CVE-2026-40047Not scored

CVE-2026-40047

Vendor not yet named

No fix listed · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub8 Jul
Not established: not seen

No EPSS score yet. The score appears once FIRST publishes it.

Not scored yet. NVD has not published a CVSS score.

NVD has not published a description yet.

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Neutralization of Argument Delimiters in a Command · Command and Code Injection
Vendor: Apache Software Foundation
Published: July 2026
Band: Possible (1 to 10%), July 2026

First in our coverage: SecurityOnline, 26 Oct.

26 Oct 03:21
Apache Camel fixes eight flaws, including an XXE vulnerability
SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.