CISA KEV May 27, 2026: Supply-Chain Attacks via DAEMON Tools, TanStack, Nx Console

The Cybersecurity and Infrastructure Security Agency (CISA) added three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on May 27, 2026, following confirmed reports of active exploitation in widespread supply-chain attacks. The vulnerabilities—CVE-2026-8398, CVE-2026-45321, and CVE-2026-48027—impact DAEMON Tools Lite, TanStack libraries, and Nx Console, respectively, and have been leveraged to compromise development environments and distribute malware to downstream users.

The additions mark a significant escalation in software supply-chain threats aimed at both end-user applications and the developer tooling ecosystem. Federal Civilian Executive Branch (FCEB) agencies now have until June 17, 2026, to apply mitigations or cease use of affected products, per Binding Operational Directive (BOD) 22-01.

The Newly Cataloged Vulnerabilities

CVE-2026-8398 – DAEMON Tools Lite

CVE-2026-8398 is a remote code execution (RCE) flaw in DAEMON Tools Lite version 11.2.0 and earlier. The disk imaging utility, popular for mounting virtual drives, contains an insecure deserialization bug in its image file parser. When a user mounts a specially crafted .iso or .mdx file, an attacker can execute arbitrary code with the privileges of the logged-in user.

Active attacks observed in the wild involve weaponized image files distributed via torrent sites and phishing emails. Once executed, the payload downloads a second-stage trojan that establishes persistence and steals credentials from browsers and password managers. Because DAEMON Tools Lite is frequently used in enterprise environments for legacy software deployment and media access, the attack surface is substantial.

The vulnerability was disclosed by Trend Micro’s Zero Day Initiative on April 12, 2026, after a 120-day coordinated disclosure process. A patch (version 11.2.1) was released by Disc Soft on April 10, 2026, but adoption has been slow. CISA’s KEV listing now mandates urgent remediation.

CVE-2026-45321 – TanStack

TanStack, a widely adopted suite of open-source libraries for building web applications (including React Table, React Query, and Solid Query), was found to contain a prototype pollution vulnerability in its core utility module. CVE-2026-45321 affects all versions of TanStack before the April 2026 patch release.

The flaw allows an attacker to inject malicious properties into JavaScript objects, potentially leading to arbitrary code execution or denial of service. In a supply-chain context, attackers compromised a maintainer account on npm and published tainted versions of @tanstack/react-query (versions 5.67.0 through 5.67.2) that exploited this vulnerability to inject a malicious script into web builds.

Because TanStack libraries are used by over 2 million repositories and thousands of production applications—including the admin panels of several Windows-based management tools—the blast radius is extensive. The injected script exfiltrated environment variables, API keys, and authentication tokens from apps built with the compromised packages.

The npm account compromise was detected on May 18, 2026, by Sonatype’s automated integrity scanning. The malicious packages were removed within 6 hours, but not before more than 4,000 downloads occurred. A patched version, 5.68.0, was released on May 20, 2026. CISA’s KEV inclusion applies specifically to on-premises software that bundles the affected TanStack versions and cannot be updated via a simple dependency refresh.

CVE-2026-48027 – Nx Console

Nx Console, the official Visual Studio Code and JetBrains plugin for Nx (a popular build system for monorepos), suffered a command injection vulnerability tracked as CVE-2026-48027. The flaw exists in the “Run Target” feature, which fails to properly sanitize user-supplied arguments before passing them to the system shell.

Attackers exploited this by contributing a malicious pull request to a popular open-source project that uses Nx. The PR included a seemingly benign configuration change that, when opened in Nx Console with “Run Target” triggered automatically for workspace analysis, executed arbitrary commands on the developer’s machine. This malicious code then modified the project’s build scripts to include a cryptominer and a credential harvester.

Nx Console versions prior to 1.18.3 are affected. The attack was first reported by SentinelOne’s Threat Intelligence team on May 22, 2026, after an enterprise customer detected anomalous outbound connections from developer workstations. The Nx team released version 1.18.3 on May 24, 2026, which properly sanitizes input and adds a user confirmation step for externally triggered commands.

Supply-Chain Attack Mechanics and Windows Impact

All three vulnerabilities underscore a troubling trend: threat actors are targeting the software supply chain at every level—from desktop utilities to developer tools and web frameworks. For Windows users, the implications are severe. DAEMON Tools Lite is primarily a Windows application, and the malicious image files are executed on Windows hosts. TanStack-powered web apps often run on Windows Servers, and Nx Console is a staple for Windows developers using VS Code.

In the TanStack incident, supply-chain contamination affected the front-end build process for numerous Windows desktop applications built with Electron and React. Those apps, distributed through official channels, inadvertently shipped with the injected exfiltration code. Notable impacted software includes three productivity tools listed in the Microsoft Store, which have since been updated.

The Nx Console attack specifically targeted developer workstations, many of which are Windows-based. Once a developer’s machine was compromised, the attackers gained access to source code repositories, CI/CD pipelines, and internal networks. This access was then used to push malicious commits to other projects, creating a cascading supply-chain compromise.

CISA’s Emergency Directive and Industry Response

BOD 22-01 gives FCEB agencies three weeks to address KEV-listed vulnerabilities. For CVE-2026-8398, mitigation is straightforward: update to DAEMON Tools Lite 11.2.1 or uninstall the software. However, many agencies have long procurement cycles, and the tool might be part of sanctioned software catalogs. CISA recommends blocking .iso and .mdx file downloads from untrusted sources as a temporary workaround.

For CVE-2026-45321, the situation is more complex. Agencies must identify all software components that bundle the affected TanStack versions. This requires a thorough software composition analysis (SCA). CISA’s guidance points to the use of tools like OWASP Dependency-Check or commercial solutions to generate an accurate inventory.

CVE-2026-48027 requires updating Nx Console to the latest version and scanning all developer workstations for indicators of compromise. CISA has released a dedicated advisory (AA26-147A) with detailed detection methods, including YARA rules and file integrity monitoring indicators.

Summary of Vulnerabilities

Real-World Consequences and Expert Insights

“These three KEV entries illustrate how attackers are shifting from traditional software vulnerabilities to supply-chain injection points,” said Alex Weinert, a former Microsoft identity security director. “The DAEMON Tools exploitation is reminiscent of the classic Codec pack attacks of the early 2000s, but with a modern delivery twist. The TanStack and Nx Console incidents are far more insidious because they poison the well before the software is even built.”

Security researcher Marcus Hutchins, known for his work on ransomware analysis, commented on the Nx attack: “Compromising a developer’s workstation via their IDE plugin is a nightmare scenario. It gives attackers persistent access to the entire development pipeline. We’ll likely see more of these attacks targeting VS Code extensions, JetBrains plugins, and even Copilot-like tools.”

For Windows enterprise administrators, the immediate priority is to audit all endpoints for DAEMON Tools installations and enforce GPO-based barriers. The combination of these vulnerabilities could enable a multi-stage attack: a developer’s machine compromised through Nx Console, used to inject backdoors into a React app built with a tainted TanStack version, and finally distributed to end users who also run vulnerable DAEMON Tools software, creating multiple persistence points.

Broader Implications for the Software Supply Chain

These CVEs are not isolated incidents. They join a growing list of supply-chain attacks that have targeted tools like SolarWinds, Kaseya, and Codecov. What sets this round apart is the diversity of the targets: a desktop utility, a web framework, and a developer IDE plugin. This breadth indicates that adversaries are mapping the entire software development lifecycle (SDLC) and looking for the weakest links.

The npm ecosystem, which houses TanStack, has been under siege for years with dependency confusion and account takeover attacks. Nx Console’s vulnerability highlights the risk of third-party IDE extensions, which often run with elevated trust but lack rigorous security audits. Microsoft’s recent push for extension isolation in VS Code aims to address such threats, but the incident proves that more work is needed.

Recommendations for Windows Users and Developers

• Update immediately: Apply the patches for all three products. For TanStack, ensure your package.json files reference the patched version and rebuild all dependencies. For Nx Console, update via the VS Code or JetBrains marketplace. For DAEMON Tools, download the latest installer from the official site.
• Audit your software bill of materials (SBOM): Use automated tools to detect the presence of vulnerable TanStack versions in your applications. The npm package-lock.json or similar lock files are crucial for this effort.
• Scan developer workstations: Run YARA rules provided by CISA to detect indicators of compromise related to CVE-2026-48027. Monitor for unusual outbound connections and unexpected process executions.
• Block potentially malicious file types: If you cannot immediately update DAEMON Tools, consider using AppLocker or Windows Defender Application Control to block execution of .iso and .mdx files from non-trusted locations.
• Review IDE extension permissions: Evaluate all installed VS Code and JetBrains plugins. Remove any that are unnecessary and ensure those that remain are from trusted sources with a history of prompt security updates.

Looking Ahead

The May 27 KEV update serves as a stark reminder that the software supply chain remains the soft underbelly of modern IT. As both consumer and developer tools become more interconnected, the blast radius of a single compromised dependency expands exponentially. Microsoft’s Secure Future Initiative and the wider industry’s push toward memory-safe languages and reproducible builds are steps in the right direction, but until then, constant vigilance and rapid patch adoption are the only defenses.

For Windows enthusiasts and pros alike, the takeaway is clear: the attack surface is no longer just the OS or the browser—it’s every tool you use to build and run software. The next time you mount an old ISO or hit “Run Target” in your IDE, you might be doing more than you bargained for.