Marimo RCE: 10 Hours From Disclosure to Exploitation

A critical remote code execution (RCE) flaw in Marimo, tracked as CVE-2026-39987, was reportedly exploited in the wild within a mere 10 hours of its public disclosure. This lightning-fast operationalization of a zero-day is a stark reminder of how quickly adversaries move once vulnerabilities hit the streets.

According to Cyber Threat Intelligence, this rapid exploitation window highlights the aggressive posture of threat actors, who are constantly scanning public disclosures and proof-of-concept (PoC) releases for immediate leverage. Organizations leveraging Marimo need to understand that the moment a critical RCE like this drops, the clock starts ticking not in days, but in hours, for potential compromise. It’s a race against time, and in this instance, the attackers clearly won the first lap.