Navigating CVE-2026-66066: Threat details, affected components, and how to stay protected

• On July 29, 2026, Rails released patches and an advisory for CVE-2026-66066, an arbitrary file read vulnerability in Active Storage that can enable remote code execution (RCE)

• Exploiting this vulnerability also requires the use of libvips < version 8.13

• Fastly Next-Gen WAF customers can enable our new virtual patch (released July 31, 2026) to gain immediate protection against exploitation attempts while the underlying components are patched.

• Affected components

  • Active Storage

    • < 7.2.3.2, 8.0 up to 8.0.5.1, 8.1 up to 8.1.3.1

• Mitigating this vulnerability requires updating both Active Storage and libvips

  • Active Storage

    • >= 7.2.3.2, >= 8.0.5.1, >= 8.1.3.1

  • libvips

    • >= 8.13

CVE-2026-66066 is an arbitrary file read vulnerability, meaning it enables an attacker to read arbitrary files (and process memory) from a vulnerable web server. If certain files are read, an attacker can use this to gain remote code execution on the vulnerable server. For more in-depth details on the exact cause of the vulnerability, see Ethiack’s detailed research post.

While our virtual patch mitigates the vast majority of attack vectors, edge cases may exist depending on your specific environment and configuration. Applying the official patches to Active Storage and libvips as soon as possible remains the best way to ensure total protection.

To enable the virtual patch, follow the enablement instructions in our official documentation.

If you are concerned about potential exploitation, Rails has also published details on how to perform forensics for this vulnerability. This includes a forensics repo with Claude skills to assist in forensics.

Rails advisory & technical details:

• https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm

• https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441

Research from Ethiack: 

• https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066

• https://ethiack.com/info-hub/research/kindarails2shell-how-a-matlab-file-reads-your-secrets-and-pops-a-shell-on-ruby-on-rails