{"metadata": {"vulnerability": "CVE-2026-40860", "count": 118, "kinds": {"milestone": 12, "sighting": 7, "kev": 0, "other": 99}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0129", "record": "NCSC-2026-0129", "field": "document.tracking.generator.date"}, {"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0230", "record": "NCSC-2026-0230", "field": "document.tracking.generator.date"}, {"timestamp": "2026-03-04T06:06:00Z", "date_only": false, "value": "2026-03-04T06:06:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.9.release_date"}, {"timestamp": "2026-03-04T07:02:26.064Z", "date_only": false, "value": "2026-03-04T07:02:26.064000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.9.discovery_date"}, {"timestamp": "2026-03-19T22:36:15.112Z", "date_only": false, "value": "2026-03-19T22:36:15.112000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.8.release_date"}, {"timestamp": "2026-03-19T23:02:37.111Z", "date_only": false, "value": "2026-03-19T23:02:37.111109+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.8.discovery_date"}, {"timestamp": "2026-03-25T00:00:00Z", "date_only": false, "value": "2026-03-25T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-03-25T18:02:00.463Z", "date_only": false, "value": "2026-03-25T18:02:00.463244+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-03-27T19:54:15.586Z", "date_only": false, "value": "2026-03-27T19:54:15.586000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.12.release_date"}, {"timestamp": "2026-03-27T19:55:23.135Z", "date_only": false, "value": "2026-03-27T19:55:23.135000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.13.release_date"}, {"timestamp": "2026-03-27T21:01:59.865Z", "date_only": false, "value": "2026-03-27T21:01:59.865839+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.12.discovery_date"}, {"timestamp": "2026-03-27T21:02:13.396Z", "date_only": false, "value": "2026-03-27T21:02:13.396015+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.13.discovery_date"}, {"timestamp": "2026-04-07T13:07:08.679Z", "date_only": false, "value": "2026-04-07T13:07:08.679000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.14.release_date"}, {"timestamp": "2026-04-07T14:01:09.792Z", "date_only": false, "value": "2026-04-07T14:01:09.792155+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.14.discovery_date"}, {"timestamp": "2026-04-08T13:32:28.935Z", "date_only": false, "value": "2026-04-08T13:32:28.935000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-04-08T14:01:02.911Z", "date_only": false, "value": "2026-04-08T14:01:02.911884+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-04-14T10:59:10.193Z", "date_only": false, "value": "2026-04-14T10:59:10.193000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-04-14T10:59:10.193Z", "date_only": false, "value": "2026-04-14T10:59:10.193000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-04-14T12:01:05.768Z", "date_only": false, "value": "2026-04-14T12:01:05.768902+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-04-14T12:01:05.768Z", "date_only": false, "value": "2026-04-14T12:01:05.768902+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-04-15T08:56:34.057Z", "date_only": false, "value": "2026-04-15T08:56:34.057000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-04-15T08:59:12.677Z", "date_only": false, "value": "2026-04-15T08:59:12.677000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-04-15T09:06:15.617Z", "date_only": false, "value": "2026-04-15T09:06:15.617000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-04-15T09:06:37.939Z", "date_only": false, "value": "2026-04-15T09:06:37.939000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-04-15T10:00:59.672Z", "date_only": false, "value": "2026-04-15T10:00:59.672015+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-04-15T10:01:17.415Z", "date_only": false, "value": "2026-04-15T10:01:17.415497+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-04-15T10:01:27.769Z", "date_only": false, "value": "2026-04-15T10:01:27.769752+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-04-15T10:01:32.911Z", "date_only": false, "value": "2026-04-15T10:01:32.911938+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-04-15T12:44:39.673Z", "date_only": false, "value": "2026-04-15T12:44:39.673Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-40860", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-04-26T19:27:35.032Z", "date_only": false, "value": "2026-04-26T19:27:35.032201Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkgbyr3nyr2v", "record": "CVE-2026-40860", "field": "creation_timestamp", "uuid": "b5115e84-cd28-4bc3-a108-f0c73db23953", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkgbyr3nyr2v"}, {"timestamp": "2026-04-26T22:00:00Z", "date_only": false, "value": "2026-04-26T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1271", "record": "WID-SEC-W-2026-1271", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-04-26T22:00:00Z", "date_only": false, "value": "2026-04-26T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1271", "record": "WID-SEC-W-2026-1271", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-04-26T22:00:00Z", "date_only": false, "value": "2026-04-26T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1271", "record": "WID-SEC-W-2026-1271", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-04-27T00:00:00Z", "date_only": false, "value": "2026-04-27T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-40860", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2026-04-27T00:00:00Z", "date_only": false, "value": "2026-04-27T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-40860", "record": "FKIE_CVE-2026-40860", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-04-27T08:03:19.616Z", "date_only": false, "value": "2026-04-27T08:03:19.616Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-40860", "field": "containers.adp.2.datePublic"}, {"timestamp": "2026-04-27T08:03:19.616Z", "date_only": false, "value": "2026-04-27T08:03:19.616Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-40860", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-04-27T08:03:19.616Z", "date_only": false, "value": "2026-04-27T08:03:19.616000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.18.release_date"}, {"timestamp": "2026-04-27T08:03:19.616Z", "date_only": false, "value": "2026-04-27T08:03:19.616000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-04-27T08:03:19.616Z", "date_only": false, "value": "2026-04-27T08:03:19.616Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-40860", "field": "containers.adp.2.timeline.1.time"}, {"timestamp": "2026-04-27T08:03:19.616Z", "date_only": false, "value": "2026-04-27T08:03:19.616Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-40860", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-27T08:23:20.354Z", "date_only": false, "value": "2026-04-27T08:23:20.354000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.16.release_date"}, {"timestamp": "2026-04-27T08:55:18.390Z", "date_only": false, "value": "2026-04-27T08:55:18.390Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2026-40860", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-27T08:59:50.652Z", "date_only": false, "value": "2026-04-27T08:59:50.652000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.22.release_date"}, {"timestamp": "2026-04-27T09:16:01Z", "date_only": false, "value": "2026-04-27T09:16:01Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M5VH-3FW5-5WGH", "record": "GHSA-M5VH-3FW5-5WGH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-04-27T09:16:01.770Z", "date_only": false, "value": "2026-04-27T09:16:01.770", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-40860", "record": "FKIE_CVE-2026-40860", "field": "published"}, {"timestamp": "2026-04-27T09:34:39Z", "date_only": false, "value": "2026-04-27T09:34:39Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M5VH-3FW5-5WGH", "record": "GHSA-M5VH-3FW5-5WGH", "field": "published"}, {"timestamp": "2026-04-27T09:38:55.466Z", "date_only": false, "value": "2026-04-27T09:38:55.466000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.17.release_date"}, {"timestamp": "2026-04-27T09:38:55.466Z", "date_only": false, "value": "2026-04-27T09:38:55.466000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-04-27T09:40:28.107Z", "date_only": false, "value": "2026-04-27T09:40:28.107000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.15.release_date"}, {"timestamp": "2026-04-27T09:42:39.799Z", "date_only": false, "value": "2026-04-27T09:42:39.799000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.11.release_date"}, {"timestamp": "2026-04-27T09:58:48.787Z", "date_only": false, "value": "2026-04-27T09:58:48.787000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.10.release_date"}, {"timestamp": "2026-04-27T10:01:11.044Z", "date_only": false, "value": "2026-04-27T10:01:11.044535+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.18.discovery_date"}, {"timestamp": "2026-04-27T10:01:11.044Z", "date_only": false, "value": "2026-04-27T10:01:11.044535+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-04-27T10:01:11.044Z", "date_only": false, "value": "2026-04-27T10:01:11.044Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-40860", "field": "containers.adp.2.timeline.0.time"}, {"timestamp": "2026-04-27T10:01:14.347Z", "date_only": false, "value": "2026-04-27T10:01:14.347755+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.16.discovery_date"}, {"timestamp": "2026-04-27T10:01:29.162Z", "date_only": false, "value": "2026-04-27T10:01:29.162466+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.22.discovery_date"}, {"timestamp": "2026-04-27T10:01:32.316Z", "date_only": false, "value": "2026-04-27T10:01:32.316756+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.15.discovery_date"}, {"timestamp": "2026-04-27T10:01:35.538Z", "date_only": false, "value": "2026-04-27T10:01:35.538625+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.17.discovery_date"}, {"timestamp": "2026-04-27T10:01:35.538Z", "date_only": false, "value": "2026-04-27T10:01:35.538625+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-04-27T10:01:41.829Z", "date_only": false, "value": "2026-04-27T10:01:41.829738+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.11.discovery_date"}, {"timestamp": "2026-04-27T11:01:08.808Z", "date_only": false, "value": "2026-04-27T11:01:08.808664+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.10.discovery_date"}, {"timestamp": "2026-04-27T22:00:00Z", "date_only": false, "value": "2026-04-27T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1271", "record": "WID-SEC-W-2026-1271", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-04-27T23:15:19.194Z", "date_only": false, "value": "2026-04-27T23:15:19.194000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.19.release_date"}, {"timestamp": "2026-04-27T23:29:51.946Z", "date_only": false, "value": "2026-04-27T23:29:51.946000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.20.release_date"}, {"timestamp": "2026-04-27T23:32:58.596Z", "date_only": false, "value": "2026-04-27T23:32:58.596000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.21.release_date"}, {"timestamp": "2026-04-28T00:01:55.408Z", "date_only": false, "value": "2026-04-28T00:01:55.408040+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.20.discovery_date"}, {"timestamp": "2026-04-28T00:01:58.716Z", "date_only": false, "value": "2026-04-28T00:01:58.716976+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.21.discovery_date"}, {"timestamp": "2026-04-28T00:02:02.075Z", "date_only": false, "value": "2026-04-28T00:02:02.075124+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.19.discovery_date"}, {"timestamp": "2026-04-28T03:55:40.595Z", "date_only": false, "value": "2026-04-28T03:55:40.595Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-40860", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-29T08:12:14.412Z", "date_only": false, "value": "2026-04-29T08:12:14.412477Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0129", "record": "NCSC-2026-0129", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-04-29T08:12:14.412Z", "date_only": false, "value": "2026-04-29T08:12:14.412477Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0129", "record": "NCSC-2026-0129", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-04-29T08:12:14.412Z", "date_only": false, "value": "2026-04-29T08:12:14.412477Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0129", "record": "NCSC-2026-0129", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-05-14T16:55:24Z", "date_only": false, "value": "2026-05-14T16:55:24+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-05-14T16:55:24Z", "date_only": false, "value": "2026-05-14T16:55:24+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-05-14T16:55:24Z", "date_only": false, "value": "2026-05-14T16:55:24+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-05-14T22:00:00Z", "date_only": false, "value": "2026-05-14T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1271", "record": "WID-SEC-W-2026-1271", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-05-20T22:00:00Z", "date_only": false, "value": "2026-05-20T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1271", "record": "WID-SEC-W-2026-1271", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-06-02T11:27:09Z", "date_only": false, "value": "2026-06-02T11:27:09+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-06-02T11:27:09Z", "date_only": false, "value": "2026-06-02T11:27:09+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-06-02T11:27:09Z", "date_only": false, "value": "2026-06-02T11:27:09+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-06-02T22:00:00Z", "date_only": false, "value": "2026-06-02T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1271", "record": "WID-SEC-W-2026-1271", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2026-06-02T22:00:00Z", "date_only": false, "value": "2026-06-02T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1271", "record": "WID-SEC-W-2026-1271", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-06-03T06:12:28.812Z", "date_only": false, "value": "2026-06-03T06:12:28.812+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1271", "record": "WID-SEC-W-2026-1271", "field": "document.tracking.generator.date"}, {"timestamp": "2026-07-06T19:53:52.948Z", "date_only": false, "value": "2026-07-06T19:53:52.948448Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpyul5kuor2t", "record": "CVE-2026-40860", "field": "creation_timestamp", "uuid": "6ef91b99-d875-4110-a6df-3c1bb523f15b", "content": "CVE-2026-43866: Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpyul5kuor2t"}, {"timestamp": "2026-07-13T22:00:00Z", "date_only": false, "value": "2026-07-13T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2308", "record": "WID-SEC-W-2026-2308", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-07-13T22:00:00Z", "date_only": false, "value": "2026-07-13T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2308", "record": "WID-SEC-W-2026-2308", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-07-13T22:00:00Z", "date_only": false, "value": "2026-07-13T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2308", "record": "WID-SEC-W-2026-2308", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-07-13T22:00:05.507Z", "date_only": false, "value": "2026-07-13T22:00:05.507380Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/92809", "record": "CVE-2026-40860", "field": "creation_timestamp", "uuid": "51fb94f3-1f8e-4ddd-b6e5-7ea749ced26e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-40860\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-10 09:13:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-40860 \u2014 Apache Camel camel-jms/sjms/amqp JMS ObjectMessage unsafe deserialization (RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/92809"}, {"timestamp": "2026-07-14T00:00:00Z", "date_only": true, "value": "2026-07-14", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0877", "record": "CERTFR-2026-AVI-0877", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-07-14T00:00:07.413Z", "date_only": false, "value": "2026-07-14T00:00:07.413939Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/92809", "record": "CVE-2026-40860", "field": "creation_timestamp", "uuid": "dd604492-e200-4e72-a493-bf574577c2ca", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-40860\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-10 09:13:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-40860 \u2014 Apache Camel camel-jms/sjms/amqp JMS ObjectMessage unsafe deserialization (RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/92809"}, {"timestamp": "2026-07-14T13:47:14.712Z", "date_only": false, "value": "2026-07-14T13:47:14.712870Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0230", "record": "NCSC-2026-0230", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-07-14T13:47:14.712Z", "date_only": false, "value": "2026-07-14T13:47:14.712870Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0230", "record": "NCSC-2026-0230", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-07-15T00:00:00Z", "date_only": false, "value": "2026-07-15T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0877", "record": "CERTFR-2026-AVI-0877", "field": "last_revision_date"}, {"timestamp": "2026-07-15T00:00:00Z", "date_only": false, "value": "2026-07-15T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0877", "record": "CERTFR-2026-AVI-0877", "field": "initial_release_date"}, {"timestamp": "2026-07-15T00:00:00Z", "date_only": false, "value": "2026-07-15T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0877", "record": "CERTFR-2026-AVI-0877", "field": "revisions.0.revision_date"}, {"timestamp": "2026-07-16T19:00:13.215Z", "date_only": false, "value": "2026-07-16T19:00:13.215089Z", "kind": "sighting", "label": "Seen", "source": "Telegram/IYbPLk4ERTEBv3PHVDATQd8EaZ4Sc0OJ99RE8uvxfU7J1W8", "record": "CVE-2026-40860", "field": "creation_timestamp", "uuid": "136c5586-99a9-4a37-b6f7-d0c591695dc6"}, {"timestamp": "2026-07-17T08:17:06.607Z", "date_only": false, "value": "2026-07-17T08:17:06.607312Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0230", "record": "NCSC-2026-0230", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-07-17T08:17:06.607Z", "date_only": false, "value": "2026-07-17T08:17:06.607312Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0230", "record": "NCSC-2026-0230", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-07-18T00:00:43.681Z", "date_only": false, "value": "2026-07-18T00:00:43.681434Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/IYbPLk4ERTEBv3PHVDATQd8EaZ4Sc0OJ99RE8uvxfU7J1W8", "record": "CVE-2026-40860", "field": "creation_timestamp", "uuid": "d42cd204-e683-431e-b8b0-9095cf11add5"}, {"timestamp": "2026-07-28T22:00:00Z", "date_only": false, "value": "2026-07-28T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2308", "record": "WID-SEC-W-2026-2308", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-07-28T22:00:00Z", "date_only": false, "value": "2026-07-28T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2308", "record": "WID-SEC-W-2026-2308", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-07-29T05:52:55.722Z", "date_only": false, "value": "2026-07-29T05:52:55.722+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2308", "record": "WID-SEC-W-2026-2308", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-26T15:19:50Z", "date_only": false, "value": "2026-08-26T15:19:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M5VH-3FW5-5WGH", "record": "GHSA-M5VH-3FW5-5WGH", "field": "modified"}, {"timestamp": "2026-09-09T13:19:51.590Z", "date_only": false, "value": "2026-09-09T13:19:51.590", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-40860", "record": "FKIE_CVE-2026-40860", "field": "lastModified"}, {"timestamp": "2026-09-10T12:04:54.245Z", "date_only": false, "value": "2026-09-10T12:04:54.245Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-40860", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-10T12:04:54.245Z", "date_only": false, "value": "2026-09-10T12:04:54.245Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-40860", "field": "containers.adp.2.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T11:18:47.014Z", "date_only": false, "value": "2026-10-19T11:18:47.014992Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117467297958204229", "record": "CVE-2026-40860", "field": "creation_timestamp", "uuid": "56521051-da2a-4d66-935a-b796b14fb0d3", "content": "CVE-2026-88900 Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\nJGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an ObjectMessage, which is the message type the Camel jgroups producer sends, JGroups Java-deserializes the payload through an ObjectInputStream on its own receive thread as the message arrives, and getObject() returns the resulting object. No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. Unless a channel or the channelProperties option is configured, the consumer creates its channel with new JChannel(), the stock JGroups protocol stack, which multicasts over UDP without the AUTH protocol and without encryption, so any host able to reach the cluster's multicast group or bind port can join the cluster and send messages to the consumer without credentials. Such a host could send a crafted serialized object that leads to remote code execution in the Camel process when a usable deserialization gadget chain is present on the classpath, and no non-default option was required on the consumer. Because JGroups materializes the object before Camel's receiver runs, a check performed by Camel can only inspect the deserialized result and cannot stop code that runs during deserialization, so closing the issue also requires a control that applies before the payload is read, as described in the mitigation. Exploitation requires network access to the cluster's multicast group or bind port, which with the default UDP multicast transport means a host on an adjacent network, and a usable gadget chain on the classpath, which is why the severity is assessed as high rather than critical.\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.\nhttps://www.cve.org/CVERecord?id=CVE-2026-88900https://camel.apache.org/security/CVE-2026-88900.htmlhttps://issues.apache.org/jira/browse/CAMEL-24676https://issues.apache.org/jira/browse/CAMEL-25223https://github.com/apache/camel/pull/26267https://github.com/apache/camel/pull/26281https://github.com/apache/camel/pull/26283https://github.com/apache/camel/pull/27205https://github.com/apache/camel/pull/26282https://github.com/apache/camel/pull/26326https://camel.apache.org/security/CVE-2026-40860.html#apache #ApacheSoftwareFoundation #ApacheCamel#CVE_2026_88900#bot", "url": "https://infosec.exchange/users/cve/statuses/117467297958204229"}, {"timestamp": "2026-10-19T16:56:57Z", "date_only": false, "value": "2026-10-19T16:56:57+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-19T16:56:57Z", "date_only": false, "value": "2026-10-19T16:56:57+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-19T16:56:57Z", "date_only": false, "value": "2026-10-19T16:56:57+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:22453", "record": "RHSA-2026:22453", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-21T01:02:22Z", "date_only": false, "value": "2026-10-21T01:02:22+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-21T01:02:22Z", "date_only": false, "value": "2026-10-21T01:02:22+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-21T01:02:22Z", "date_only": false, "value": "2026-10-21T01:02:22+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:17668", "record": "RHSA-2026:17668", "field": "document.tracking.current_release_date"}]}