Is CVE-2026-48027 (Nx Console Embedded Malicious Code) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2026-48027 to its Known Exploited Vulnerabilities catalogue on 27 May 2026, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published.

How KEV Listing Changes the Answer

For a CVE question like this, the most important signal is not the CVE title alone, but whether a trusted authority has placed it in an active exploitation catalogue. CISA’s KEV inclusion means the issue has crossed from theoretical exposure into confirmed real-world abuse, so the operational question becomes exposure management, not curiosity about the vulnerability name.

That distinction matters because KEV-listed issues should move to the front of patch queues, exception reviews, and containment planning. If the vulnerable product is present anywhere in your environment, treat the finding as actionable even if the affected system appears low value or indirectly reachable.

What To Check In Your Environment

Start by confirming whether Nx Console is installed, where it is used, and whether any versions in your estate could have accepted a malicious publication path. For this type of issue, inventory is not just an IT hygiene exercise, it is the basis for deciding whether you need emergency remediation, compensating controls, or compromise assessment.

Because the vulnerability involves embedded malicious code in a published component, you should also look for development and workstation impact, not only server-side exposure. If engineers used the extension or connected tooling in daily workflows, the blast radius can include local secrets, browser sessions, tokens, and source-control credentials.

Use the KEV entry, the vendor advisory, and your software inventory together rather than relying on package names or version labels alone. The practical question is whether the vulnerable code ever ran in a context that could access credentials, repositories, or signing material.

Responding When Immediate Patching Is Not Yet Possible

If patching or removal must wait, reduce access first and monitor for signs that the component was used during the exposure window. That usually means constraining the affected extension or package, tightening developer workstation privileges, and reviewing whether any secrets or sessions were accessible to the compromised component.

When a maliciously published developer tool is involved, post-exposure actions often matter as much as the fix itself. Review token issuance, rotate credentials that may have been present on impacted machines, and invalidate sessions or cached auth material if you cannot prove they were untouched.

For a supply-chain style issue like this, compromise assessment should focus on what the component could have reached, not just whether malware was detected. If you find evidence that the tool had access to code, tokens, or repositories, treat that as a potential credential and integrity incident.

Risk and Threat Considerations

Active exploitation changes this from a software defect into an exposure problem with real attacker interest. A maliciously published developer component can be used to harvest secrets, pivot into source control or cloud services, and create follow-on compromise long after the original package is discovered.

Failure mechanism: The malicious version rides a legitimate distribution path, gains trust through normal installation behavior, and executes in an environment where developers expect the tool to be safe.

Impact: Attackers can steal tokens, sessions, or other secrets, then use them for repository access, downstream package abuse, or broader environment compromise, which is why KEV-listed developer tooling deserves urgent handling.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	KEV-listed exploitation requires identifying where Nx Console is deployed and exposed.
	PR.PS-01 — Configuration Management	Removing or restricting a maliciously published component is a protective configuration action.
	RS.MA-01 — Incident Mitigation	Active exploitation makes containment and mitigation central to response.
Recommendation — Identify all installations and exposure paths, then prioritise remediation by confirmed risk. Apply hardened software configuration controls to remove or restrict the vulnerable component. Contain affected systems and execute mitigation actions before broader recovery work.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	This is a vulnerability triage and exposure-confirmation problem driven by active exploitation.
	SI-3 — Malicious Code Protection	The issue involves malicious code delivered through a trusted software path.
	IR-4 — Incident Handling	Known exploitation requires containment, analysis, and response actions.
Recommendation — Use vulnerability monitoring to confirm exposure and drive urgent remediation. Block or detect malicious code execution in affected developer environments. Treat confirmed use as an incident and execute containment and analysis procedures.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV entries belong in urgent vulnerability prioritisation and remediation workflows.
Recommendation — Prioritise and remediate KEV-listed exposure ahead of routine backlog work.
MITRE ATT&CK	T1195 — Supply Chain Compromise	The scenario is an abused software distribution path delivering malicious code.
	T1552 — Unsecured Credentials	The likely consequence is theft of tokens, sessions, or other secrets from developer systems.
	T1204 — User Execution	Malicious developer tooling still depends on a user or build process executing it.
Recommendation — Map the compromise path as supply-chain abuse and hunt for downstream execution. Hunt for credential exposure and rotate any secrets reachable by the compromised tool. Trace how the user or build path executed the malicious component and contained its reach.

Practitioner Guidance

What to verify: Confirm whether Nx Console was installed on any system that handled production code, cloud access, or signing operations. If yes, verify not only removal or patching, but also whether the tool had access to any credentials that still remain valid.

Decision rule: If the component touched developer secrets or source-control credentials, rotate first and investigate second; if it never had access to sensitive material, you still need removal and fleet-wide exposure review, but the recovery scope is narrower.

What practitioners underestimate: The real risk is often persistence through stolen access rather than the package itself. A clean endpoint does not prove a clean identity trail, so sessions, tokens, and repository permissions deserve the same urgency as the binary or extension.

Practitioner takeaway: Treat KEV listing as a trigger for immediate exposure management, because once a malicious package has been publicly abused, the main question is no longer whether exploitation is possible, but whether any trusted credentials or workflows were already touched.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org