{"vulnerability": "cve-2026-46339", "sightings": [{"uuid": "43e5f913-f3f4-4992-bb23-05f3f46b3aa4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "seen", "source": "Telegram/Gb8E7051tk852HHDoXLjDtC-e550Fak_8ZYRyADH7od6Bkg", "content": "", "creation_timestamp": "2026-08-29T23:00:14.109683Z"}, {"uuid": "5e3585f8-4a60-4a09-84d6-cdaaaa35673a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "seen", "source": "Telegram/Gb8E7051tk852HHDoXLjDtC-e550Fak_8ZYRyADH7od6Bkg", "content": "", "creation_timestamp": "2026-08-30T00:00:24.132147Z"}, {"uuid": "d5d64b7a-82a6-4d6d-bbd7-d5f981996585", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "published-proof-of-concept", "source": "Telegram/Gb8E7051tk852HHDoXLjDtC-e550Fak_8ZYRyADH7od6Bkg", "content": "", "creation_timestamp": "2026-08-31T00:00:45.236189Z"}, {"uuid": "bd6f372c-a933-4319-b6df-f755fb5034fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46339", "type": "published-proof-of-concept", "source": "https://github.com/decolua/9router/security/advisories/GHSA-fhh6-4qxv-rpqj", "content": "", "creation_timestamp": "2026-05-13T13:15:48.000000Z"}, {"uuid": "97f2a303-9e0e-427c-8b69-012c7af545f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-46339.yaml", "content": "", "creation_timestamp": "2026-07-15T06:00:04.825296Z"}, {"uuid": "86ae5892-b393-43ee-ad7f-fd309da4260f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqpq2aalhz2a", "content": "CVE-2026-46339 - 9router\nThe 9router software exposes unauthenticated API endpoints that can be used to execute arbitrary OS commands without any prerequisites or credentials. This vulnerability exists\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#9router #decolua #npm #CVE #infosec", "creation_timestamp": "2026-07-15T22:04:04.465509Z"}, {"uuid": "af0df7d4-e2a3-44fd-8bdd-62e3505582c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-46339.yaml", "content": "", "creation_timestamp": "2026-07-16T00:00:03.619820Z"}, {"uuid": "44111896-18b3-46c2-a90b-945d312fea4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqq23ub7dj2e", "content": "CVE-2026-46339 - 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes\nCVE ID : CVE-2026-46339\n \n Published : July 15, 2026, 9:16 p.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : 9Router is an AI router & token saver. From 0.4.30 until 0.4.3...", "creation_timestamp": "2026-07-16T01:03:56.409644Z"}, {"uuid": "32d87a3d-f322-45b1-88ae-3bb3fad0e471", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-46339", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116927419172028216", "content": "CRITICAL: CVE-2026-46339 impacts decolua 9Router (<0.4.37). OS command injection via exposed API lets unauth attackers gain full control. Patch to 0.4.37 now! https://radar.offseq.com/threat/cve-2026-46339-cwe-78-improper-neutralization-of-s-96ae550cea593bb1 #OffSeq #CVE202646339 #infosec #security", "creation_timestamp": "2026-07-16T03:00:25.538953Z"}, {"uuid": "83a23b17-be05-488f-9182-aed74e0788f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-46339", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqqam6zeky26", "content": "CVE-2026-46339 in decolua 9Router (<0.4.37): CRITICAL OS command injection lets unauthenticated attackers fully compromise systems. Upgrade to 0.4.37 now. https://radar.offseq.com/threat/cve-2026-46339-cwe-78-improper-neutralization-of-s-96ae550cea593bb1 #OffSeq #CVE #security", "creation_timestamp": "2026-07-16T03:00:27.443537Z"}, {"uuid": "eb4c305b-2fc9-475b-9965-93a6af075c06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-46339.yaml", "content": "", "creation_timestamp": "2026-07-17T00:00:04.543892Z"}, {"uuid": "55b2d60f-4bb4-42be-a76f-65ea180bd00a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mqsxvncty22j", "content": "Daily IT Security Digest \u2014 2026-07-17\ncontrols.\n   Source: Mastodon #zero-day\n\n5. **CVE-2026-46339: CRITICAL Command Injection in decolua 9Router**\n   A critical OS command injection vulnerability (CVE-2026-46339) in decolua 9Router below version 0.4.37 allows unauthenticated attackers to gain full", "creation_timestamp": "2026-07-17T05:02:39.654012Z"}, {"uuid": "f8655311-f6be-4425-8a65-e4359f6c1a9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-46339.yaml", "content": "", "creation_timestamp": "2026-07-18T00:00:04.766101Z"}, {"uuid": "bde9896e-a473-4e99-b101-6339ffa5eeac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mqvieet5zd2o", "content": "Daily IT Security Digest \u2014 2026-07-18\nresponse.\nSources: [Mastodon #zero-day](https://mastodon.hofud.com/@hermes_agent/116933561716749738), [Mastodon #infosec](https://infosec.exchange/@offseq/116724637739741236)\n\n4. **CVE-2026-46339: Critical OS Command Injection in decolua 9Router**\nA critical OS", "creation_timestamp": "2026-07-18T05:02:33.258950Z"}, {"uuid": "cf4cfbdb-c075-4e4b-9449-1abd5af9d92b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mqvief3wbs2e", "content": "Daily IT Security Digest \u2014 2026-07-18\ninjection flaw (CVE-2026-46339) has been identified in decolua 9Router (versions below 0.4.37). The vulnerability is exposed through the application's API, allowing unauthenticated attackers to gain full control of affected devices. Users are urged to upgrade to", "creation_timestamp": "2026-07-18T05:02:33.718088Z"}, {"uuid": "4550edf8-5612-4989-94d7-6e0a92ccc1b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mqxys6yx5d2g", "content": "Daily IT Security Digest \u2014 2026-07-19\naffecting script execution, EUVD-2026-45416 (CVSS 4.8) in Pluck CMS (CVE-2026-46339) impacting htmlspecialchars_decode, and EUVD-2026-45417 (CVSS 5.3) in django-oauth-toolkit 3.3.0 affecting OAuth token handling. All affect commonly used software and should be", "creation_timestamp": "2026-07-19T05:02:21.573169Z"}, {"uuid": "cd13c2c9-8094-43d0-95c4-4c5d7113dbf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/100088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CTT-Enhanced-CVE-2026-46339-Exploit-Engine\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SimoesCTT\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-28 10:58:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA specialized Python framework that executes unauthenticated remote code execution via the 9Router Model Context Protocol (MCP) bridge by deploying a 33-layer temporal phase cascade, Riemann-Hadamard dispersion, and an 11 ns wedge filter to bypass traditional proxy and process-monitoring defenses.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-28T14:00:05.338627Z"}, {"uuid": "dee81896-a5aa-4f06-81a9-0e0631e4de7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46339", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/100088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CTT-Enhanced-CVE-2026-46339-Exploit-Engine\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SimoesCTT\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-28 10:58:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA specialized Python framework that executes unauthenticated remote code execution via the 9Router Model Context Protocol (MCP) bridge by deploying a 33-layer temporal phase cascade, Riemann-Hadamard dispersion, and an 11 ns wedge filter to bypass traditional proxy and process-monitoring defenses.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-29T00:00:11.747484Z"}]}