ACVE-2026-0419

In the wild

exploited-itw · dfir

Description

What

Pickai activity targeted exposed ComfyUI image-generation servers and installed a C++ backdoor with reverse-shell and AI-data theft capabilities. The public coverage reports at least 695 compromised servers. The record is an exposure-conditioned incident row, not a claim that every ComfyUI installation is vulnerable.

Which configuration is exposed

The exposed configuration is a ComfyUI service reachable from the internet while known remote-code or file-processing paths remain available. A local private service is outside the static condition even when it has the same product version.

How ACVE detects it

ACVE matches the discovered comfyui.exposed feature. Discovery does not scan ports, validate the vulnerable endpoint, or read image data. Operators must supply the feature through a trusted lock enrichment or review.

Fix

Patch ComfyUI and related plugins, bind the service privately, require authentication, and inspect for backdoors and reverse-shell persistence. Rotate AI-service and cloud credentials present on affected hosts.

Grounding needed

The incident page should be checked for the compromised-server count and date range. The product is represented as an exposed configuration because the named package release is not supplied by the source.

This record is limited to the condition named in the public source: Exposed ComfyUI servers were compromised by the Pickai backdoor. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

features["comfyui.exposed"] eq true

Fix

Patch ComfyUI and bind the service behind authentication.

• Reconfigure features["comfyui.exposed"] to false. Remove public exposure.
• Reconfigure surface to authenticated. Restrict image-generation service access.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.