A newly disclosed Linux kernel vulnerability, CVE-2026-53359, dubbed Januscape, has exposed a critical weakness in the Linux Kernel-based Virtual Machine (KVM) hypervisor. The flaw resides in the shadow MMU code and allows attackers to escape a virtual machine (VM), compromise the underlying host, and potentially execute arbitrary code.  Security researchers warn that the issue poses a serious risk to multi-tenant x86 public cloud environments running untrusted guests with nested virtualization enabled. 

Januscape Flaw Affects KVM Shadow MMU Code 

Discovered by security researcher Hyunwoo Kim (@v4bel), CVE-2026-53359 is described as a use-after-free vulnerability in the KVM/x86 shadow MMU code. According to Kim, the flaw can be triggered entirely from within a guest VM to corrupt the host kernel's shadow page state, ultimately breaking guest-to-host isolation. Kim demonstrated Januscape as a zero-day during Google's KVMCTF bug bounty program, which offers rewards of up to $250,000 for complete VM escape vulnerabilities. The researcher noted that this is the first publicly known KVM guest-to-host exploit research that can be triggered on both Intel and AMD systems, rather than being limited to a single architecture.

CVE-2026-53359 impact and affected systems 

Successful exploitation of Januscape can result in complete compromise of the host. Kim explained, "An attacker who has rented just a single instance on a public cloud could panic the host kernel to take down every other tenant VM on the same physical machine (DoS), or run code with root privilege on the host to take over the host and all the guests on it (RCE)."  In addition to VM escape, CVE-2026-53359 can enable local privilege escalation on certain Linux distributions. On systems such as Red Hat Enterprise Linux (RHEL), where /dev/kvm is world-writable (0666), unprivileged users may escalate privileges to root.  The vulnerability requires root privileges inside the guest VM, which public cloud users typically receive by default. If root access is unavailable, Kim said attackers could chain the flaw with another privilege escalation vulnerability, such as Dirty Frag. 

Patch availability and disclosure timeline 

According to the official GitHub advisory, Januscape remained hidden in the Linux kernel for roughly 16 years. The affected code spans the commit from 2032a93d66fa (August 1, 2010) through 81ccda30b4e8 (June 16, 2026). The issue was patched in the mainline Linux kernel on June 19, 2026, when commit 81ccda30b4e8 was merged.  The advisory states that a proof-of-concept (PoC) executed inside a guest VM can reliably trigger a host's kernel panic within seconds or minutes. While a full VM escape exploit exists in a controlled environment, it has not been publicly released. Following coordinated disclosure through linux-distros@vs.openwall.org and the end of the agreed embargo, the exploit details were published on oss-security along with technical documentation.  The advisory also clarifies that CVE-2026-53359 affects only Intel and AMD-based KVM hosts, not arm64 systems. It further notes that the vulnerability exists within KVM's in-kernel MMU code, making it independent of QEMU's emulation and potentially impacting cloud providers using custom virtualization stacks. Administrators running multi-tenant x86 KVM hosts with nested virtualization are advised to ensure the 81ccda30b4e8 patch has been applied. 

A critical Flowise RCE vulnerability is now being actively exploited. The flaw, tracked as CVE-2025-59528, carries a maximum severity rating and enables attackers to execute arbitrary code on affected systems, potentially leading to full system compromise.  Security researchers have confirmed that threat actors are taking advantage of the Flowise RCE vulnerability to infiltrate vulnerable deployments. This issue, identified as CVE-2025-59528, allows malicious actors to inject and execute arbitrary code through unsafe handling of user input within the platform.  The vulnerability was first publicly disclosed in September of last year, accompanied by warnings that successful exploitation could result in command execution and unauthorized access to the file system. Despite the availability of a patch, exploitation attempts have now been observed in real-world environments. 

Unsafe JavaScript Execution 

The issue arises in the Flowise CustomMCP node, a component designed to connect with external Model Context Protocol (MCP) servers. The vulnerability arises because the node unsafely evaluates user-supplied input in the mcpServerConfig setting.  This design flaw allows attackers to inject malicious JavaScript code without undergoing proper validation or security checks. As a result, attackers can leverage the Flowise RCE vulnerability (CVE-2025-59528) to execute arbitrary code, potentially gaining control over the affected system.  The developers addressed the vulnerability in Flowise version 3.0.6. The latest available version, 3.1.1, was released two weeks ago and includes the necessary fixes.  Flowise itself is a low-code, open-source platform used to build AI agents and large language model (LLM) workflows. It features a drag-and-drop interface that enables users to design pipelines for chatbots, automation tools, and other AI-driven systems.

Evidence of Flowise RCE Vulnerability 

According to Caitlin Condon, VP of Security Research at VulnCheck, exploitation activity has already begun. She stated:  “New hashtag#KEV: Early this morning, VulnCheck's Canary network began detecting first-time exploitation of CVE-2025-59528, a CVSS-10 arbitrary JavaScript code injection vulnerability in Flowise, an open-source AI development platform. The vulnerability resides in the CustomMCP server logic in multiple versions of Flowise and allows for code execution.”  She further noted:  “Observed activity so far originates from a single Starlink IP. Our team's ASM queries show 12,000 - 15,000 instances of Flowise on the public internet as of today. CVE-2025-59528 is patched in version 3.0.6 of Flowise.”  This suggests that while exploitation is currently limited, the attack surface remains significant due to the large number of exposed instances. 

Additional Vulnerabilities Increase Risk 

The Flowise RCE vulnerability (CVE-2025-59528) is not the only security concern affecting the platform. Researchers have also observed active exploitation of two other vulnerabilities: CVE-2025-8943 and CVE-2025-26319.  Condon emphasized that both of these flaws are included in VulnCheck’s Known Exploited Vulnerabilities (KEV) catalog and have been detected through their monitoring systems. This indicates a broader pattern of attackers targeting Flowise deployments to execute arbitrary code and gain unauthorized access.  Although estimates suggest that between 12,000 and 15,000 Flowise instances are accessible on the public internet, it remains unclear how many of these are vulnerable to CVE-2025-59528.  Even so, the presence of such a large number of exposed systems increases the likelihood of further attacks, especially as exploit techniques become more widely available. 

Recommendations for Users

Users of Flowise are strongly advised to take immediate action to mitigate the risks associated with CVE-2025-59528. Upgrading to version 3.1.1, or at a minimum version 3.0.6, is critical to patch the Flowise RCE vulnerability and prevent attackers from exploiting it to execute arbitrary code.  Additionally, organizations should evaluate whether their Flowise instances need to be publicly accessible. If external access is not required, removing these systems from the public internet can significantly reduce exposure to attacks.