PULSE
ES
FEED
ransomsilentransomgroup reclama a Susman Godfrey LLP · US · Professional Servicesransomglobal secret group reclama a TDS Telecommunications LLC. · US · Energy & Utilitiesransomshiba reclama a IT Foods Industries · Agriculture and Food Productionransomshiba reclama a Friendly Senior Living · Healthcareransomshiba reclama a Morgan White Group · Professional Servicesransomshiba reclama a Antwerp House Dentistry · GB · Healthcareransomeverstake reclama a as*****g.comransomeverstake reclama a ca*****s.comransomeverstake reclama a in*****s.comransomeverstake reclama a corp-smart.com · Technologyransomwhitearmor reclama a rolly.io · Technologyransomemperador reclama a LA PROFUMERIA SRL · IT · Retail & E-Commerceransomscarlettgroup reclama a sunnybrook.ca · CA · Healthcareransomscarlettgroup reclama a au.bank.in · IN · Financial Servicesransomsilentransomgroup reclama a Susman Godfrey LLP · US · Professional Servicesransomglobal secret group reclama a TDS Telecommunications LLC. · US · Energy & Utilitiesransomshiba reclama a IT Foods Industries · Agriculture and Food Productionransomshiba reclama a Friendly Senior Living · Healthcareransomshiba reclama a Morgan White Group · Professional Servicesransomshiba reclama a Antwerp House Dentistry · GB · Healthcareransomeverstake reclama a as*****g.comransomeverstake reclama a ca*****s.comransomeverstake reclama a in*****s.comransomeverstake reclama a corp-smart.com · Technologyransomwhitearmor reclama a rolly.io · Technologyransomemperador reclama a LA PROFUMERIA SRL · IT · Retail & E-Commerceransomscarlettgroup reclama a sunnybrook.ca · CA · Healthcareransomscarlettgroup reclama a au.bank.in · IN · Financial Services
← All CVEs
CVE WatchOct 25, 2026

CVE-2026-41679

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthen

CVSS

10.0

Critical

EPSS

31.7%

p98

KEV

—

Exploit Today

29

0-100

Published: Apr 23, 2026 · Last modified: Oct 25, 2026 · CWE-287 · CWE-862 · CWE-1188

EPSS · 30d
7.4%EPSS · 30 days31.7%
2026-10-012026-10-28
Technical description

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-96389—
—
———Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.7hCVE-2026-118573—
—
———Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.7hCVE-2026-118539—
—
———Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.7hCVE-2026-114547—
—
———Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.7hCVE-2026-114535—
—
———Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.7hCVE-2026-114533—
—
———Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.7h