{"id":"EM-20261112-0BA1","url":"https://cyber.eventmonitor.net/incident/EM-20261112-0BA1/vulnerability-cve-2026-59726/","type":"cve","title":"Vulnerability (CVE-2026-59726)","subtitle":"CVE-2026-59726","subject":"CVE-2026-59726","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-12T22:54:01.000Z","firstSignal":"2026-11-11T12:00:00.000Z","lastSignal":"2026-11-12T22:54:01.000Z","updated":"2026-11-13T16:08:41.627Z","revision":1,"life":[{"status":"Born","at":"2026-11-12T22:54:01.000Z","why":"second independent source: C31 Vulners (new public exploits)"},{"status":"Developing","at":"2026-11-12T22:54:01.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-11T12:00:00.000Z","what":"First signal: C32 Exploit-DB"},{"at":"2026-11-12T22:54:01.000Z","what":"Born: second source, C31 Vulners (new public exploits). Page EM-20261112-0BA1 created."}],"stages":[{"name":"Disclosed","at":"2026-11-11T12:00:00.000Z","detail":"C32 first to name it"},{"name":"Scored","at":"2026-11-11T12:00:00.000Z","detail":"No CVSS yet · EPSS 6.2%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-11T12:00:00.000Z","source":"C32","sourceName":"Exploit-DB","role":"Research & News","severity":3,"title":"Exploit published: Ruflo MCP Bridge 3.16.2 - Remote Code Execution","text":"remote · python","url":"https://www.exploit-db.com/exploits/52705"},{"at":"2026-11-12T22:54:01.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Ruflo MCP Bridge CVE-2026-59726 detect","text":"CVE-2026-59726 (RufRoot): Ruflo MCP Bridge before 3.16.3 exposes unauthenticated JSON-RPC on /mcp/devtools including ruflo__terminal_execute.","url":"https://github.com/SIA-IOTechnology/Kittysploit-framework/blob/main/modules/scanner/http/ruflo_mcp_cve_2026_59726_detect.py"},{"at":"2026-11-12T22:54:01.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Ruflo MCP Bridge CVE-2026-59726 unauthenticated RCE","text":"CVE-2026-59726 (RufRoot): Ruflo MCP Bridge before 3.16.3 allows unauthenticated JSON-RPC tools/call to ruflo__terminal_execute for arbitrary command execution.","url":"https://github.com/SIA-IOTechnology/Kittysploit-framework/blob/main/modules/exploits/linux/http/ruflo_mcp_cve_2026_59726_rce.py"}],"crowd":[],"reference":{"nvd":null,"kev":null,"epss":{"epss":0.06244,"pct":0.93649,"at":1794498647989},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}