploitation1
Full discourse3 posts
  • Aretiq.AI@AretiqAI
    Active Exploitation

    ARETIQ Daily Vulnerability Bulletin — September 15, 2026 🔴 CRITICAL: CVE-2026-59971 (designcomputer/mysql_mcp_server) AAS 13.8 🔴 CRITICAL: CVE-2026-46488 (motioneye-project/motioneye) AAS 13.3 — exploited ITW (X/Twitter signals) 31 vulnerabilities — CRITICAL: 2, HIGH: 29 Full bulletin: https://aretiq.ai/bulletins/2026-09-15/

    Post summary

    The bulletin flags two critical CVEs, notably reporting that CVE-2026-46488 is actively exploited in the wild based on Twitter signals.

    0002069
    231 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 motionEye, Partial Authentication Bypass / Path Traversal, #CVE-2026-31978, #CVE-2026-32315, #CVE-2026-46488 (Critical) -DC-Jun2026-600 https://dailycve.com/motioneye-partial-authentication-bypass-path-traversal-cve-2026-31978-cve-2026-32315-cve-2026-46488-critical-dc-jun2026-600/

    Post summary

    The tweet announces newly identified critical CVEs for motionEye involving partial authentication bypass and path traversal, but no proof of concept, exploit, or patches are referenced.

    0000034
    216 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨Critical - motionEye Authentication Bypass via Password-Hash Cookie (CVE-2026-46488) motionEye trusts client-controlled cookies (meye_username and meye_password_hash) as sufficient authentication material, with no server-side session validation. An attacker who knows a target's username and password-hash value can set or modify these cookies - manually via browser dev tools, or by submitting blank credentials to load them - and impersonate that user, bypassing the login flow entirely. Worse, the admin username and hash live in /etc/motioneye/motion.conf, which is globally readable by default, so any local user with shell access can grab a valid admin hash and take over the admin account. Impact includes account lockout, persistence via password change, and data theft or destruction. 👉Upgrade to motionEye 0.44.0.

    Post summary

    The post discloses a credential bypass flaw in motionEye, provides technical details, and urges users to upgrade to version 0.44.0.

    0000070
    226 followersView on X

Explore more

Back to dashboard