Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can exploit malicious __reduce__ methods embedded in crafted pickle payloads to execute arbitrary shell commands as the server process.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-20 | 1 | Patch1 |
| 2026-07-21 | 3 | Disclosure3 |
🚨 CVE-2026-63767 — CVSS 9.8/10 ██████████ ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/9wKxdV6sf4
Post summary
The tweet announces a critical CVE-2026-63767 affecting ktransformers, highlights the unauthenticated pickle deserialization flaw, and confirms that a patch has been released (commit def0f93).
🚨 ktransformers Pickle Deserialization RCE — CVSS 9.8 CVE-2026-63767: Unauthenticated RCE via ZMQ socket + pickle.loads(). Affects ≤ 0.6.3. Public PoC available. Fix: commit def0f93 (loopback binding). → http://threataft.com/articles/ktransformers-cve-2026-63767-pickle-rce #cybersecurity #infosec #AI #ML #Python
Post summary
A new CVE-2026-63767 affecting ktransformers was disclosed, with a publicly available PoC demonstrating unauthenticated RCE, and a patch commit def0f93 is already available.
#CVE-2026-63767 - Critical RCE in Ktransformers. Unauthenticated pickle deserialization via ZMQ ROUTER socket. #CVSS 9.8. No patch available - immediately isolate affected systems. #CVEAlert #infosec #cybersecurity #devops #sysadmin #devsecops #developer https://www.valtersit.com/cve/CVE-2026-63767/
Post summary
The tweet announces CVE‑2026‑63767 as a critical RCE vulnerability in Ktransformers, notes there is no patch available, and urges isolation of affected systems.
「脆弱性対応ウォッチ」を更新し、Criticalな脆弱性「CVE-2026-63767」について情報を掲載しました。ktransformersにおける未認証pickle RCEの危険性に関する詳細です。該当システムをお使いの方は、早めの対応をご検討ください。 https://cve.autoarticles.net/cve/CVE-2026-63767
Post summary
The post announces a new vulnerability (CVE‑2026‑63767) with technical details and urges users to remedy it, but offers no PoC, exploit code, patch, or evidence of active exploitation.