CVE-2026-52751Exploit(nsa / ghidra)

LOWCVSS 8.6 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for nsa ghidra systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File → Open Project, deserializes untrusted objects using a Jython 2.7.4 gadget chain to execute arbitrary commands.

nsa CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/NationalSecurityAgency/ghidra/commit/91a269103fe5d133c14ec3afa60280dccb94be5c

Exploit / PoC references

https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-fgg5-g275-7742

Vendor / third-party advisories

https://www.vulncheck.com/advisories/ghidra-remote-code-execution-via-unfiltered-rmi-deserialization-in-shared-project-connection

Weakness type (CWE)

CWE-502

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ghidra

Threat summary

Public PoC and exploit tooling are both present
9 mentions across 5 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 5 signals
PoC mentioned or linked in 5 signals
Technical details provided in 6 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 2d ago at 4 mentions (2026-07-21); latest day: 1
9 total mentions across 5 days

Affected systems

Vendors

nsa

Products

ghidra

Deep dive

Activity timeline9 mentions / 5d

Signal classification4 categories

Exploit

444.4%

Disclosure

222.2%

General

222.2%

PoC

111.1%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-10	2	Disclosure2
2026-07-02	1	PoC1
2026-07-21	4	Exploit2General2
2026-07-31	1	Exploit1
2026-08-01	1	Exploit1

Full discourse9 posts

YogSotho@YogSoth087d
Exploit
⚠️🚨⚠️🚨⚠️🚨⚠️ #BrokenSec - Ghidra RCE Exploit kit Fully weaponized exploits for **CVE-2026-52751** and **CVE-2026-52750** Based on public research from bikini/exploitarium/ghidra-12.1.2-rce-ace-calc-poc #RCE #security #cybersec #hacking #0days #exploit #antisec #infosec #brokensec #cybernews #ghidra
Post summary
The tweet announces fully weaponized exploits for CVE-2026-52751 and CVE-2026-52750, citing a public repo that presumably contains PoC code, but it does not mention active exploitation, patches, or detailed technical data.
311061294.6K
1.9K followersView on X
YogSotho@YogSoth0116d
PoC
#Ghidra <= 12.1.2 #RCE Exploit Kit Based on public research from `bikini/exploitarium/ghidra-12.1.2-rce-ace-calc-poc` ## 🎯 Vulnerabilities Covered | CVE | Type | Vector | Impact | Platform | |-----|------|--------|--------|----------| | **CVE-2026-52751** | RMI Deserialization RCE | Malicious `.gpr` project with `ghidra://` URL | **CVSS 8.8** — Remote code execution on project open | All (Java) | | **CVE-2026-52750** | Command Injection | Windows `cmd://` URL annotation | **CVSS 7.8** — Local command execution | Windows only | | Swift Demangler | ACE | Malformed Swift symbol | Crash → RCE via LLVM | All | | TraceRMI | Conditional RCE | Malicious trace config | RCE if tracing enabled | All | | SevenZipJBinding | Native Parser | Malformed 7z archive | JNI crash → RCE | All | ## ⚠️ Affected version **Primary target**: Ghidra 12.1.2 (directly confirmed via `ghidra-12.1.2-rce-ace-calc-poc`) **Likely affected**: Ghidra 11.x through 12.x series (anything with the same `DefaultProject.restore()` → `ServerConnectTask` → RMI deserialization chain) #0days #exploit #ghidra #cybersecurity #CVE #CVSS #swift #windows #antisec #infosec #security #vulnerability
Post summary
The post announces publicly available Proof of Concept code for Ghidra RCE vulnerabilities CVE-2026-52751 and CVE-2026-52750, detailing attack vectors and CVSS scores.
0302171.3K
1.9K followersView on X
Lyrie.ai@lyrie_ai97d
General
| CVE | Type | Vector | Impact | Platform | |-----|------|--------|--------|----------| | CVE-2026-52751 | RMI Source: X search for RCE 2026 exploit Posted: 2026-07-02T16:43:06.000Z Likes: 18
Post summary
The post briefly enumerates CVE‑2026‑52751 as an RMI vulnerability with no additional context or actionable information.
1000043
326 followersView on X
Lyrie.ai@lyrie_ai97d
General
Platform vs Type vs Vector vs Impact: **CVE-2026-52751**: **CVE-2026-52751** (vs Type | Vector | Impact ) Source: X search for RCE 2026 exploit Posted: 2026-07-02T16:43:06.000Z Likes: 18
Post summary
The post references CVE‑2026‑52751 with a vague mention of an RCE exploit, but provides no details about proofs of concept, exploitation, patching, or mitigation.
1000045
326 followersView on X
Lyrie.ai@lyrie_ai97d
Exploit
CVE-2026-52751: #Ghidra &lt;= 12.1.2 #RCE Exploit Kit Based on public research from bikini/exploitarium/ghidra-12.1.2-rce-ace-calc-poc 🎯 Vulnerabilities Covered | CVE | Type | Vector | Impact | Platform | |-----|------|--------|--------|----------| | CVE-2026-52751 | RMI…
Post summary
CVE‑2026‑52751 is a Ghidra RMI remote code execution vulnerability, with an exploit kit referencing a public PoC; no active exploitation or patch information is reported.
1000078
326 followersView on X
Lyrie.ai@lyrie_ai97d
Exploit
16:43 UTC: CVE-2026-52751 disclosed. #Ghidra &lt;= 12.1.2 #RCE Exploit Kit Based on public research from `bikini/exploitarium/ghidra-12.1.2-rce-ace-calc-poc
Post summary
CVE-2026-52751, a remote code execution flaw in Ghidra versions up to 12.1.2, has been disclosed with an available PoC and exploit kit, but no active exploitation or patch details were reported.
1000065
326 followersView on X
John smith@Johnsmithwjvmqq86d
Exploit
BrokenSec - Ghidra RCE Exploit kit Fully weaponized exploits for **CVE-2026-52751** and **CVE-2026-52750** Based on public research from bikini/exploitarium/ghidra-12.1.2-rce-ace-calc-poc #RCE #security #cybersec #hacking #0days #exploit #antisec #infosec #brokensec #security
Post summary
BrokenSec announces fully weaponized exploit code for CVE-2026-52751 and CVE-2026-52750, based on a public PoC repository, indicating the availability of functional exploitation tools.
00000120
61 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds138d
Disclosure
CVE-2026-52751 Unsafe Deserialization Remote Code Execution in Ghidra Before 12.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-52751
Post summary
CVE-2026-52751 is a disclosed unsafe‑deserialization remote code execution flaw in Ghidra before 12.1, with no PoC, exploit, or mitigation details provided.
0000033
4.0K followersView on X
CVE@CVEnew138d
Disclosure
CVE-2026-52751 Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code executio… https://www.cve.org/CVERecord?id=CVE-2026-52751
Post summary
The text announces the Ghidra CVE-2026‑52751, detailing its unsafe deserialization flaw that enables unauthenticated RCE, with no mention of PoC, exploit, active usage, patch, or false claims.
00000126
57.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nsa	ghidra	-	-	-

Explore more

Back to dashboard nsa CVEs ghidra vulnerabilities

What researchers are saying

CVE-2026-52751

YogSotho[verified]@YogSoth0Exploit

The tweet announces fully weaponized exploits for CVE-2026-52751 and CVE-2026-52750, citing a public repo that presumably contains PoC code, but it does not mention active exploitation, patches, or detailed technical data.

YogSotho[verified]@YogSoth0PoC

The post announces publicly available Proof of Concept code for Ghidra RCE vulnerabilities CVE-2026-52751 and CVE-2026-52750, detailing attack vectors and CVSS scores.

Lyrie.ai[verified]@lyrie_aiGeneral

The post briefly enumerates CVE‑2026‑52751 as an RMI vulnerability with no additional context or actionable information.

Lyrie.ai[verified]@lyrie_aiGeneral

The post references CVE‑2026‑52751 with a vague mention of an RCE exploit, but provides no details about proofs of concept, exploitation, patching, or mitigation.

Lyrie.ai[verified]@lyrie_aiExploit

CVE‑2026‑52751 is a Ghidra RMI remote code execution vulnerability, with an exploit kit referencing a public PoC; no active exploitation or patch information is reported.

Lyrie.ai[verified]@lyrie_aiExploit

CVE-2026-52751, a remote code execution flaw in Ghidra versions up to 12.1.2, has been disclosed with an available PoC and exploit kit, but no active exploitation or patch details were reported.

John smith@JohnsmithwjvmqqExploit

BrokenSec announces fully weaponized exploit code for CVE-2026-52751 and CVE-2026-52750, based on a public PoC repository, indicating the availability of functional exploitation tools.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

CVE-2026-52751 is a disclosed unsafe‑deserialization remote code execution flaw in Ghidra before 12.1, with no PoC, exploit, or mitigation details provided.