Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
Sysdig documents a skilled human attacker exploiting Marimo pre-auth RCE CVE-2026-39987 (CVSS 9.3), reaching an SSH bastion in eight seconds without AI tooling.
Sysdig detailed exploitation of CVE-2026-39987 (CVSS 9.3), a pre-authenticated RCE affecting all Marimo versions that came under active exploitation within hours of disclosure. A human operator used a hand-written Python script to harvest an AWS key from Secrets Manager and SSH into a bastion host in eight seconds, issuing 850+ commands over nine hours. Separately, Hunt.io disclosed an XMRig cryptomining campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection. Operation CameraSwarm, linked to a single operator, compromised over 14,000 Dahua IP cameras using CVE-2021-33044 and CVE-2021-33045.
- Marimo /terminal/ws WebSocket RCE exploited within hours of disclosure
- Attacker pivoted to SSH bastion in eight seconds using hand-rolled Python, no AI
- Hunt.io: 3,562 Redis servers hit by XMRig via SLAVEOF rogue replication
- Operation CameraSwarm compromised 14,000+ Dahua cameras via auth bypass CVEs
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-33044 +1 in the same advisory: …33045 | Authentication Bypass in Dahua IP Camera Firmware Dahua IP cameras and related products contain an authentication bypass flaw (CWE-287, Improper Authentication) that is triggered when the client supplies the NetKeyboard type argument during the authentication process, allowing the device to treat the session as authenticated without valid credentials. An unauthenticated remote attacker who can reach the camera's network interface can exploit this to gain unauthorized access to the device's management functions. Successful exploitation can expose camera video streams and device configuration and can serve as a foothold into the surrounding surveillance or corporate network. Any organization running affected Dahua IP camera firmware, particularly cameras exposed to the internet, is potentially affected. The flaw is confirmed to be exploited in the wild: it was added to the CISA KEV on 2024-08-21, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile), although no public PoC is known. Do: Apply the mitigations or patched firmware specified in Dahua's security advisory for CVE-2021-33044; if mitigations are unavailable, discontinue use of the product as CISA's required action directs. Inventory internet-facing Dahua cameras and related devices, restrict their login interfaces from direct internet exposure, and review authentication logs for signs of prior exploitation. Ransomware use is listed as unknown, so treat any compromised camera as a potential network foothold and rotate any credentials used on the device. | 9.8 | 100% | KEV PoC ×2 |
| massplausibly millions of installed Dahua cameras worldwide, with likely >100,000 internet-exposed Dahua devices | |
| CVE-2026-39987 | Unauthenticated Remote Code Execution in Marimo Python Notebook Marimo, a reactive Python notebook, contains an unauthenticated remote code execution flaw (CVE-2026-39987, CWE-306; CVSS 4.0: 9.3 Critical) because its terminal WebSocket endpoint /terminal/ws skips authentication entirely. Unlike other WebSocket endpoints such as /ws, which call validate_auth(), /terminal/ws only checks the running mode and platform support before accepting connections, so any unauthenticated attacker who can reach the server can obtain a full PTY shell and execute arbitrary system commands on the host. All marimo deployments running versions prior to 0.23.0 are affected, with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-04-23, public PoCs exist, and reporting shows it was exploited within roughly 10 hours of disclosure, with observed post-exploitation activity involving LLM agents. EPSS assigns a 98.9% probability of exploitation within 30 days (100th percentile). Do: Upgrade marimo to 0.23.0 or later; until patched, restrict access to the /terminal/ws WebSocket endpoint by binding the notebook to localhost, a VPN, or an authenticating reverse proxy. Identify whether any marimo instances are internet-exposed and review logs for connections to /terminal/ws and unexpected shell or process spawns, given reports of LLM-agent-driven post-exploitation on compromised instances. As a KEV entry (added 2026-04-23), this requires federal agencies to apply the vendor fix or mitigations per BOD 22-01 timelines. | 9.3 | 99% | KEV PoC ×4 |
| moderatelikely tens of thousands of users, with directly internet-exposed marimo servers plausibly in the low thousands |
Full article706 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 15, 2026Vulnerability / Malware
With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access.
In one instance highlighted by the cloud security company, the threat actor pivoted from a vulnerable Marimo notebook to an SSH bastion host in eight seconds using a custom Python toolkit they "wrote and debugged by hand" without any AI agent in the loop.
"Eight seconds is the kind of speed we expect to see in AI-assisted attacks," the Sysdig Threat Research Team said. "This operator got there on skill alone, and along the way walked straight past a trap that every agentic threat actor (ATA) we've profiled against this same CVE fell into. Not only can skilled human attackers move at machine speed, but they can also often better evade defenders' detections."
The attack chain has been found to exploit CVE-2026-39987 (CVSS score: 9.3), a pre-authenticated remote code execution vulnerability impacting all versions of Marimo that came under active exploitation within hours of public disclosure.
Upon gaining an initial foothold, the threat actor is said to have run an end-to-end credential-pivot chain, leveraging the Marimo flaw to gain a full interactive shell, followed by an Amazon Web Services (AWS) Secrets Manager call using credentials harvested from the compromised instance, and SSH access to a bastion host with the retrieved private key -
- 18:57:22: Fresh WebSocket connection
- 18:57:26: Lookup against the application's stored credential returns the harvested AWS key
- 18:57:30: SSH authentication observed at the bastion host
The entire activity lasted from 12:52 p.m., when the first WebSocket connection was made from "172.236.12[.]17" to the "/terminal/ws WebSocket endpoint exposed by Marimo, to 9:50 p.m., during which the threat actor deployed an asyncssh-style listener setup against an attacker-owned VPS.
"Over the course of a nine-hour session, they issued more than 850 interactive commands, used no recognizable publicly available offensive tooling, and hand-rolled their scripts in-session," Sysdig said. "The operator's tradecraft converged on a single backgrounded Python3 invocation, not an agentic framework, that pulls the credential, fetches the SSH key from Secrets Manager, writes it to disk, and authenticates to the bastion over SSH in one shot."
"AI may be changing the economics of attacks — more targets, faster time-to-exploit, and less manual grind on repetitive tasks — but it has not yet replaced the skilled attacker who knows how to build from scratch and avoid traps."
The findings come as Hunt.io disclosed details of a cryptomining campaign that has compromised 3,562 Redis servers likely following a broad internet sweep of candidate Redis hosts on port 6379, while simultaneously launching three parallel pipelines -
- WordPress target discovery, which scans a list of HTTPS hosts for WordPress version, installed plugins, and whether XML-RPC or directory listings are exposed
- AOF-based SSH authorized_keys injection, which uses Redis's append-only file (AOF) mode to perform authorized_keys SSH key injection
- Lua sandbox-escape probing, which runs Redis EVAL commands and sandbox escape attempts against three hosts ("47.250.92[.]230," "34.166.99[.]116," and "20.198.10[.]42")
The primary exploitation method is the use of the SLAVEOF command to smuggle attacker-controlled content onto a target Redis server, resulting in the deployment of an XMRig miner. The activity, which came to light after the discovery of an exposed working environment at 188.245.99[.]156, has not been attributed to any known threat actor or group.
"Confirmed victims span Redis 2.8.17 (2015) through 7.2.0 (2023) and Linux from EOL RHEL/CentOS 6 to current Ubuntu kernels, pointing to missing authentication as the weakness rather than a version-specific bug," Hunt.io said.
"The toolkit runs four techniques across three services, but only Redis rogue replication worked at scale: SSH key-injection and MongoDB sandbox-escape returned zero across 2,810 attempts, and a complete WordPress credential-to-webshell chain was recovered but not confirmed at scale."
In recent months, a single operator was also linked to a massive campaign dubbed Operation CameraSwarm that compromised over 14,000 Dahua IP cameras using brute-force attacks, authentication bypass flaws (CVE-2021-33044 and CVE-2021-33045), and a peer-to-peer (P2P) relay technique.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/human-attacker-exploits-marimo-rce.html