{"vulnerability": "CVE-2026-75604", "sightings": [{"uuid": "9c563650-d14e-4fb3-b9c2-930dc60d3c4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/117166951267868054", "content": "Next.js Windows RCE PoC https://github.com/rafabd1/CVE-2026-75604-poc", "creation_timestamp": "2026-08-27T10:16:34.911295Z"}, {"uuid": "d1509c8d-2807-48e2-aa56-86d74d90aa25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-75604", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mu3rucitqc2n", "content": "Thursday's fuck up - It's been a while since I've had fresh meat from Next.js - and here's such a beautiful critical vulnerability RCE - github.com/rafabd1/CVE-... #cve #exploit #poc #redteam #nextjs #cve-2026-75604 #critical #windows #rce", "creation_timestamp": "2026-08-27T11:24:17.291602Z"}, {"uuid": "af535502-8911-428a-aec2-930caac33316", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/qhr7w023-vn7u1_ejg3FfnGZ1vCO9Tv-EvHPiDFbLb3J-JQ", "content": "", "creation_timestamp": "2026-08-27T12:00:10.254408Z"}, {"uuid": "632c089f-8149-45d7-a31c-1b470a6832c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "content": "", "creation_timestamp": "2026-08-27T12:00:07.429107Z"}, {"uuid": "f633fca3-c312-40d0-b837-dcceee889034", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99785", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-26 11:54:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-26T14:00:05.641284Z"}, {"uuid": "48692862-1d8f-4069-9e85-083ad6ddf186", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/493", "content": "poc: https://github.com/rafabd1/CVE-2026-75604-poc", "creation_timestamp": "2026-08-28T00:00:11.103217Z"}, {"uuid": "5b5338eb-9b9a-4e77-8d72-eb817efdaee3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://t.me/captainsmok3r_official/492", "content": "two critical Next.js vulnerabilities, including CVE-2026-75604 (CVSS 9.0), enable unauthenticated remote code execution. Patch to 15.5.24 or 16.3.3 now.", "creation_timestamp": "2026-08-28T00:00:11.151921Z"}, {"uuid": "d40f4eaf-3391-4c76-bf6b-630fb14666eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "content": "", "creation_timestamp": "2026-08-28T00:00:51.186329Z"}, {"uuid": "f16e0e9f-01ba-42f8-a1d7-ab089aedca34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99693", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rafabd1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 19:35:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 Next.js Windows RCE proof of concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-25T22:00:03.476506Z"}, {"uuid": "6a3c044f-de10-4839-8740-850d996463b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/qhr7w023-vn7u1_ejg3FfnGZ1vCO9Tv-EvHPiDFbLb3J-JQ", "content": "", "creation_timestamp": "2026-08-28T00:00:52.976185Z"}, {"uuid": "ed85a847-7bea-45ea-895a-8be7442dd899", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mtz6e6kiuo24", "content": "\ud83d\udea8 CVE-2026-75604 (Critical, CVSS 9.0): pre-auth RCE in Next.js via path traversal in Windows cache. Affects Windows versions before 15.5.24, 16.3.3 and some canary (Pages + App Router without Cache Components).\n\ud83d\udc49 Update now: 15.5.24 / 16.3.3 /  16.4.0-canary.7 \nbuff.ly/LdWZiJF", "creation_timestamp": "2026-08-26T20:29:43.469190Z"}, {"uuid": "a22d795f-0745-4c39-b4c1-0457a9e992a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99693", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rafabd1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 19:35:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 Next.js Windows RCE proof of concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-26T00:00:07.456509Z"}, {"uuid": "efba5206-ca69-4b08-8ce9-77b95719d6d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-75604", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mu3b72nco42i", "content": "Critical Next.js & libheif RCE Vulnerabilities: Inside the August 2026 AVIF Zero-Day Exploit\u00a0Chain\n\nCritical Next.js RCE vulnerabilities affect AVIF image optimization and Windows servers. Learn about\u2026\n\nhttps://thecybersecguru.com/news/recommended-url-slug-nextjs-rce-avif-libheif-cve-2026-75604/", "creation_timestamp": "2026-08-27T16:25:54.244190Z"}, {"uuid": "966fd94e-3e51-461c-bc43-81992584b848", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html", "content": "Credit: Hacktron\nVercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem.\n\nThe Windows path traversal, tracked as CVE-2026-75604&", "creation_timestamp": "2026-08-28T01:00:44.937603Z"}, {"uuid": "65834bdc-621e-4537-8cd6-4442d23a8f11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "Telegram/5OcvQ0Kvc7EZmNnx124YGJsJb961fNxRCYGvYNIkiajBUhEy", "content": "", "creation_timestamp": "2026-08-27T00:00:07.016659Z"}, {"uuid": "e9cd7f90-19fe-4e7d-95e2-8236243c57af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99785", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-26 11:54:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-27T00:00:10.331329Z"}, {"uuid": "20e12dd1-72e2-4572-a93f-5fc776271654", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/TyxHaxNOYZewY16WupfPzLILXONmDjxPuLwVALABem5R50xg", "content": "", "creation_timestamp": "2026-08-28T15:00:05.299603Z"}, {"uuid": "7d7e12d0-5a01-42e1-bd24-5c97bb4c61e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtxaajmfdv2q", "content": "Two critical Next.js vulnerabilities, including CVE-2026-75604 (CVSS 9.0), enable unauthenticated remote code execution. Patch to 15.5.24 or 16.3.3 now.\n\n#NextJS #RCE #CyberSecurity #CVE202675604 #WebSecurity", "creation_timestamp": "2026-08-26T01:58:09.366034Z"}, {"uuid": "90bede7d-09b7-4656-8069-5ae1578e4bcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mu3iwqpz542c", "content": "#NextJS: Two Critical Vulnerabilities in NextJS allow unauthenticated #RCE: one through crafted AVIF images, another via path traversal on Windows (CVE-2026-75604). \nUpgrade your NextJS immediately to v15.5.24 or 16.3.3!:\n\ud83d\udc47", "creation_timestamp": "2026-08-27T18:44:38.004000Z"}, {"uuid": "b2c75c07-4b34-48e4-bd4e-579dda1b0545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0329", "content": "Vercel heeft twee kwetsbaarheden verholpen in Next.js, een React framework voor het ontwikkelen van (web)applicaties. Een kwaadwillende kan de kwetsbaarheid met kenmerk CVE-2026-75604 misbruiken voor het uitvoeren van willekeurige code op de applicatieserver. De kwetsbaarheid is alleen aanwezig in Next.js-applicaties die op een Windows-omgeving worden gehost en die een Pages- en App-router gebruiken zonder de Cache Component.\n\nNaast deze kwetsbaarheid is er ook een andere kwetsbaarheid verholpen die kwaadwillenden in staat stelt willekeurige code uit te voeren. Hiertoe dient een malafide mediabestand aan een kwetsbare applicatie te worden aangeboden. Deze kwetsbaarheid heeft ten tijde van publicatie nog geen CVE-kenmerk toegekend gekregen.", "creation_timestamp": "2026-08-27T01:00:32.738052Z"}, {"uuid": "8ba80c9d-f2c8-4c5c-ae73-3b93b2c2c79a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html", "content": "Credit: Hacktron\nVercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem.\n\nThe Windows path traversal, tracked as CVE-2026-75604&", "creation_timestamp": "2026-08-27T19:00:42.064265Z"}, {"uuid": "916bf366-5a92-4acb-89f9-061a2afe4aa3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mu3okvouo527", "content": "\ud83e\udd16 Next.js patches two critical unauth RCE flaws: crafted AVIF image (heap overflow in libheif, CVSS 9.5) and Windows path traversal CVE-2026-75604 (CVSS 9.0). Fixed in 15.5.24 / 16.3.3.\nhttps://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html", "creation_timestamp": "2026-08-27T20:25:08.652362Z"}, {"uuid": "0d5eb292-41be-402f-9ab6-4c4a7614b3e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mu4xp2d6lp2k", "content": "\ud83e\udd16 Next.js: Vercel patches two critical unauthenticated RCEs \u2014 crafted AVIF images and a Windows path traversal (CVE-2026-75604). Upgrade affected versions.\nhttps://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html", "creation_timestamp": "2026-08-28T08:41:10.543898Z"}, {"uuid": "a5672d7a-c897-4f5d-bf75-300aa27aa39e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/493", "content": "poc: https://github.com/rafabd1/CVE-2026-75604-poc", "creation_timestamp": "2026-08-27T22:00:05.890900Z"}, {"uuid": "300383d1-d600-4ed2-9ca3-c082754ea266", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://t.me/captainsmok3r_official/492", "content": "two critical Next.js vulnerabilities, including CVE-2026-75604 (CVSS 9.0), enable unauthenticated remote code execution. Patch to 15.5.24 or 16.3.3 now.", "creation_timestamp": "2026-08-27T22:00:05.937513Z"}, {"uuid": "b06e5731-a1a6-4deb-85dd-b30b68a1a732", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mu52gkyljp2i", "content": "\ud83d\udce2 [VULN] Next.js : deux failles critiques permettent une ex\u00e9cution de code \u00e0 distance sans authentification - CVE-2026-75604\n\nLe 25 ao\u00fbt 2026, Vercel a publi\u00e9 plusieurs nouvelles versions de Next.js : 15.5.24 et 16.3.3. L'objectif ?\n\n#CVE #Cyberveille", "creation_timestamp": "2026-08-28T09:30:07.075701Z"}, {"uuid": "6b233393-779d-49de-9d00-40c4a7bc0aff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0329", "content": "", "creation_timestamp": "2026-08-26T12:15:03.731017Z"}, {"uuid": "98c2e18b-eee0-4860-9220-7792f9ba39b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mu2mkwk4fq42", "content": "Next.js Windows RCE PoC https://github.com/rafabd1/CVE-2026-75604-poc", "creation_timestamp": "2026-08-27T10:16:47.865530Z"}]}