sign in--:--:--UTC

CVE-2026-75604

exploited in the wild☆ pin

CVSS

9.0

Reports

2

First seen

Aug 27, 2026

Last seen

Aug 31, 2026

Affected product

Next.js 13.4–15.5.23, 16.0–16.3.2 (Windows servers)

Associated actors

AnonyMousKIT ×1 Nimbus Manticore ×1 Qilin ×1 QTFY ×1 ShinyHunters ×1

Recent reports

31 August Threat Intelligence Report – Multiple Breaches, Critical Vulnerabilities, AI Threats

Check Point ResearchAug 31, 2026 Critical

Next.js Patches Critical AVIF and Windows Path Traversal RCE Flaws

The Hacker NewsAug 27, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans