PT-2026-3861 · Unknown · Nexusflow Api Gateway

Published 2026-01-21 · Updated 2026-05-27 · CVE-2026-12345

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions NexusFlow API Gateway versions prior to 3.8.1

Description A critical remote code execution issue exists in NexusFlow API Gateway. This issue is actively exploited by unauthenticated attackers, allowing them to gain full control of servers. The issue is identified as a zero-day with a CVSS score of 10.0. The affected component is the API Gateway. Attackers can exploit this through the API.

Recommendations Update NexusFlow API Gateway to version 3.8.1 or later.

Related Identifiers

CVE-2026-12345

Affected Products

Nexusflow Api Gateway

References · 10

• https://twitter.com/NetSecIO/status/2015864305799868824 · Twitter Post
• https://twitter.com/dailycve/status/2036266718482333870 · Twitter Post
• https://twitter.com/dailycve/status/2034288679267483800 · Twitter Post
• https://twitter.com/CybrPulse/status/2027759532097630498 · Twitter Post
• https://twitter.com/dailycve/status/2024254461493858684 · Twitter Post
• https://twitter.com/dailycve/status/2037327735345787266 · Twitter Post
• https://twitter.com/dailycve/status/2031908651359686852 · Twitter Post
• https://twitter.com/dailycve/status/2014021046735712635 · Twitter Post
• https://reddit.com/r/CodeyLab/comments/1towmjj/daily_dev_security_update_20260527 · Reddit Post
• https://i.redd.it/ftj4b2lgs8rg1.png · Reddit Post