Security readout for executives and security teams
Plain-English summary
Nx Console 18.95.0 was a maliciously compromised IDE extension release. It was briefly available in Visual Studio Marketplace and OpenVSX on May 19, 2026. Organizations that installed or auto-updated to that exact version should treat affected developer machines as potentially compromised and move quickly to upgrade and investigate.
Executive priority
Treat this as urgent if your developers use Nx Console. The exposure window was short, but compromised developer tooling can affect source code, credentials, and build trust. Prioritize identifying affected machines, upgrading, and investigating before assuming the issue is resolved.
Technical view
CVE-2026-48027 covers embedded malicious code in nrwl nx-console version 18.95.0, classified as CWE-506. Sources identify version 18.100.0 as not compromised. The CVSS 4.0 score is 9.3, with high impact to confidentiality, integrity, and availability. CISA KEV inclusion supports known exploitation status.
Likely exposure
Exposure is limited to systems that installed Nx Console exactly version 18.95.0 from Visual Studio Marketplace or OpenVSX during the brief publication windows. Developer workstations, CI-like environments, and remote development hosts using that extension are the main concern.
Exploitation context
The source bundle states the malicious version was available for about 18 minutes in Visual Studio Marketplace and about 36 minutes in OpenVSX. CISA KEV listing supports active exploitation. The supplied sources do not provide safe details for reproducing the malicious behavior.
Researcher notes
Evidence is strong for the affected version, timing, severity, and remediation version. The supplied bundle does not include full malware behavior details. Base validation on the vendor advisory, postmortem IoCs, package provenance, local extension inventory, and CISA KEV status.
Mitigation direction
- Upgrade Nx Console to version 18.100.0 or later vendor-confirmed safe release.
- Remove Nx Console 18.95.0 from all developer environments immediately.
- Review vendor advisory and postmortem indicators of compromise.
- Investigate affected machines before restoring normal developer access.
- Rotate credentials or tokens if investigation suggests exposure.
Validation and detection
- Inventory installed Nx Console versions across developer endpoints and remote workspaces.
- Check whether version 18.95.0 was installed during the marketplace exposure windows.
- Review Nx postmortem indicators of compromise against affected systems.
- Confirm no remaining installations report Nx Console 18.95.0.
- Document affected users, hosts, timestamps, and remediation actions.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-506: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-48027 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- Yes
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2026-48027 added to CISA KEV
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-05-27T00:00:00.000Z: CVE-2026-48027 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847wCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/nrwl/nx-console/issues/3139CVE reference, GitHub_M · x_refsource_MISC
- https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromiseCVE reference, GitHub_M · x_refsource_MISC
- https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromisedCVE reference, GitHub_M · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Embedded Malicious Code
Embedded Malicious Code represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.