CVE-2026-66066
Public exploit code is available. Proof-of-concept or working exploit code for CVE-2026-66066 is indexed in GitHub PoC. Expect opportunistic scanning and exploitation attempts — prioritize remediation even though it is not (yet) in the CISA KEV catalog.
Serial Number: AV26-767 Date: July 31, 2026 As of July 30, 2026, Rails is affected by a vulnerability in the following product: Rails Prior to 8.0.5.1 Prior to 8.1.3.1 Prior to 7.2.3.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Release 7.2.3.2 · rails/rails - GitHub Release 8.0.5.1 · rails/rails - GitHub Release 8.1.3.1 · rails/rails - GitHub [CVE-2026-66066] Possible arbitrary file read and remote code execution in Active Storage variant processing Release list - rails/rails
CSIRTS triage
- What
- A vulnerability allows information disclosure, which may lead to remote code execution or lateral movement.
- Who is affected
- Remote, anonymous attackers targeting Ruby on Rails deployments.
- Urgency
- Remediation is urgent due to the high severity and potential for exploitation.
- Action
- Update to the latest version of Ruby on Rails to mitigate the vulnerability.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-66066
Get an email if CVE-2026-66066 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Moderate exploitation risk1.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 75% of all EPSS-scored CVEs.
Exploit availability
Public exploit or proof-of-concept code for CVE-2026-66066 is indexed in these free datasets. Available exploit code raises real-world risk independent of the CVSS score.
- GitHub PoCPublic proof-of-concept repositories on GitHub reference this CVE.look it up ↗
Advisory coverage (5)
- unknownRails security advisory (AV26-767)cccs · 2026-07-31
- high[NEW] [high] Ruby on Rails: Vulnerability allows information disclosurecert-bund · 2026-07-31
- unknownCVE-2026-66066: Action Pack is a framework for handling and responding to web requests. In versions prior to 7…nvd · 2026-07-30
- criticalGHSA-xr9x-r78c-5hrm: Active Storage has possible arbitrary file read and remote code execution in Active Stora…ghsa · 2026-07-30
- unknownVulnerability in Ruby on Rails activestorage (July 30, 2026)cert-fr-avis · 2026-07-30
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-66066)