CVE-2026-48027

This is not a normal “bug in a program.” Instead, a bad copy of Nx Console (version 18.95.0) was briefly distributed through common software marketplaces, and it could let an attacker run code on your machine. Think of it like someone briefly swapping the software installer for a “look-alike” that secretly does harmful things when you install it.

This matters if your business uses Nx Console (nx-console / Nx Console) and any of your machines installed version 18.95.0. There’s no need for users to click anything, and the finding indicates no authentication is required for the attack path.

This is a risk when the compromised version has been installed (the precondition is installation of Nx Console 18.95.0); systems that are not running that exact version are not the target of this specific issue.

This is urgent because CISA’s KEV lists CVE-2026-48027 as being used in ransomware campaigns, and exploitation has been reported in the wild. The affected component is an installer distributed via marketplaces, so any business that installed the compromised version is at immediate risk.

Because this is classified as RED, treat it as an active incident: upgrade the affected version and run the vendor’s compromise checks immediately.

1. Confirm exposure (installed version check)

   • On each machine that has Nx Console installed, check the Nx Console version.
   • Specifically identify whether any machine is running Nx Console 18.95.0.

2. Immediate remediation

   • If any machine has Nx Console 18.95.0 installed: upgrade to Nx Console 18.100.0.

3. Threat hunting / indicators of compromise (per vendor)

   • Use the vendor’s posted “indicators of compromise” guidance to check for signs of tampering/compromise on machines that had 18.95.0 installed.
   • Compare findings against the vendor postmortem/security advisory guidance.

4. If you can’t remediate right away

   • Stop using Nx Console on affected machines until you can upgrade and complete the vendor’s checks.
   • If mitigations are unavailable for your environment, CISA guidance says to discontinue use of the product.

5. Timing

   • CISA remediation due date for KEV items is 2026-06-10.

6. What to monitor afterwards

   • Watch for evidence of unexpected processes, persistence, or credential access events on machines where 18.95.0 was installed, and continue using the vendor’s indicators as your monitoring checklist.

Severity is critical (CWE-506) with a mechanism of arbitrary code execution via a supply-chain event (malicious package publication). The findings state authentication is not required and there is no user interaction requirement; the practical precondition is installation of the compromised Nx Console 18.95.0.

CISA KEV confirms real-world use in ransomware campaigns (added 2026-05-27), and news reporting confirms exploitation in-the-wild starting 2026-06-01 with worm activity involving compromised npm package workflows. No public exploit code is on record, but exploitation is still confirmed via KEV/news. A vendor remediation is available, and a safe alternative version is called out: Nx Console 18.100.0 is not compromised.

EPSS is provided in the dataset, but public likelihood values should not be used to downplay risk here because KEV/news confirm exploitation; treat this as active and prioritize upgrading and compromise checks.