{"id":"EM-20261111-86XE","url":"https://cyber.eventmonitor.net/incident/EM-20261111-86XE/critical-rconfig-core-vulnerability-cve-2026-124079/","type":"cve","title":"Critical rConfig Core Vulnerability (CVE-2026-124079)","subtitle":"CVE-2026-124079","subject":"CVE-2026-124079","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-11T06:00:24.000Z","firstSignal":"2026-11-09T13:17:07.503Z","lastSignal":"2026-11-11T06:00:24.000Z","updated":"2026-11-11T15:44:07.320Z","revision":1,"life":[{"status":"Born","at":"2026-11-11T06:00:24.000Z","why":"second independent source: C31 Vulners (new public exploits)"},{"status":"Developing","at":"2026-11-11T06:00:24.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-09T13:17:07.503Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-11T06:00:24.000Z","what":"Born: second source, C31 Vulners (new public exploits). Page EM-20261111-86XE created."}],"stages":[{"name":"Disclosed","at":"2026-11-09T13:17:07.503Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-09T13:17:07.503Z","detail":"CVSS 9.3 · EPSS 0.6%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-09T13:17:07.503Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-124079 (CVSS 9.3)","text":"rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected deployments. Laravel's CallQueuedHandler unserializes the job without class restrictions, allowing attackers to instantiate the existing App\\\\Jobs\\\\TaskDownloadRun class and invoke an attacker-controlled Artisan command. Attackers can leverage the bundled laravel/tinker package…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124079"},{"at":"2026-11-11T06:00:24.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Exploit for CVE-2026-124079","text":"# CVE-2026-124079 — rConfig Core unauthenticated RCE via Redis/Horizon queue poisoning\n\nComplete, 100 % containerised reproduction lab and proof-of-concept for\n**CVE-2026-124079** (CWE-502, Deserialization of Untrusted Data → unauthenticated RCE, CVSS 9.8).\n\n| | |\n|---|---|\n| **Product** | rConfig…","url":"https://github.com/googlesky/CVE-2026-124079"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-09T13:17:07.503","score":9.3,"severity":"CRITICAL","desc":"rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without…","product":"","seen":1794237520970},"kev":null,"epss":{"epss":0.00621,"pct":0.50107,"at":1794411847320},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}