Critical Remote Code Execution in Marimo (CVE‑2026‑39987) Threatens Unauthenticated Access
What It Is
Marimo’s core service contains a pre‑authorization remote code execution (RCE) flaw. An attacker who has not authenticated can obtain a shell on the underlying host and run arbitrary system commands. The vulnerability is cataloged as CVE‑2026‑39987 and is rated Critical by CISA’s Known Exploited Vulnerabilities (KEV) program.
Exploitability
The vulnerability is exploitable without any credentials or prior interaction with the target system. Public proof‑of‑concept code has not been released, but the inclusion in the KEV list signals that active exploitation is either confirmed or highly probable. The CVSS vector is not yet published; however, the critical rating implies a score in the 9.0‑10.0 range.
Affected Products
- Vendor: Marimo
- Product: Marimo (all currently shipped versions)
Why It Matters for Compliance & Audit Readiness
- Access Controls: The flaw bypasses authentication, directly violating the principle of least privilege and undermining access‑control frameworks required by ISO 27001, NIST 800‑53 AC‑1/AC‑2, and PCI‑DSS.
- Continuous Control Monitoring: Evidence of unpatched critical RCEs can be flagged as a control‑failure during real‑time monitoring, jeopardizing the defensibility of your audit trail.
- Vendor‑Management Controls: The issue highlights the need for a robust third‑party risk program that includes timely vulnerability tracking and remediation verification for all supplied software.
Recommended Actions
- Map the Control Gap: Record the missing patch as a deviation in your access‑control inventory (e.g., AC‑2 “Account Management”).
- Capture Evidence: Document current Marimo version, patch status, and any compensating controls (e.g., network segmentation, IDS alerts).
- Validate Posture: Apply the vendor‑released patch or mitigation immediately; if unavailable, isolate the affected host and enforce strict network‑level deny‑list rules.
- Update Vendor Risk File: Re‑assess Marimo’s security posture, noting the KEV inclusion and any remediation timelines.
- Monitor for Indicators of Compromise: Enable logging of unexpected command‑execution events and correlate with SIEM alerts.
Source: CISA KEV – CVE‑2026‑39987