CVE-2026-48027Active Exploitation(nx / nx_console)

MEDIUMCVSS 9.8 · CRITICALCISA KEV

Exploitation observed; activity peaked at 10 mentions and remains active

Immediate actions

Patch nx nx_console systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

nx CVEs Back to dashboard

5.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-06-10. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references

https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-506

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

nx_console

Threat summary

Active exploitation appears in 15 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
19 mentions across 6 observed days

What's happening

Active exploitation reported across 15 signals
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 5 signals
Technical details provided in 5 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 4d ago at 10 mentions (2026-05-28); latest day: 1
19 total mentions across 6 days

Affected systems

Vendors

Products

nx_console

1 version affected across 1 product

Deep dive

Activity timeline19 mentions / 6d

Signal classification3 categories

Active Exploitation

1578.9%

Disclosure

210.5%

General

210.5%

Referenced assets23 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-27	4	Active Exploitation3Disclosure1
2026-05-28	10	Active Exploitation8Disclosure1General1
2026-05-29	1	Active Exploitation1
2026-05-30	1	General1
2026-06-10	2	Active Exploitation2
2026-06-15	1	Active Exploitation1

Full discourse19 posts

CISA Cyber@CISACyber136d
General
🚨 Supply chain compromises are impacting developer environments, targeting GitHub & Nx Console. See our Alert for detection and remediation recommendations & our KEV Catalog for info on Nx Console embedded malicious code vulnerability CVE-2026-48027. 🔗 https://go.dhs.gov/559 https://t.co/qGoCPPaGX5
Post summary
The tweet highlights a supply chain compromise involving CVE-2026-48027, offering detection and remediation guidance but lacking detailed technical, exploit, or patch information.
435570199.5K
300.1K followersView on X
CISA Cyber@CISACyber137d
Active Exploitation
🛡️ We added Daemon Tools Lite embedded malicious code vulnerability CVE-2026-8398, TanStack vulnerability CVE-2026-45321 & Nx Console vulnerability CVE-2026-48027 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q for more information. #Cybersecurity #InfoSec https://t.co/Sk7r1825lX
Post summary
The DHS KEV Catalog now includes CVE-2026-8398, CVE-2026-45321, and CVE-2026-48027, confirming these vulnerabilities are actively exploited.
32114977.5K
300.1K followersView on X
kokumօtօ@__kokumoto136d
Disclosure
Nx Console及びGitHubリポジトリに影響するサプライチェーン侵害について、米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が警告。CVE-2026-48027。Nx開発者のシステム侵害を侵害し、毒入れしたサードパーティーVS Code拡張機能からGitHub従業員の機器を侵害。 https://www.cisa.gov/news-events/alerts/2026/05/28/supply-chain-compromises-impact-nx-console-and-github-repositories
Post summary
CISA issued a warning about CVE‑2026‑48027, a supply‑chain compromise affecting Nx Console and GitHub via a malicious VS Code extension, but no PoC, exploit details, or patch information are provided.
111522.5K
7.6K followersView on X
piyokango@piyokango137d
Active Exploitation
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（5/27追加） 🛡No.1605 CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability =================================== ✅概要・深刻度：緊急 9.8 (CVSS Base) / NVD ・種別：埋め込まれた悪意のあるコード (CWE-506) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Nx Console 18.95.0 の悪意あるバージョンが一次公開されていた脆弱性。2026年5月19日 12:30 UTC に Visual Studio Marketplace へ公開され、12:48 UTC に削除されるまで約18分間利用可能となっていたもの。さらにOpenVSX では 12:33 UTC から 13:09 UTC まで約36分間、侵害されたバージョンが利用可能となっていたもの。 ✅ChatGPTによる脆弱性評価・国内影響度：中・悪用難易度：低 ✅攻撃前提条件・Nx Console 18.95.0 が Visual Studio Marketplace または OpenVSX からインストールされる・VS Code またはその派生環境で拡張機能が有効化される・対象端末に GitHub、npm、AWS、Vault、1Password、SSH 鍵などの認証情報が存在する ✅悪用時影響・認証情報の窃取・永続化アーティファクトの作成・外部へのデータ送信・侵害された認証情報を利用した追加のリポジトリ操作やサプライチェーン侵害 ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-48027 ・https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w ・https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise ・https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised 🛡No.1606 CVE-2026-45321 TanStack Unspecified Vulnerability =================================== ✅概要・深刻度：緊急 9.6 (CVSS Base) / GitHub, Inc. (CNA) ・種別：埋め込まれた悪意のあるコード (CWE-506) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H 2026年5月11日 19:20 から 19:26 UTC 頃に、42件の @ tanstack/* パッケージにわたり 84件の悪意あるバージョンが npm レジストリへ公開されていたもの。公開は TanStack/router 向けの正規 GitHub Actions OIDC trusted-publisher binding により認証されていたが、公開ワークフロー自体は変更されていなかった。 ✅ChatGPTによる脆弱性評価・国内影響度：中・悪用難易度：中 ✅攻撃前提条件・影響を受けた @ tanstack/* パッケージの悪意あるバージョンを npm、pnpm、yarn などでインストールする・インストール処理により悪意ある payload が実行される・対象環境にクラウド認証情報、GitHub トークン、SSH 鍵などが存在する ✅悪用時影響・クラウド認証情報、GitHub トークン、SSH 鍵などの窃取・窃取情報の外部送信・被害者が管理する npm パッケージへの同様の注入・サプライチェーン侵害の拡大 ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（TanStack / GitHub, Inc.） 42件の @ tanstack/* パッケージに 84件の悪意あるバージョンが公開され、認証情報窃取マルウェアが正規の trusted-publisher 経路で配布されたと報告。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-45321 ・https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ・https://tanstack.com/blog/npm-supply-chain-compromise-postmortem ・https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem 🛡No.1607 CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability ==================================== ✅概要・深刻度：緊急 9.3 (CVSS Base) / Kaspersky Labs (CNA) ・種別：埋め込まれた悪意のあるコード (CWE-506) ・CVSS:CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N DAEMON Tools Lite の Windows 版 12.5.0.2421 から 12.5.0.2434 の公式インストールパッケージが侵害され、2026年4月8日頃から2026年5月5日頃まで正規サイト daemon-tools .cc から配布された。攻撃者は AVB Disc Soft のビルドまたは配布基盤に不正アクセスし、DTHelper.exe、DiscSoftBusServiceLite.exe、DTShellHlp.exe をトロイの木馬化したもの。 ✅ChatGPTによる脆弱性評価・国内影響度：中・悪用難易度：低 ✅攻撃前提条件・影響期間中に DAEMON Tools Lite の該当 Windows 版を公式サイトからダウンロードまたはインストールしている・トロイの木馬化されたバイナリが起動される・対象は DAEMON Tools Lite 12.5.0.2421 から 12.5.0.2434 である ✅悪用時影響・端末情報の収集・追加ペイロードのダウンロードおよび実行・バックドアによる不正操作・機密情報の漏えい ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（Kaspersky） Kaspersky LabsはDAEMON Tools Lite の公式インストールパッケージがサプライチェーン攻撃により侵害され、正規署名付きのトロイの木馬化バイナリが配布されたと報告。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-8398 ・https://blog.daemon-tools.cc/post/security-incident ・https://securelist.com/tr/daemon-tools-backdoor/119654/ https://www.cisa.gov/news-events/alerts/2026/05/27/cisa-adds-three-known-exploited-vulnerabilities-catalog #vulnerability
Post summary
The alert confirms that three critical vulnerabilities—CVE‑2026‑48027, CVE‑2026‑45321, and CVE‑2026‑8398—have been actively exploited in the wild, with partial PoC information released but no full exploit code available.
030524.9K
43.9K followersView on X
CCB Alert@CCBalert136d
Active Exploitation
Warning: #CISA added new vulnerabilities to its KEV list: CVE-2026-48027 in #Nx Console, CVE-2026-8398 in #Daemon Tools Lite and CVE-2026-45321 in #Tanstack. Make sure you are running the non-malicious version of the packages to avoid a supply chain attack. #Patch #Patch #Patch
Post summary
CISA has flagged CVE-2026-48027, CVE-2026-8398, and CVE-2026-45321 as known to be exploited in the wild; users are urged to use clean package versions and apply available patches.
02011314
7.2K followersView on X
University of ZERO@zerotalktoai137d
Disclosure
CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability CVE-2026-45321 TanStack Unspecified Vulnerability CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability
Post summary
The text merely lists three CVE identifiers with brief descriptors, indicating disclosure but providing no PoC, exploit, patch, or active exploitation details.
00020152
1.6K followersView on X
Lyrie.ai@lyrie_ai124d
Active Exploitation
00:00 UTC: CVE-2026-48027 disclosed. CISA: CVE-2026-48027 added to Known Exploited Vulnerabilities — Nx Nx Console Status: ✅ Confirmed exploited in the wild Date added: 2026-05-27 Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01…
Post summary
CISA confirms CVE-2026-48027 is being actively exploited in the wild and urges applying vendor mitigations.
1000042
258 followersView on X
Atarus@Atarussecurity135d
Active Exploitation
CISA added three actively exploited supply chain vulnerabilities to the KEV catalog this week. CVE-2026-8398 affects Daemon Tools Lite, where attackers shipped trojanized signed installers from the vendor's own website for nearly a month. CVE-2026-45321 affects TanStack, where 42 npm packages were compromised via GitHub Actions trusted-publisher abuse, cache poisoning, pull_request_target misconfiguration, and OIDC token theft from runner memory. CVE-2026-48027 affects Nx Console v18.95.0, the same VS Code extension that gave attackers access to GitHub's internal repositories last week. The exposure windows tell the story. Nx Console was live for 36 minutes. TanStack was live for 6 minutes. Daemon Tools was live for 27 days. Three layers of the developer-tooling stack, three different defender visibility levels, all confirmed exploited. Then on May 28, CISA issued a separate formal alert about Megalodon, a campaign injecting malicious GitHub Actions workflows into public repositories. The attack moves further upstream into the automation layer that decides what becomes trusted. Federal remediation deadline is June 17, accelerated to May 30 for Daemon Tools. Verizon DBIR put commercial median time-to-patch at 43 days. The gap between federal and commercial response is where breaches happen. The methodology Atarus has been tracking for six weeks is now the federal patching priority. Full analysis from Atarus Research: https://www.atarussecurity.com/post/cisa-added-three-supply-chain-cves-to-kev-including-the-nx-console-that-compromised-github-the-meth
Post summary
CISA reports three supply‑chain CVEs that are actively exploited in the wild, with attacker tactics ranging from trojanized installers to GitHub Actions abuse, and includes remediation deadlines hinting at available patches.
0000181
19 followersView on X
Mr.M@cybermrm136d
Active Exploitation
CISA agregó CVE-2026-48027 a KEV el 27 de mayo. Eso cambia la prioridad: ya no es “revisemos extensiones cuando haya tiempo”, es asumir que el IDE puede haber sido una pista de entrada a credenciales de producción.
Post summary
CISA listed CVE‑2026‑48027 on the KEV, elevating its priority and implying that the IDE could be a vector for production credential compromise, indicating active exploitation concern.
1000046
9 followersView on X
波乗野郎@shojiueda137d
Active Exploitation
TanStack CVE-2026-45321、Nx Console CVE-2026-48027 に対するサプライチェーン攻撃に対してKEV指定されています。
Post summary
The statement confirms that TanStack CVE‑2026‑45321 and Nx Console CVE‑2026‑48027 are listed on the KEV, indicating they are actively exploited in the wild, but it does not provide PoC, exploit code, patch details, or technical vulnerability specifics.
00010275
1.7K followersView on X
Orizon@OrizonCyber137d
Active Exploitation
🚨 CVE-2026-48027 — CVSS 9.8/10 ██████████ Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/jbJNZQ88lG
Post summary
A malicious release of Nx Console 18.95.0 exploited CVE‑2026‑48027, a critical vulnerability (CVSS 9.8). A patch is available and should be applied immediately.
10000107
43 followersView on X
John McClure@johnmcclure00118d
Active Exploitation
CISA: two active supply chain campaigns. Nx Console CVE-2026-48027 (KEV) auto-pushed to devs, pivoted into GitHub internally. "Megalodon" harvested CI/CD secrets via GitHub Actions. Rotate all pipeline secrets. Now. #Cybersecurity #InfoSec https://ift.tt/KX7PAEp https://t.co/ZpH6vfSjO5
Post summary
The tweet reports that CVE‑2026‑48027 is being actively exploited in two supply chain campaigns, with the tool "Megalodon" harvesting CI/CD secrets; users are urged to rotate pipeline secrets.
0000040
952 followersView on X
Lyrie.ai@lyrie_ai124d
Active Exploitation
https://lyrie.ai/research/research/active-exploit-cve-2026-48027-nx-console #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The tweet links to research claiming CVE‑2026‑48027 is being actively exploited as a zero‑day on NX Console, but it does not provide patch, technical details, or PoC code.
0000027
258 followersView on X
IntegSec@integ_sec134d
General
CVE-2026-48027: Nx Console Supply-Chain Compromise - What It Means for Your Business and How to Respond https://hubs.li/Q04jtkkm0
Post summary
The provided text consists only of a title and a link, offering no concrete evidence of exploitation, patches, or detailed technical information about CVE-2026-48027.
0000038
32 followersView on X
SecAlerts@SecAlertsCo136d
Active Exploitation
⚠️ CVE-2026-48027: Nx Console v18.95.0 was a supply chain attack. A malicious build fetched obfuscated payloads to harvest data. CVSS 9.3, KEV-listed, actively exploited. Remove it now. https://secalerts.co/vulnerability/CVE-2026-48027 https://t.co/WpMy7Y2oPC
Post summary
The tweet reports that CVE-2026-48027 is actively exploited as a supply‑chain attack against Nx Console v18.95.0, advising immediate removal and noting a CVSS score of 9.3.
0000086
826 followersView on X
RedLegg@RedLegg136d
Active Exploitation
CVE-2026-48027 - Critical Supply Chain Alert: Nx Console (VS Code) version 18.95.0 was compromised and is actively exploited (CISA KEV). Malicious code was distributed via official marketplaces in a short attack window. #ThreatIntel #NXConsole https://hubs.li/Q04jdSHw0
Post summary
The alert confirms that CVE‑2026‑48027 is actively exploited in the wild, with malicious code distributed through official marketplaces and a CISA KEV designation.
0000074
2.2K followersView on X
ByteSec1401 Efshagari@Leila97726926136d
Active Exploitation
Three CVEs have been added to the list of known exploits; CVE-2026-45321 (TanStack), CVE-2026-48027 (Nx Console) and CVE-2026-8398 (DAEMON Tools Lite). The trio has been linked to an attack campaign named "Mini Shai-Hulud" and has been attributed to cybercriminal group 'TeamPCP'. The campaign targeted Github, where the vulnerabilities enabled attackers to maneuver in CI/CD pipelines to extract proprietary source code depots. This would then cause supply chain issues to millions of end users. #TeamPCP #Github #cybercriminal https://ayinedjimi-consultants.fr/cve/mini-shai-hulud-supply-chain-npm-github-kev
Post summary
The post announces that CVE-2026-45321, CVE-2026-48027, and CVE-2026-8398 are being actively exploited in the "Mini Shai-Hulud" campaign targeting GitHub CI/CD pipelines to exfiltrate source code, highlighting a serious supply‑chain threat.
00000102
320 followersView on X
VulDB 🛡@vuldb137d
Active Exploitation
A lot of offensive activities were identified targeting nrwl nx-console (CVE-2026-48027) https://vuldb.com/vuln/366456/cti
Post summary
The statement alerts that offensive activities targeting nrwl nx-console (CVE-2026-48027) have been identified, implying active exploitation, but does not provide PoC, exploit code, patch info, or technical details.
0000099
2.2K followersView on X
キタきつね@foxbook137d
Active Exploitation
CISAが既知の悪用された脆弱性3件をカタログに追加 CISA Adds Three Known Exploited Vulnerabilities to Catalog #CISA (May 27) CVE-2026-8398 Daemon Tools Lite Embedded の悪意のあるコードの脆弱性 CVE-2026-45321 TanStackの特定されていない脆弱性 CVE-2026-48027 Nx Console組み込み型悪意のあるコードの脆弱性 https://www.cisa.gov/news-events/alerts/2026/05/27/cisa-adds-three-known-exploited-vulnerabilities-catalog
Post summary
CISA added three known exploited vulnerabilities to its catalog, indicating active exploitation in the wild, but no specific exploit tools or patches are referenced in the announcement.
00000252
4.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nx	nx_console	18.95.0	visual_studio_code	-

Explore more

Back to dashboard nx CVEs nx_console vulnerabilities

What researchers are saying

CVE-2026-48027

kokumօtօ[verified]@__kokumotoDisclosure

CISA issued a warning about CVE‑2026‑48027, a supply‑chain compromise affecting Nx Console and GitHub via a malicious VS Code extension, but no PoC, exploit details, or patch information are provided.

piyokango[verified]@piyokangoActive Exploitation

The alert confirms that three critical vulnerabilities—CVE‑2026‑48027, CVE‑2026‑45321, and CVE‑2026‑8398—have been actively exploited in the wild, with partial PoC information released but no full exploit code available.

University of ZERO[verified]@zerotalktoaiDisclosure

The text merely lists three CVE identifiers with brief descriptors, indicating disclosure but providing no PoC, exploit, patch, or active exploitation details.

Lyrie.ai[verified]@lyrie_aiActive Exploitation

CISA confirms CVE-2026-48027 is being actively exploited in the wild and urges applying vendor mitigations.

Atarus[verified]@AtarussecurityActive Exploitation

CISA reports three supply‑chain CVEs that are actively exploited in the wild, with attacker tactics ranging from trojanized installers to GitHub Actions abuse, and includes remediation deadlines hinting at available patches.

Mr.M[verified]@cybermrmActive Exploitation

CISA listed CVE‑2026‑48027 on the KEV, elevating its priority and implying that the IDE could be a vector for production credential compromise, indicating active exploitation concern.

波乗野郎[verified]@shojiuedaActive Exploitation

The statement confirms that TanStack CVE‑2026‑45321 and Nx Console CVE‑2026‑48027 are listed on the KEV, indicating they are actively exploited in the wild, but it does not provide PoC, exploit code, patch details, or technical vulnerability specifics.

Orizon[verified]@OrizonCyberActive Exploitation

A malicious release of Nx Console 18.95.0 exploited CVE‑2026‑48027, a critical vulnerability (CVSS 9.8). A patch is available and should be applied immediately.