In CISA KEV9.3 CriticalCWE-506Ransomware use
CVE-2026-48027
Nx Console Embedded Malicious Code Vulnerability
NxNx Console
Status
- Exploited in the wild
- In CISA KEV since 27 May
- Vendor fix available
- Known ransomware use
Federal deadlineWed 10 Jun, 23:59 UTC
Passed 136 days ago
CISA KEV · added 27 May
Exploit probabilityEPSSchecked 25 Oct
1.9%probability of exploitation in the next 30 days
Higher than 79% of scored CVEs
SeverityCVSS
9.3Critical
Description NVD
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 4 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 27 May · 19:31 UTC | CISA | CVE‑2026‑48027 Compromises Nx Console, Leads to Credential Theft |
| Thu 28 May · 00:18 UTC | CISA | CVE‑2026‑48027 Compromises Nx Console, Leads to Credential Theft |
| Thu 28 May · 08:11 UTC | SecurityOnline | Showboat malware leverages critical CVEs to spy on telecoms |
| Thu 28 May · 13:31 UTC | Security Affairs | CISA warns of Daemon Tools, TanStack and Nx Console flaws |
- CISA warns of Daemon Tools, TanStack and Nx Console flawsSecurity Affairs · mentions it in passing
- Showboat malware leverages critical CVEs to spy on telecomsSecurityOnline
- CVE‑2026‑48027 Compromises Nx Console, Leads to Credential TheftCISA · official notice
- CVE‑2026‑48027 Compromises Nx Console, Leads to Credential TheftCISA · first in our coverage · official notice