{"metadata": {"vulnerability": "CVE-2026-117601", "count": 20, "kinds": {"milestone": 4, "sighting": 7, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-24T00:00:00Z", "date_only": false, "value": "2026-10-24T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-117601", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T13:04:09.905Z", "date_only": false, "value": "2026-10-27T13:04:09.905Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-117601", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-27T13:09:51.347Z", "date_only": false, "value": "2026-10-27T13:09:51.347Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-117601", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T13:09:51.347Z", "date_only": false, "value": "2026-10-27T13:09:51.347Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-117601", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-27T13:48:41.906Z", "date_only": false, "value": "2026-10-27T13:48:41.906303Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117513186264147151", "record": "CVE-2026-117601", "field": "creation_timestamp", "uuid": "fc4783cc-3629-4000-b2e7-756b153ef224", "content": "CVE-2026-117601 Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.\nhttps://www.cve.org/CVERecord?id=CVE-2026-117601https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5vhttps://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999ebhttps://www.vulncheck.com/advisories/electrum-before-4.8.3-missing-signature-verification-of-mempool-transactions#spesmilo #electrum#CVE_2026_117601#bot", "url": "https://infosec.exchange/users/cve/statuses/117513186264147151"}, {"timestamp": "2026-10-27T14:16:39Z", "date_only": false, "value": "2026-10-27T14:16:39Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6JP4-8V48-CC5V", "record": "GHSA-6JP4-8V48-CC5V", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-27T14:16:39.947Z", "date_only": false, "value": "2026-10-27T14:16:39.947", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-117601", "record": "FKIE_CVE-2026-117601", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-27T14:50:07.017Z", "date_only": false, "value": "2026-10-27T14:50:07.017065Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3myuibz4mn32y", "record": "CVE-2026-117601", "field": "creation_timestamp", "uuid": "a788308a-97a6-4a5f-8007-df494b9a8abb", "content": "CVE-2026-117601\nVersions of the Electrum Bitcoin wallet before 4.8.3 do not correctly check the digital signatures on transactions that are still waiting in the network's memory pool. A rogue server can swap a just\u2011sent\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3myuibz4mn32y"}, {"timestamp": "2026-10-27T14:56:57.879Z", "date_only": false, "value": "2026-10-27T14:56:57.879012Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5oxn55tf6524v", "record": "CVE-2026-117601", "field": "creation_timestamp", "uuid": "7c93eec9-dd94-44d7-8dff-3c06aa9b6cf7", "content": "CVE-2026-117601 - Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions\nCVE ID : CVE-2026-117601\n \n Published : Oct. 27, 2026, 2:16 p.m. | 7\u00a0minutes ago\n \n Description : Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirm...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/5oxn55tf6524v"}, {"timestamp": "2026-10-27T15:35:05.177Z", "date_only": false, "value": "2026-10-27T15:35:05.177465Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatroundup.bsky.social/post/3myuksfgbx424", "record": "CVE-2026-117601", "field": "creation_timestamp", "uuid": "c49a1eca-22c7-4373-bca3-b91348e5ace5", "content": "\ud83d\udea8 Critical: CVE-2026-117601 in spesmilo electrum, CVSS 9.3. Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing\u2026 No public exploit reported yet. #CVE #infosec\n\nthreatroundup.com/cve/cve-2026...", "url": "https://bsky.app/profile/threatroundup.bsky.social/post/3myuksfgbx424"}, {"timestamp": "2026-10-27T16:09:02.284Z", "date_only": false, "value": "2026-10-27T16:09:02.284081Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3myump53lrd2v", "record": "CVE-2026-117601", "field": "creation_timestamp", "uuid": "ff055e4b-5c5e-4293-a0a9-434ab16c1756", "content": "\ud83d\udea8 CVE-2026-117601 \u2014 CVSS 9.3 CRITICAL\n\nElectrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-117601\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3myump53lrd2v"}, {"timestamp": "2026-10-28T15:56:45.794Z", "date_only": false, "value": "2026-10-28T15:56:45.794314Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-117601", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-28T15:56:45.794Z", "date_only": false, "value": "2026-10-28T15:56:45.794314Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-117601", "record": "FKIE_CVE-2026-117601", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-28T16:16:43.752Z", "date_only": false, "value": "2026-10-28T16:16:43.752Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-117601", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-28T16:16:43.752Z", "date_only": false, "value": "2026-10-28T16:16:43.752Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-117601", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T17:18:17.600Z", "date_only": false, "value": "2026-10-28T17:18:17.600", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-117601", "record": "FKIE_CVE-2026-117601", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-28T21:23:44Z", "date_only": false, "value": "2026-10-28T21:23:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6JP4-8V48-CC5V", "record": "GHSA-6JP4-8V48-CC5V", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T21:23:44Z", "date_only": false, "value": "2026-10-28T21:23:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6JP4-8V48-CC5V", "record": "GHSA-6JP4-8V48-CC5V", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-28T22:30:52Z", "date_only": false, "value": "2026-10-28T22:30:52.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/955df8d6b5ddbc2555072e424055bc7c", "record": "CVE-2026-117601", "field": "creation_timestamp", "uuid": "3a659eff-f1dd-49d6-9b82-26bdbed0bda9", "content": "# CVE-2026-117601: CVE-2026-117601: Improper Cryptographic Signature Verification in Electrum Bitcoin Wallet\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-10-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-117601\n\n## Summary\nA missing cryptographic signature verification vulnerability exists in Electrum Bitcoin Wallet versions prior to 4.8.3. In Electrum's Simplified Payment Verification (SPV) architecture, the client failed to validate input signatures on unconfirmed mempool transactions received from connected Electrum servers. A malicious Electrum server can exploit this flaw by intercepting a legitimate user broadcast, suppressing it, and returning a spoofed unconfirmed transaction with an invalid signature and zero fee that redirects the user's UTXOs to an attacker-controlled address. When the user initiates a Replace-By-Fee (RBF) action to accelerate the seemingly stuck transaction, Electrum signs the spoofed outputs with the user's private keys, resulting in the direct theft of funds.\n\n## TL;DR\nElectrum Bitcoin Wallet versions prior to 4.8.3 fail to verify cryptographic signatures on wallet-owned inputs for unconfirmed transactions received from Electrum servers. A malicious server can inject a spoofed, zero-fee mempool transaction spending the user's funds to an attacker address and induce the user to sign it via a Replace-By-Fee (RBF) fee bump.\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-117601 / GHSA-6jp4-8v48-cc5v\n- **CWE Classification**: CWE-347: Improper Verification of Cryptographic Signature\n- **CVSS v4.0 / v3.1 Score**: 9.3 (Critical) / 7.5 (High)\n- **EPSS Score**: 0.18% (7.12th Percentile)\n- **Attack Vector**: Network (Malicious Electrum Server / SPV Protocol Manipulation)\n- **Affected Versions**: Electrum < 4.8.3\n- **Patched Version**: Electrum 4.8.3\n- **Primary Impact**: Theft of Bitcoin funds via Replace-By-Fee (RBF) transaction poisoning\n\n## Affected Systems\n\n- Electrum Bitcoin Wallet (spesmilo/electrum)\n- **Electrum Bitcoin Wallet**: < 4.8.3 (Fixed in: `4.8.3`)\n\n## Mitigation\n\n- Upgrade Electrum Bitcoin Wallet to version 4.8.3 or later to enforce local cryptographic signature verification on mempool inputs.\n- Connect exclusively to a trusted, self-hosted Electrum server (Fulcrum, ElectrumX, or Electrs) backed by a personal full node using the --oneserver configuration flag.\n- Verify destination addresses and output amounts on a hardware wallet's trusted display prior to approving any Replace-By-Fee (RBF) or fee-bumping transaction.\n- Avoid relying on unconfirmed (0-conf) transaction states for automated financial workflows or point-of-sale systems.\n\n**Remediation Steps:**\n1. Download the official Electrum 4.8.3 (or newer) release package from the official project repository or website.\n2. Verify the GPG signature of the downloaded Electrum binary or source tarball against the maintainers' public keys.\n3. Install the updated version and restart any running Electrum GUI or headless daemon instances.\n4. In Electrum Network Settings (Tools -> Network), optionally disable 'Select server automatically' and configure a known trusted server endpoint.\n\n## References\n\n- [GitHub Security Advisory GHSA-6jp4-8v48-cc5v](https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v)\n- [Electrum Patch Commit 90fe30822561e515a9d2d6e5a352cc07780999eb](https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb)\n- [VulnCheck Advisory: Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions](https://www.vulncheck.com/advisories/electrum-before-4.8.3-missing-signature-verification-of-mempool-transactions)\n- [NVD - CVE-2026-117601](https://nvd.nist.gov/vuln/detail/CVE-2026-117601)\n- [CVE.org Record: CVE-2026-117601](https://www.cve.org/CVERecord?id=CVE-2026-117601)\n- [CVE List V5 JSON Record for CVE-2026-117601](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/117xxx/CVE-2026-117601.json)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-117601) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/955df8d6b5ddbc2555072e424055bc7c"}, {"timestamp": "2026-11-02T13:36:47.296Z", "date_only": false, "value": "2026-11-02T13:36:47.296682Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/secquill.com/post/3mzdgyf6psq24", "record": "CVE-2026-117601", "field": "creation_timestamp", "uuid": "4032e5e0-9a35-4185-a860-b69d2b70485f", "content": "Upgrade electrum to 4.8.3: critical signature verification issue tracked as CVE-2026-117601\n\nA reviewed GitHub security advisory rates CVE-2026-117601 in the PyPI package electrum critical. Affected versions are < 4.8.3; version 4.8.3 contains the fix.\n\n#cybersecurity #vulnerability #opensource", "url": "https://bsky.app/profile/secquill.com/post/3mzdgyf6psq24"}], "metrics": {"as_of": "2026-11-12T12:42:08.043Z", "anchors": {"origin": {"timestamp": "2026-10-24T00:00:00Z", "date_only": false, "value": "2026-10-24T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-117601", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-24T00:00:00Z", "date_only": false, "value": "2026-10-24T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-117601", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1687328.043168, "hours": 468.7022342133333, "days": 19.529259758888887, "min_seconds": 1600928.043168, "max_seconds": 1687328.043168, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-24T00:00:00Z", "date_only": false, "value": "2026-10-24T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-117601", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T12:42:08.043Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}