Nrwl: Actively-Exploited Flaw Added to CISA KEV, Linked to Ransomware
CISA added a Nrwl vulnerability, CVE-2026-48027, to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation tied to ransomware.
Key findings
- CISA added CVE-2026-48027, a Nrwl vulnerability, to the KEV catalog on May 27, 2026.
- The flaw is confirmed under active exploitation and tied to ransomware campaigns.
- Federal agencies must remediate or cease use by June 17, 2026, under BOD 22-01.
- Nrwl's role in developer tooling and build pipelines raises supply-chain risk concerns.
- Organizations should patch immediately, audit logs, and verify offline backup integrity.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a single vulnerability from Nrwl to its Known Exploited Vulnerabilities (KEV) catalog on May 27, 2026, confirming that the flaw is being actively exploited in the wild and has been linked to ransomware campaigns.
**CVE-2026-48027** — This vulnerability in Nrwl software is under active exploitation, with CISA flagging it specifically for use in ransomware operations. While technical details remain limited pending broader disclosure, the ransomware association elevates the urgency significantly: attackers are not merely probing but are leveraging the flaw to deploy encryptors and extort victims.
The KEV listing triggers Binding Operational Directive (BOD) 22-01, which mandates that all U.S. federal civilian executive branch agencies apply vendor-supplied mitigations or cease use of the affected product within a strict remediation window. For this entry, the due date falls on June 17, 2026 — three weeks from the catalog addition date.
Nrwl, best known for the Nx build system and monorepo tooling widely adopted across enterprise development environments, occupies a sensitive position in software supply chains. A compromise in developer tooling can cascade into downstream risks, making swift patching critical not only for direct users but for organizations whose build pipelines depend on Nrwl products.
Security teams should immediately inventory Nrwl software across their environments, apply available patches or mitigations, and review access logs for indicators of compromise. Given the ransomware tie-in, defenders should also ensure offline backups are intact and that endpoint detection tooling is tuned to flag encryption-related behaviors. CISA strongly recommends prioritizing this CVE ahead of routine patch cycles.