Exploitation ongoing with high activity in latest observed window (3 mentions)
Recommended action window: Immediate (within 24h)
NVD description
A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/delete_model of the file api/src/serge/routers/model.py of the component Model API Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-6588 A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/delete_model of the file api/src/serge/routers/model… https://www.cve.org/CVERecord?id=CVE-2026-6588
Post summary
The text reports a CVE‑2026-6588 weakness affecting Serge‑Chat’s model download/delete functions, but provides no evidence of exploitation, PoC, patch, or detailed technical data.
Serge-chat CVE-2026-6588 is under active exploitation — attackers can delete models due to missing authentication in version 1.4TB. Patch now to prevent unauthorized deletions. #NerdieNews #CyberSecurity #InfoSec #Ransomware #Malware #Microsoft https://t.co/bke6sXhtBn
Post summary
CVE-2026-6588 is actively exploited to delete models due to a missing authentication flaw, and an immediate patch is available.
CVE-2026-6588 Missing Authentication in Serge-Chat Model API Endpoint Download and Delete Functions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6588
Post summary
The text announces CVE‑2026‑6588 as a missing‑authentication flaw in Serge‑Chat’s API download/delete endpoints, with no PoC, exploit, patch, or active exploitation details.