Executive Summary
In September 2026, skilled threat actors demonstrated machine-speed exploitation of CVE-2026-39987, a critical remote code execution vulnerability in Marimo notebooks with a CVSS score of 9.3. The attackers pivoted from initial compromise to SSH bastion host access in just eight seconds, using hand-crafted Python toolkits without AI assistance. Over a nine-hour session, they executed over 850 interactive commands, harvested AWS credentials from Secrets Manager, and established persistent access to cloud infrastructure, showcasing how human expertise can rival AI-assisted attacks in speed and stealth.
This incident highlights the evolving threat landscape where skilled human operators are matching the speed traditionally expected from AI-powered attacks, while demonstrating superior evasion techniques that bypass automated defenses and detection systems designed to catch machine-generated attack patterns.
Why This Matters Now
This incident proves that human threat actors can achieve AI-level attack speeds while evading AI-focused defenses, challenging assumptions about automated threat detection and requiring organizations to prepare for hybrid human-AI attack scenarios that combine machine speed with human creativity.
Attack Path Analysis
A skilled human attacker exploited CVE-2026-39987 in Marimo notebook via WebSocket connection from 172.236.12.17, gained interactive shell access, harvested AWS credentials from the compromised instance, retrieved SSH private keys from AWS Secrets Manager, and pivoted to SSH bastion host within 8 seconds. The attacker then maintained a 9-hour session issuing over 850 commands, deployed custom Python toolkits, established asyncssh listener on attacker-controlled VPS, and demonstrated advanced tradecraft avoiding detection mechanisms.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attacker exploited CVE-2026-39987 RCE vulnerability in Marimo notebook via WebSocket connection to /terminal/ws endpoint from IP 172.236.12.17, achieving pre-authenticated remote code execution
Related CVEs
CVE-2026-39987
CVSS 9.8Pre-authenticated remote code execution vulnerability in Marimo notebook that allows attackers to execute arbitrary code via WebSocket endpoint.
Affected Products:
Marimo Marimo Notebook – All versions
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter: Python
Unsecured Credentials: Credentials In Files
Credentials from Password Stores: Cloud Secrets Management Stores
Remote Services: SSH
Process Discovery
Remote Access Software
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – External Penetration Testing
Control ID: 11.3.1
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.15
CISA ZTMM 2.0 – Software platforms and applications within the organization are inventoried
Control ID: ID.AM-2
DORA – ICT risk management framework
Control ID: Article 11
NIS2 Directive – Cybersecurity risk-management measures
Control ID: Article 21
ISO 27001 – Management of technical vulnerabilities
Control ID: A.12.6.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical exposure to Marimo RCE exploits targeting cloud infrastructure, requiring enhanced east-west traffic security and zero trust segmentation for multicloud environments.
Computer Software/Engineering
High risk from rapid exploitation of development environments, necessitating Kubernetes security controls and egress filtering to prevent credential harvesting attacks.
Financial Services
Severe threat to AWS-hosted applications with SSH bastion access, demanding encrypted traffic controls and anomaly detection for PCI compliance protection.
Health Care / Life Sciences
Vulnerable to Redis cryptomining campaigns targeting patient data systems, requiring inline IPS and threat detection capabilities for HIPAA compliance maintenance.
Sources
- Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Secondshttps://thehackernews.com/2026/09/human-attacker-exploits-marimo-rce.htmlVerified
- Machine Speed, Hold the AI: Hand-Rolled Marimo CVE-2026-39987 Exploithttps://www.sysdig.com/blog/machine-speed-hold-the-ai-hand-rolled-marimo-cve-2026-39987-exploitVerified
- Vulnerability Response in the AI Discovery Erahttps://www.sysdig.com/blog/vulnerability-response-in-the-ai-discovery-eraVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely reduce the blast radius of this sophisticated attack by constraining lateral movement paths and limiting access to sensitive AWS resources. The segmentation controls could have restricted the attacker's ability to pivot from the compromised Marimo notebook to the SSH bastion host.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The compromise of the Marimo notebook would likely still occur, but CNSF visibility controls could have provided earlier detection of the WebSocket exploitation and subsequent shell access patterns.
Control: Zero Trust Segmentation
Mitigation: Zero trust segmentation would likely constrain the scope of AWS service access from the compromised workload, potentially limiting which Secrets Manager resources could be accessed based on workload identity and policy enforcement.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely block or significantly delay the SSH connection to the bastion host by enforcing segmentation policies between the compromised notebook workload and internal infrastructure components.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely detect and flag the sustained outbound SSH connections to external VPS infrastructure, reducing the attacker's ability to maintain covert command channels undetected.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies would likely constrain data exfiltration by enforcing strict outbound connectivity rules and potentially blocking unauthorized data transfers through the SSH tunnel to external destinations.
The overall blast radius would likely be reduced to the initially compromised workload and immediately adjacent resources, limiting the attacker's ability to access sensitive production systems or expand their foothold.
Impact at a Glance
Affected Business Functions
- Cloud Infrastructure Services
- Application Development Platforms
- Data Analytics and Notebook Services
- SSH Bastion Host Management
Estimated downtime: 1 days
Estimated loss: $50,000
AWS Secrets Manager credentials, SSH private keys, and potential access to bastion host infrastructure with unknown scope of downstream systems
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation with least privilege access controls to prevent credential harvesting from compromising multiple systems
- • Deploy East-West Traffic Security monitoring to detect and block lateral movement attempts between internal resources
- • Enable Egress Security & Policy Enforcement to prevent unauthorized outbound connections and detect covert channels to external VPS
- • Establish Multicloud Visibility & Control with anomaly detection to identify suspicious interactive sessions and repeated command execution patterns
- • Deploy Inline IPS (Suricata) with updated signatures to detect and block known CVE exploitation attempts like CVE-2026-39987 at network boundaries
