VulnSocial

CVE-2026-92206

LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

Back to dashboard
0.0/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked 1d ago at 1 mentions (2026-09-17); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-17: 1Mentions · 2026-09-18: 109-1709-18
Referenced assets1 URL
Full discourse2 posts
  • E@ethanxpy

    CrewAI 0-day: load an agent from a repo → RCE. CVE-2026-92206. load_agent_from_repository imports whatever you hand it. No allowlist. Service-account code. You have to click load (UI:R). ZDI shipped it unpatched. Treat untrusted agent repos like untrusted .py.

    0002048
    125 followersView on X
  • Security Arsenal, LLC@SecurityAr58409

    🔒 #CyberSecurity CVE-2026-92206: Unpatched CrewAI Unsafe Reflection Flaw Enables Unauthenticated… "The Zero Day Initiative has published advisory ZDI-26-706 disclosing a currently unpatched…" 🔗 https://securityarsenal.com/blog/cve-2026-92206-unpatched-crewai-unsafe-reflection-flaw-enables-unauthenticated-rce-detection-and-mitigation-guide #CyberSecurity #ThreatIntel #critical #zeroday #cve

    0000014
    31 followersView on X

Explore more

Back to dashboard