@blamejs/exceptd-skills 0.18.17 → 0.18.18

package/data/cve-catalog.json

@@ -55,8 +55,8 @@
     "ai_discovery_methodology": {
       "field_added": "2026-05-15",
       "agents_md_target": "Hard Rule #7 — '41% of 2025 zero-days were AI-discovered'. Catalog target rate floor: 0.40.",
-      "current_rate": 0.0261,
-      "current_floor_enforced_by_test": 0.026,
+      "current_rate": 0.025,
+      "current_floor_enforced_by_test": 0.025,
       "ladder_to_target": [
         0.027,
         0.028,
@@ -47970,5 +47970,2120 @@
         "published_date": "2026-05-27"
       }
     ]
+  },
+  "CVE-2026-12569": {
+    "name": "PTC Windchill and FlexPLM Improper Input Validation Vulnerability",
+    "type": "RCE",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-06-25",
+    "cisa_kev_due_date": "2026-06-28",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited unauthenticated deserialization RCE. Unauthenticated deserialization of crafted input executes code and plants JSP webshells on Windchill/FlexPLM.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Disclosed by PTC (advisory published 2026-06-17). No AI tool credited with discovery.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "In-the-wild webshell deployment; no AI-build attribution.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (added 2026-06-25, due 2026-06-28). First-ever confirmed real-world exploitation of PTC Windchill; attackers deploy persistent JSP webshells for remote command execution and data exfiltration. No named actor attribution.",
+    "affected": "PTC Windchill and FlexPLM — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "PTC Windchill/FlexPLM all versions up to and including 11.0",
+      "Affected releases across the 11.1, 11.2, 12.0, 12.1 and 13.0 branches (see PTC advisory for fixed builds per branch)"
+    ],
+    "vector": "A remote, unauthenticated attacker sends a specially crafted request whose untrusted data is deserialized by Windchill/FlexPLM (CWE-20 leading to CWE-502), yielding arbitrary code execution. Observed in the wild dropping persistent JSP webshells that provide ongoing remote command execution and data exfiltration from the PLM platform, which holds product designs and manufacturing IP.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed unauthenticated deserialization RCE on PTC Windchill and FlexPLM; CISA set a 2026-06-28 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited unauthenticated deserialization RCE the timescale must collapse to the CISA due date (2026-06-28) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this unauthenticated deserialization RCE until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited unauthenticated deserialization RCE demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — PTC Windchill and FlexPLM was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1505.003",
+      "T1059"
+    ],
+    "rwep_score": 72,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": null,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS not published/retrieved at curation time; refresh via the FIRST EPSS API.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-12569",
+    "cwe_refs": [
+      "CWE-20",
+      "CWE-502"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-12569"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2026-12569",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2026-06-25"
+      },
+      {
+        "vendor": "PTC",
+        "advisory_id": null,
+        "url": "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability",
+        "severity": "critical",
+        "published_date": "2026-06-18"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Disclosed by PTC (advisory published 2026-06-17). No AI tool credited with discovery. CISA KEV-listed 2026-06-25 (due 2026-06-28). Curated 2026-06-26 from the NVD record and the PTC advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Unauthenticated crafted HTTP requests to Windchill/PDMLink endpoints that trigger deserialization of untrusted data",
+        "New or unexpected JSP files under the Windchill web application directories (persistent webshells)",
+        "Java application-server processes spawning shell/command children following the crafted requests; outbound data-exfiltration connections"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-12569, CISA KEV (added 2026-06-25), and the PTC advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2026-20230": {
+    "name": "Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability",
+    "type": "SSRF",
+    "cvss_score": 8.6,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-06-25",
+    "cisa_kev_due_date": "2026-06-28",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited unauthenticated SSRF-to-root. Unauthenticated SSRF in the WebDialer HTTP handler chained to attacker-controlled file write and root escalation; public PoC available.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Disclosed by Cisco PSIRT (advisory cisco-sa-cucm-ssrf-cXPnHcW) on 2026-06-03. No AI tool credited with discovery.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "Public PoC exploit code released by security researchers; no AI-build attribution.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (added ~2026-06-24). Defused reported in-the-wild exploitation the weekend of 2026-06-21/22, the first credible ITW claim; public PoC available. No named actor attribution.",
+    "affected": "Cisco Unified Communications Manager — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Cisco Unified CM / Unified CM SME prior to 14SU6",
+      "Cisco Unified CM / Unified CM SME 15 prior to 15SU5",
+      "Exploitable only when the WebDialer service is enabled (disabled by default)"
+    ],
+    "vector": "The Unified CM WebDialer service is reachable by an unauthenticated remote attacker. Improper input validation of specific HTTP requests (CWE-918) lets the attacker coerce the server into issuing attacker-controlled requests and writing files to the underlying OS, which are then used to elevate to root. Cisco rates the Security Impact Critical above the 8.6 base because the end state is root compromise of the call-control plane.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed unauthenticated SSRF-to-root on Cisco Unified Communications Manager; CISA set a 2026-06-28 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited unauthenticated SSRF-to-root the timescale must collapse to the CISA due date (2026-06-28) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this unauthenticated SSRF-to-root until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an unauthenticated unauthenticated SSRF-to-root in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Cisco Unified Communications Manager was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-SC-7": "SC-7 boundary protection treats this appliance as the boundary; when the boundary device itself carries an unauthenticated unauthenticated SSRF-to-root, the control protects nothing in front of it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190"
+    ],
+    "rwep_score": 78,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 23,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=23 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": null,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS not published/retrieved at curation time; refresh via the FIRST EPSS API.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-20230",
+    "cwe_refs": [
+      "CWE-918"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-20230"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2026-20230",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2026-06-25"
+      },
+      {
+        "vendor": "Cisco",
+        "advisory_id": null,
+        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW",
+        "severity": "high",
+        "published_date": "2026-06-03"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Disclosed by Cisco PSIRT (advisory cisco-sa-cucm-ssrf-cXPnHcW) on 2026-06-03. No AI tool credited with discovery. CISA KEV-listed 2026-06-25 (due 2026-06-28). Curated 2026-06-26 from the NVD record and the Cisco advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Inbound HTTP requests to the WebDialer service endpoint carrying crafted URIs that coerce the server into making attacker-directed requests",
+        "Unexpected files written under the Unified CM web/OS paths following WebDialer requests (the SSRF primitive is used to write files that escalate to root)",
+        "WebDialer service enabled on an internet-reachable Unified CM where it is not operationally needed"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-20230, CISA KEV (added 2026-06-25), and the Cisco advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated SSRF-to-root, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-67038": {
+    "name": "Lantronix EDS5000 Code Injection Vulnerability",
+    "type": "Code-Injection",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-06-23",
+    "cisa_kev_due_date": "2026-06-26",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited root OS command injection. Shell-metacharacter username in a failed-auth request to the HTTP RPC module yields root command execution on the OT device server.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Coordinated disclosure via GitHub Security Advisory GHSA-55gq-23mv-cw8r / vendor. No AI tool credited with discovery.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-build attribution for the in-the-wild exploit.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (added 2026-06-23, due 2026-06-26). Actively exploited against internet-facing/network-accessible EDS5000 device servers. No named actor; the device bridges serial OT assets (PLCs/RTUs) to IP, so exploitation enables OT pivot.",
+    "affected": "Lantronix EDS5000 — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Lantronix EDS5000 firmware 2.1.0.0R3 and earlier",
+      "Fixed in firmware 2.2.0.0R1"
+    ],
+    "vector": "The EDS5000 HTTP RPC module is reachable over the network. When logging a failed authentication attempt it concatenates the attacker-supplied username directly into a shell command without sanitization (CWE-94), so a crafted username executes arbitrary OS commands as root. Because the device bridges legacy serial OT equipment to IP, root control lets the attacker intercept/manipulate serial streams and pivot into connected OT networks.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed root OS command injection on Lantronix EDS5000; CISA set a 2026-06-26 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited root OS command injection the timescale must collapse to the CISA due date (2026-06-26) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this root OS command injection until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an unauthenticated root OS command injection in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Lantronix EDS5000 was exploited before a normal cycle would have reached it.",
+      "IEC-62443-3-3": "62443-3-3 zone-and-conduit segmentation is the compensating control, but an internet-reachable device server with a root-level root OS command injection bridges the IT and OT zones it is supposed to keep apart.",
+      "NIST-800-82r3": "800-82r3 treats the serial-to-IP gateway as a trusted conduit; root compromise via this root OS command injection turns the gateway into an OT pivot, which a segmentation-only reading of the guide does not address."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 77,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": null,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS not published/retrieved at curation time; refresh via the FIRST EPSS API.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-67038",
+    "cwe_refs": [
+      "CWE-94"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://github.com/advisories/GHSA-55gq-23mv-cw8r",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-67038"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-67038",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2026-06-23"
+      },
+      {
+        "vendor": "Lantronix",
+        "advisory_id": null,
+        "url": "https://github.com/advisories/GHSA-55gq-23mv-cw8r",
+        "severity": "critical",
+        "published_date": "2026-03-11"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Coordinated disclosure via GitHub Security Advisory GHSA-55gq-23mv-cw8r / vendor. No AI tool credited with discovery. CISA KEV-listed 2026-06-23 (due 2026-06-26). Curated 2026-06-26 from the NVD record and the Lantronix advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Failed-authentication attempts to the EDS5000 HTTP RPC module whose username field carries shell metacharacters (the unsanitized value is concatenated into a logging shell command)",
+        "Unexpected processes or outbound connections from the EDS5000 running as root",
+        "Manipulation or interception of serial data streams bridged by the device after compromise"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-67038, CISA KEV (added 2026-06-23), and the Lantronix advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the root OS command injection, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2026-34910": {
+    "name": "Ubiquiti UniFi OS Improper Input Validation Vulnerability",
+    "type": "Command-Injection",
+    "cvss_score": 10,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-06-23",
+    "cisa_kev_due_date": "2026-06-26",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited package-update command injection. Command injection in the package-update path executes as root; chained with CVE-2026-34908/34909 for unauthenticated root RCE and botnet deployment.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Per Bishop Fox chain analysis, credited to John Carroll (human). No AI tool credited with discovery.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "In-the-wild weaponization is a conventional Mirai/Gafgyt-derived loader; no AI-build attribution.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (added 2026-06-23, due 2026-06-26). Command-injection leg of the unauthenticated root-RCE chain (with CVE-2026-34908 + CVE-2026-34909) used to deploy the azsxd/Mirai-derived IoT botnet. Opportunistic mass-exploitation; no named APT.",
+    "affected": "Ubiquiti UniFi OS — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "UniFi OS Server builds prior to 5.0.8 (unifi-core 5.0.153)",
+      "UniFi OS consoles/devices (UDM, UDM-Pro, UDM-SE, Express, UNVR, UNAS families) prior to the SAB-064 fixes"
+    ],
+    "vector": "The UniFi OS package-update handler passes attacker-influenced input into a command executed with root privilege (CWE-20 improper input validation enabling command injection). On its own it requires reaching the handler; chained behind CVE-2026-34908 (access-control bypass) and CVE-2026-34909 (path traversal) it completes an unauthenticated root RCE that operators use to install a Mirai/Gafgyt-derived botnet.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed package-update command injection on Ubiquiti UniFi OS; CISA set a 2026-06-26 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited package-update command injection the timescale must collapse to the CISA due date (2026-06-26) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this package-update command injection until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an unauthenticated package-update command injection in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Ubiquiti UniFi OS was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-SC-7": "SC-7 boundary protection treats this appliance as the boundary; when the boundary device itself carries an unauthenticated package-update command injection, the control protects nothing in front of it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059",
+      "T1496"
+    ],
+    "rwep_score": 79,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": null,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS not published/retrieved at curation time; refresh via the FIRST EPSS API.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-34910",
+    "cwe_refs": [
+      "CWE-20",
+      "CWE-78"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-34910"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2026-34910",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2026-06-23"
+      },
+      {
+        "vendor": "Ubiquiti",
+        "advisory_id": null,
+        "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b",
+        "severity": "critical",
+        "published_date": "2026-05-22"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Per Bishop Fox chain analysis, credited to John Carroll (human). No AI tool credited with discovery. CISA KEV-listed 2026-06-23 (due 2026-06-26). Curated 2026-06-26 from the NVD record and the Ubiquiti advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Requests to the UniFi OS package-update endpoint that inject shell metacharacters into the update/command path",
+        "Implant artifacts azsxd.<arch>, loader script zok, and a deleted-but-running cron.azsxd process",
+        "Outbound C2/payload-staging to 176.65.148.183 and 185.228.26.16; Mirai-style scanning/DDoS egress"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-34910, CISA KEV (added 2026-06-23), and the Ubiquiti advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the package-update command injection, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2026-34909": {
+    "name": "Ubiquiti UniFi OS Path Traversal Vulnerability",
+    "type": "Path-Traversal",
+    "cvss_score": 10,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-06-23",
+    "cisa_kev_due_date": "2026-06-26",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited unauthenticated path traversal (arbitrary file read/write). Encoded \"..%2f\" path traversal smuggled past the nginx auth-gateway (raw-vs-normalized URI confusion) gives unauthenticated arbitrary file read/write; chained with CVE-2026-34908 + CVE-2026-34910 it produces unauthenticated root RCE — Bishop Fox published a detection analysis of the full chain.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Human-discovered, no AI credited. Per Ubiquiti Security Advisory Bulletin 064 acknowledgments, CVE-2026-34909 is credited to Abdulaziz Almadhi (Catchify Security), reported through Ubiquiti's HackerOne bug-bounty program (https://integsec.com/blog/cve-2026-34909-unifi-os-path-traversal-vulnerability-what-it-means-for-your-business-and-how-to-respond). Bishop Fox separately published a detection/analysis writeup of the full unauthenticated RCE chain (https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis). No named AI tool/agent is credited with discovery in any primary source.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No evidence the in-the-wild exploit was AI-built. The only AI reference in the reporting is defensive: the pwndefend.com exploitation writeup states its own reverse-engineering analysis of the botnet payload was \"made with Claude\" (https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/) — that is the defender's analysis tooling, not weaponization of the exploit. No source attributes the exploit chain's construction to an AI system.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed exploitation (added to CISA KEV 2026-06-23). Exploited in the wild from on/around 2026-05-21, coinciding with the SAB-064 publication. The path traversal is chained with CVE-2026-34908 (access-control bypass) and CVE-2026-34910 (command injection) to achieve unauthenticated root RCE, which operators use to deploy a Mirai/Gafgyt-derived IoT botnet (\"azsxd v2.0\", loaded by a shell script \"zok\"), tracked via the infection-vector tag \"unifi.exploit\". No named APT/state actor or commercial spyware vendor attribution; the botnet operator is unidentified.",
+    "affected": "Ubiquiti UniFi OS — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "UniFi OS Server: versions prior to 5.0.8 (fixed in 5.0.8, unifi-core 5.0.153)",
+      "UNVR-G2 and UNVR-G2-Pro: versions prior to 5.1.12",
+      "UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8: versions prior to 5.1.10",
+      "UDM-Beast: versions prior to 5.1.11",
+      "Express: versions prior to 4.0.14",
+      "All UniFi OS consoles/devices (UDM, UDM-Pro, UDM-SE, Express, UNVR, UNAS families) running firmware prior to the SAB-064 fixes"
+    ],
+    "vector": "The UniFi OS web management interface is reachable by any actor with network access to the device, with no authentication required. CVE-2026-34909 is a path traversal (CWE-22) in the nginx/unifi-core request flow: the auth-gateway classifies the raw, percent-encoded URI as a public endpoint while the normalized/decoded request is routed to an authenticated internal service, so encoded \"..%2f\" sequences smuggle the request out of its intended directory and yield arbitrary file read/write on the underlying OS. The KEV description notes the accessed files can be \"manipulated to access an underlying account,\" giving credential/account access. In the wild it is combined with the access-control bypass (CVE-2026-34908) and the package-update command injection (CVE-2026-34910) to reach an unauthenticated root RCE chain used to drop a Mirai/Gafgyt-derived botnet.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed unauthenticated path traversal (arbitrary file read/write) on Ubiquiti UniFi OS; CISA set a 2026-06-26 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited unauthenticated path traversal (arbitrary file read/write) the timescale must collapse to the CISA due date (2026-06-26) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this unauthenticated path traversal (arbitrary file read/write) until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an unauthenticated unauthenticated path traversal (arbitrary file read/write) in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Ubiquiti UniFi OS was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-SC-7": "SC-7 boundary protection treats this appliance as the boundary; when the boundary device itself carries an unauthenticated unauthenticated path traversal (arbitrary file read/write), the control protects nothing in front of it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1083"
+    ],
+    "rwep_score": 79,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.02269,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-34909",
+    "cwe_refs": [
+      "CWE-22"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-34909"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2026-34909",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2026-06-23"
+      },
+      {
+        "vendor": "Ubiquiti",
+        "advisory_id": null,
+        "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b",
+        "severity": "critical",
+        "published_date": "2026-05-22"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Human-discovered, no AI credited. Per Ubiquiti Security Advisory Bulletin 064 acknowledgments, CVE-2026-34909 is credited to Abdulaziz Almadhi (Catchify Security), reported through Ubiquiti's HackerOne bug-bounty program (https://integsec.com/blog/cve-2026-34909-unifi-os-path-traversal-vulnerability-what-it-means-for-your-business-and-how-to-respond). Bishop Fox separately published a detection/analysis writeup of the full unauthenticated RCE chain (https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis). No named AI tool/agent is credited with discovery in any primary source. CISA KEV-listed 2026-06-23 (due 2026-06-26). Curated 2026-06-26 from the NVD record and the Ubiquiti advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Inbound HTTP requests to the UniFi OS nginx auth-gateway that mix a public endpoint prefix with encoded traversal sequences, e.g. /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/... reaching internal/authenticated services",
+        "Exploitation traffic from 176.65.148.183 with secondary payload staging pulled from 185.228.26.16",
+        "Presence of loader/payload artifacts on the device: files named zok, azsxd, cron.azsxd; payload SHA-256 5833e2344434022e18e22c4b93dc4a7710908fd03312499014d5cabf06bfc459",
+        "Running processes backed by deleted executables (fileless Mirai behavior) and cron-based persistence (cron.azsxd)"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-34909, CISA KEV (added 2026-06-23), and the Ubiquiti advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated path traversal (arbitrary file read/write), framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2026-34908": {
+    "name": "Ubiquiti UniFi OS Improper Access Control Vulnerability",
+    "type": "Auth-Bypass",
+    "cvss_score": 10,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-06-23",
+    "cisa_kev_due_date": "2026-06-26",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited access-control bypass. Public PoC available: Bishop Fox documented the full unauthenticated-to-root RCE chain and published a safe vulnerability-detection script (github.com/BishopFox/CVE-2026-34908-check); the public disclosure drove opportunistic mass-exploitation by the \"azsxd\" Mirai/Gafgyt-derived botnet.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Not AI-discovered. Bishop Fox's chain analysis credits named human researchers: CVE-2026-34908 (improper access control) to Duc Anh Nguyen (@heckintosh_); the chained CVE-2026-34909 (path traversal) to Abdulaziz Almadhi of Catchify Security; CVE-2026-34910 (command injection) to John Carroll. No AI tool/agent is credited with discovery in any primary source. Source: https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis ; vendor advisory: Ubiquiti Security Advisory Bulletin 064.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No source indicates AI-assisted exploit development. The public unauthenticated RCE chain and a safe detection script were authored by Bishop Fox researchers (human); in-the-wild weaponization is a conventional Mirai/Gafgyt-derived loader (\"azsxd\" v2.0) with no AI-build attribution.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (added 2026-06-23, due 2026-06-26). Opportunistic mass-exploitation: a Mirai/Gafgyt-derived botnet variant named \"azsxd\" (v2.0) chains CVE-2026-34908 (access-control bypass) + CVE-2026-34909 (path traversal) + CVE-2026-34910 (command injection) for unauthenticated root RCE on UniFi OS Server. First in-the-wild exploitation observed within days of public PoC tooling release following Ubiquiti advisory SAB-064 (~2026-05-21). No named APT/state actor attributed; described as opportunistic mass-exploitation.",
+    "affected": "Ubiquiti UniFi OS — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "UniFi OS Server builds at or below 5.0.6 (unifi-core 5.0.126) — affected",
+      "Fixed in UniFi OS Server 5.0.8 or later (unifi-core 5.0.153)",
+      "Affected device families per Ubiquiti SAB-064: UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max"
+    ],
+    "vector": "The UniFi OS nginx gateway compares a raw, percent-encoded request URI against its public-routes allowlist, while the backend routing decision uses a separately decoded/normalized URI. An unauthenticated, network-reachable attacker crafts a request whose raw form matches the allowlisted, auth-exempt /api/auth/validate-sso/ entry but normalizes to an authenticated backend route, defeating the access-control gate (CVE-2026-34908). Chained with the path traversal (CVE-2026-34909) and the package-update command injection (CVE-2026-34910 — an unsanitized package name passed to sh -c), this yields remote code execution, and the service's passwordless sudo to /usr/bin/dpkg escalates to full root via a malicious package maintainer script.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed access-control bypass on Ubiquiti UniFi OS; CISA set a 2026-06-26 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited access-control bypass the timescale must collapse to the CISA due date (2026-06-26) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this access-control bypass until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an unauthenticated access-control bypass in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Ubiquiti UniFi OS was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-SC-7": "SC-7 boundary protection treats this appliance as the boundary; when the boundary device itself carries an unauthenticated access-control bypass, the control protects nothing in front of it.",
+      "NIST-800-53-AC-6": "AC-6 least-privilege presumes an intact authorization check; this access-control bypass bypasses the check entirely, so the carefully-scoped privilege grants behind it are moot."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1078"
+    ],
+    "rwep_score": 79,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.0086,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-34908",
+    "cwe_refs": [
+      "CWE-284"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-34908"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2026-34908",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2026-06-23"
+      },
+      {
+        "vendor": "Ubiquiti",
+        "advisory_id": null,
+        "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b",
+        "severity": "critical",
+        "published_date": "2026-05-22"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Not AI-discovered. Bishop Fox's chain analysis credits named human researchers: CVE-2026-34908 (improper access control) to Duc Anh Nguyen (@heckintosh_); the chained CVE-2026-34909 (path traversal) to Abdulaziz Almadhi of Catchify Security; CVE-2026-34910 (command injection) to John Carroll. No AI tool/agent is credited with discovery in any primary source. Source: https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis ; vendor advisory: Ubiquiti Security Advisory Bulletin 064. CISA KEV-listed 2026-06-23 (due 2026-06-26). Curated 2026-06-26 from the NVD record and the Ubiquiti advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "HTTP requests to the unauthenticated allowlist path /api/auth/validate-sso/ whose raw percent-encoded form differs from the decoded route that the router resolves (raw-vs-normalized URI mismatch reaching authenticated backend endpoints)",
+        "Implant artifacts: azsxd.<arch> binaries (14 arch variants), stage-2 loader script 'zok', and a process masquerading as 'cron.azsxd' that is deleted from disk while still running",
+        "Unexpected package installs via the package-update endpoint / dpkg with maintainer scripts executing as root (passwordless sudo abuse)",
+        "Outbound C2 / payload-staging connections to 176.65.148.183 and 185.228.26.16; campaign/infection tag 'unifi.exploit.<arch>'"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-34908, CISA KEV (added 2026-06-23), and the Ubiquiti advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the access-control bypass, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2026-20253": {
+    "name": "Splunk Enterprise Missing Authentication for Critical Function Vulnerability",
+    "type": "RCE",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-06-18",
+    "cisa_kev_due_date": "2026-06-21",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited missing authentication for a critical function. watchTowr Labs published a working pre-auth RCE PoC chaining the unauthenticated sidecar restore endpoint through pg_restore connection-string injection and lo_export to write/overwrite Splunk Python scripts, yielding code execution as the splunk user.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Not AI-discovered. The Splunk vendor advisory SVD-2026-0603 credits discovery to a named human researcher, \"Alex Hordijk (hordalex)\" (https://advisory.splunk.com/advisories/SVD-2026-0603). No primary source credits any named AI system with finding the flaw. watchTowr Labs (Piotr Bazydlo @chudyPB and Yordan Ganchev) published an independent technical analysis and PoC AFTER vendor disclosure — they reverse-engineered the patch, they did not discover the vulnerability (https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/).",
+    "ai_assisted_weaponization": true,
+    "ai_assisted_notes": "watchTowr Labs states their public exploit was built with assistance from \"Project Red,\" their internal LLM-driven vulnerability reproduction harness, which was used to identify the vulnerable API endpoint and craft exploitation requests; human researchers Piotr Bazydlo and Yordan Ganchev performed the analysis and finalized the pg_dump/pg_restore chain (https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/, corroborated by https://thehackernews.com/2026/06/critical-splunk-enterprise-flaw-lets.html). Caveat: this named-AI assistance applies to watchTowr's research/PoC, not to any confirmed in-the-wild attacker tooling.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (added 2026-06-18, due 2026-06-21). Splunk PSIRT became aware of limited in-the-wild exploitation and updated SVD-2026-0603 on 2026-06-18; in-the-wild activity was independently confirmed by Resecurity. Exploitation began within days of the 2026-06-10 vendor disclosure and watchTowr's ~2026-06-12 public PoC. No public threat-actor or named-campaign attribution as of reporting.",
+    "affected": "Splunk Enterprise — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Splunk Enterprise 10.2.0 through 10.2.3 (fixed in 10.2.4)",
+      "Splunk Enterprise 10.0.0 through 10.0.6 (fixed in 10.0.7)",
+      "Also remediated in Splunk Enterprise 10.4.0 and later",
+      "Splunk Enterprise 9.4 and earlier are NOT affected",
+      "Primarily exposed on deployments where the PostgreSQL sidecar service is enabled (default-enabled on AWS deployments)"
+    ],
+    "vector": "The Splunk Enterprise web application (port 8000) exposes PostgreSQL sidecar recovery endpoints (proxied to the local PostgreSQL service on port 5435) that perform no authentication, so any network-reachable, unauthenticated attacker can invoke backup/restore file operations (CWE-306). The attacker controls the 'database' parameter passed to pg_dump/pg_restore, enabling PostgreSQL connection-string injection (e.g. overriding hostaddr) to force the server to restore an attacker-supplied database dump. That dump contains malicious SQL using lo_export to write arbitrary files as the splunk user, giving an arbitrary file create/truncate primitive. The chain escalates to pre-auth remote code execution by overwriting executable Python scripts in Splunk's application directory, which run as the splunk user when subsequently invoked.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed missing authentication for a critical function on Splunk Enterprise; CISA set a 2026-06-21 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited missing authentication for a critical function the timescale must collapse to the CISA due date (2026-06-21) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this missing authentication for a critical function until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited missing authentication for a critical function demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Splunk Enterprise was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-AC-6": "AC-6 least-privilege presumes an intact authorization check; this missing authentication for a critical function bypasses the check entirely, so the carefully-scoped privilege grants behind it are moot."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1078"
+    ],
+    "rwep_score": 87,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 15,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.921,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-20253",
+    "cwe_refs": [
+      "CWE-306"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://advisory.splunk.com/advisories/SVD-2026-0603",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-20253"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2026-20253",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2026-06-18"
+      },
+      {
+        "vendor": "Splunk",
+        "advisory_id": null,
+        "url": "https://advisory.splunk.com/advisories/SVD-2026-0603",
+        "severity": "critical",
+        "published_date": "2026-06-10"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Not AI-discovered. The Splunk vendor advisory SVD-2026-0603 credits discovery to a named human researcher, \"Alex Hordijk (hordalex)\" (https://advisory.splunk.com/advisories/SVD-2026-0603). No primary source credits any named AI system with finding the flaw. watchTowr Labs (Piotr Bazydlo @chudyPB and Yordan Ganchev) published an independent technical analysis and PoC AFTER vendor disclosure — they reverse-engineered the patch, they did not discover the vulnerability (https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/). CISA KEV-listed 2026-06-18 (due 2026-06-21). Curated 2026-06-26 from the NVD record and the Splunk advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Unauthenticated HTTP requests to the PostgreSQL sidecar endpoints (e.g. /v1/postgres/recovery/backup and /restore) reaching the Splunk web app (port 8000), which proxies to the local PostgreSQL service (port 5435).",
+        "pg_dump / pg_restore processes spawned by the Splunk service with attacker-controlled 'database' connection-string parameters (e.g. an injected hostaddr that overrides localhost).",
+        "Outbound PostgreSQL connections from the Splunk host to external/attacker-controlled database servers (pg_restore pulling a malicious dump), and new/modified .pgpass usage.",
+        "New, truncated, or overwritten files owned by the 'splunk' user under $SPLUNK_HOME — especially overwritten Python scripts in the Splunk application directory followed by anomalous splunkd child processes."
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-20253, CISA KEV (added 2026-06-18), and the Splunk advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the missing authentication for a critical function, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2026-48907": {
+    "name": "Widget Factory Joomla Content Editor Improper Access Control Vulnerability",
+    "type": "RCE",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-06-16",
+    "cisa_kev_due_date": "2026-06-19",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited editor access-control bypass enabling webshell upload. Public PoC, Nuclei template, and GitHub reproduction lab: fetch a CSRF token from any public page, POST a malicious editor profile to task=profiles.import, then upload a .php (or .xml.php) web shell to the images/ directory and request it to execute commands — no authentication or user interaction.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "No primary source credits any named AI system with discovery. Public technical analysis was published by Phil E. Taylor of mySites.guru (https://thehackernews.com/2026/06/cisa-warns-of-actively-exploited-joomla.html); YesWeHack's writeup credits \"Webshell Security Researchers\" with the original PoC but names no individual and no AI tool (https://www.yeswehack.com/news/rce-joomla-content-editor-extension). The vendor advisory at joomlacontenteditor.net names no AI tool. This is a human/PSIRT-class disclosure, so ai_discovered=FALSE.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No evidence the exploit was AI-built. Weaponization is a publicly published, hand-written Nuclei template plus a GitHub reproduction lab demonstrating the three-step unauthenticated chain; no source attributes exploit development to any AI tool or agent.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed active exploitation (added 2026-06-16, due 2026-06-19). Mass automated exploitation with public working exploit code (Nuclei template + GitHub reproduction lab); attackers import a rogue JCE editor profile that permits executable uploads, then drop a PHP web shell to the images/ directory for a persistent backdoor. One report describes hundreds of sites already compromised. No named threat actor / APT attribution and no public first-observed-in-wild date; Joomla warns that patching closes the entry point but does not clean an already-compromised site.",
+    "affected": "Widget Factory (Joomla Content Editor) Joomla Content Editor  — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "JCE (Joomla Content Editor) 1.0.0 through 2.9.99.4 — vulnerable",
+      "Branches 2.7.x, 2.8.x, and 2.9.x require patching; 2.6.x reportedly not affected by default",
+      "Fixed in JCE 2.9.99.5 (initial patch released 2026-06-03)",
+      "JCE 2.9.99.6 is the vendor-recommended version for all sites",
+      "A free standalone patch is offered for older 2.7.x/2.8.x sites that cannot upgrade"
+    ],
+    "vector": "The JCE profile-import endpoint (index.php?option=com_jce&task=profiles.import) is reachable by any unauthenticated visitor, requiring only a CSRF token scrapable from any public page — a broken access-control gate (CWE-284). The attacker imports a crafted editor profile that whitelists executable uploads, then abuses the upload path: File::makeSafe() sanitizes the filename but never restricts the extension, and File::upload(..., false, true) is called with unsafe handling enabled, bypassing Joomla's extension blacklist. The chained missing-authorization + absent extension validation + disabled upload safety lets the attacker write a .php web shell into the web root (default images/ folder), yielding unauthenticated remote code execution and a persistent backdoor running as the web-server user.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed editor access-control bypass enabling webshell upload on Widget Factory (Joomla Content Editor) Joomla Content Editor; CISA set a 2026-06-19 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited editor access-control bypass enabling webshell upload the timescale must collapse to the CISA due date (2026-06-19) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this editor access-control bypass enabling webshell upload until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited editor access-control bypass enabling webshell upload demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Widget Factory (Joomla Content Editor) Joomla Content Editor was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-AC-6": "AC-6 least-privilege presumes an intact authorization check; this editor access-control bypass enabling webshell upload bypasses the check entirely, so the carefully-scoped privilege grants behind it are moot."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1505.003"
+    ],
+    "rwep_score": 70,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.80425,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-48907",
+    "cwe_refs": [
+      "CWE-284"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-48907"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2026-48907",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2026-06-16"
+      },
+      {
+        "vendor": "Widget Factory (Joomla Content Editor)",
+        "advisory_id": null,
+        "url": "https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites",
+        "severity": "critical",
+        "published_date": "2026-06-05"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "No primary source credits any named AI system with discovery. Public technical analysis was published by Phil E. Taylor of mySites.guru (https://thehackernews.com/2026/06/cisa-warns-of-actively-exploited-joomla.html); YesWeHack's writeup credits \"Webshell Security Researchers\" with the original PoC but names no individual and no AI tool (https://www.yeswehack.com/news/rce-joomla-content-editor-extension). The vendor advisory at joomlacontenteditor.net names no AI tool. This is a human/PSIRT-class disclosure, so ai_discovered=FALSE. CISA KEV-listed 2026-06-16 (due 2026-06-19). Curated 2026-06-26 from the NVD record and the Widget Factory (Joomla Content Editor) advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Unauthenticated POST requests to /index.php?option=com_jce&task=profiles.import (profile-import endpoint hit by automated scanners)",
+        "Unexpected new JCE editor profiles in the JCE configuration / #__wf_profiles table that enable executable (.php) file uploads",
+        "Newly created .php files in the Joomla images/ media directory (the default upload location when no path is specified) or other media folders",
+        "Web shell access patterns: requests to anomalous PHP files followed by outbound connections or command execution from the web server (www-data/PHP process)"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-48907, CISA KEV (added 2026-06-16), and the Widget Factory (Joomla Content Editor) advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. ",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the editor access-control bypass enabling webshell upload, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2026-54420": {
+    "name": "LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability",
+    "type": "Symlink-Following",
+    "cvss_score": 8.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-06-15",
+    "cisa_kev_due_date": "2026-06-18",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited symlink-following cross-account file access. Two public GitHub PoCs (e.g. fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit) demonstrate planting a symlink that the root-running LiteSpeed plugin follows during certificate/usage JSON-API calls, escaping CageFS to read/write files across tenant boundaries and reach root.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Not AI-discovered. The LiteSpeed vendor advisory credits discovery/reporting to \"the team at Namecheap\" (a hosting provider), who reported it on 2026-05-31; no named AI tool/agent is credited anywhere. Source: https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/ and https://thehackernews.com/2026/06/cisa-flags-litespeed-cpanel-plugin-flaw.html . (One third-party write-up at yazoul.net notes it was \"drafted with large-language-model assistance\" — that refers to the blog prose, not the vulnerability discovery or exploit, so it does not establish AI discovery.)",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates the exploit was AI-built. Two public PoC exploits exist (e.g. github.com/fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit) but are human-authored; no AI weaponization is claimed or evidenced.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited in the wild beginning May 2026 (KEV-confirmed; CISA added it 2026-06-15 under BOD 26-04 with a 2026-06-18 due date). Namecheap's team reported the flaw to LiteSpeed on 2026-05-31, and cPanel proactively pushed an emergency uninstall command for the plugin the same day. No public threat-actor, campaign, or ransomware attribution; known_ransomware=Unknown. Two public proof-of-concept exploits are available on GitHub. Primary risk is a single compromised tenant turning into a server-wide, cross-account incident on multi-tenant shared hosting.",
+    "affected": "LiteSpeed cPanel Plugin — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "LiteSpeed cPanel plugin (user-end): all versions before 2.4.8 - fixed in 2.4.8",
+      "LiteSpeed WHM PlugIn: before 5.3.2.0 (per NVD); vendor advisory directs upgrade to WHM plugin v5.3.2.1 or higher, which bundles cPanel plugin v2.4.8",
+      "Exploitable only on shared hosting servers running CloudLinux/CageFS"
+    ],
+    "vector": "A low-privileged tenant who already holds FTP or web-shell access to one account on a shared CloudLinux/CageFS host plants a malicious symlink in a path the LiteSpeed cPanel plugin subsequently operates on with root privilege (during the generateEcCert / packageUserSize JSON-API operations). Because the plugin follows the attacker-controlled symlink without validating its target (CWE-61/CWE-59), the privileged process reads or writes files outside the tenant's CageFS jail. This escapes the per-account sandbox to reach other customers' database credentials, config, and source — or system files — escalating a single jailed account to root-level, server-wide cross-tenant compromise. The CVSS:3.1 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects changed scope and full CIA impact, gated behind pre-existing low-privilege access and high attack complexity (a timing/race window characteristic of symlink TOCTOU).",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level or local context), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed symlink-following cross-account file access on LiteSpeed cPanel Plugin; CISA set a 2026-06-18 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited symlink-following cross-account file access the timescale must collapse to the CISA due date (2026-06-18) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this symlink-following cross-account file access until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited symlink-following cross-account file access demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — LiteSpeed cPanel Plugin was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-AC-6": "AC-6 least-privilege presumes an intact authorization check; this symlink-following cross-account file access bypasses the check entirely, so the carefully-scoped privilege grants behind it are moot."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1083",
+      "T1068"
+    ],
+    "rwep_score": 68,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.01261,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-54420",
+    "cwe_refs": [
+      "CWE-61"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-54420"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2026-54420",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2026-06-15"
+      },
+      {
+        "vendor": "LiteSpeed",
+        "advisory_id": null,
+        "url": "https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/",
+        "severity": "high",
+        "published_date": "2026-06-14"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Not AI-discovered. The LiteSpeed vendor advisory credits discovery/reporting to \"the team at Namecheap\" (a hosting provider), who reported it on 2026-05-31; no named AI tool/agent is credited anywhere. Source: https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/ and https://thehackernews.com/2026/06/cisa-flags-litespeed-cpanel-plugin-flaw.html . (One third-party write-up at yazoul.net notes it was \"drafted with large-language-model assistance\" — that refers to the blog prose, not the vulnerability discovery or exploit, so it does not establish AI discovery.) CISA KEV-listed 2026-06-15 (due 2026-06-18). Curated 2026-06-26 from the NVD record and the LiteSpeed advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "cPanel/WHM logs showing the abused JSON-API endpoints: matches for `cpanel_jsonapi_func=(generateEcCert|packageUserSize)` or `cert_action_entry.*geneccert` in /usr/local/cpanel/logs/ and /var/cpanel/logs/ (vendor-supplied grep detection).",
+        "Bursts of concurrent/racing API calls to generateEcCert + packageUserSize from the same account, consistent with a TOCTOU symlink race window.",
+        "Unexpected symlinks inside customer home directories pointing outside the CageFS jail, and plugin-touched files modified around May 2026.",
+        "Cross-tenant artifacts in an unprivileged account: other customers' database credentials, config files, or source code appearing where they should be CageFS-isolated."
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-54420, CISA KEV (added 2026-06-15), and the LiteSpeed advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the symlink-following cross-account file access, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2026-20262": {
+    "name": "Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability",
+    "type": "Path-Traversal",
+    "cvss_score": 6.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-06-15",
+    "cisa_kev_due_date": "2026-06-29",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited path traversal. An authenticated low-privilege (single-task) user submits a crafted HTTP file-upload request with ../ path-traversal in the path/filename parameter to create or overwrite an arbitrary file on the SD-WAN Manager OS; a public PoC repository (github.com/fevar54/CVE-2026-20262-...) demonstrates the authenticated arbitrary file write, which can be escalated to root.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Not AI-discovered. The Cisco security advisory (cisco-sa-sdwan-arbfw-c2rZvQ) attributes the finding to internal Cisco security testing; Help Net Security reporting likewise states it \"was found during internal security testing.\" No external researcher and no named AI system (Big Sleep, XBOW, ZeroPath, etc.) is credited with discovery. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ and https://www.helpnetsecurity.com/2026/06/16/cisco-sd-wan-cve-2026-20262-exploited/",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No source describes the exploit as AI-built. A public PoC exists (GitHub: fevar54/CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-) but no AI tooling is credited with developing it or the in-the-wild exploit.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed exploitation (CISA KEV listing 2026-06-15, due 2026-06-29). Cisco PSIRT became aware of limited in-the-wild exploitation in June 2026; it was exploited as a zero-day before fixed software was broadly deployed. No public threat-actor, campaign, or spyware-vendor attribution. Reported as one of multiple Cisco SD-WAN Manager flaws targeted in 2026, signaling sustained targeting of network-management infrastructure.",
+    "affected": "Cisco Catalyst SD-WAN Manager — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Catalyst SD-WAN Manager 20.9.9.1 and earlier (fixed in 20.9.9.2)",
+      "20.12.7.1 and earlier (fixed in 20.12.7.2)",
+      "20.15.4.4 and earlier (fixed in 20.15.4.5)",
+      "20.15.5.2 and earlier (fixed in 20.15.5.3)",
+      "20.18.3 (fixed in 20.18.3.1)",
+      "26.1.1.1 and earlier (fixed in 26.1.1.2)"
+    ],
+    "vector": "The web UI/API of Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) is network-reachable and exposes a file-upload handler that fails to validate user-supplied file paths during upload processing. An authenticated attacker holding only a low-privileged, single-task user account sends a crafted HTTP request with path-traversal (../) sequences, obtaining an arbitrary file create/overwrite primitive anywhere on the underlying operating system. That write primitive is then chained — by overwriting a privileged configuration, cron, or startup file, or planting executable content — to elevate to root, yielding full compromise of the SD-WAN control plane that pushes policy and routing to every managed edge device.",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level or local context), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed path traversal on Cisco Catalyst SD-WAN Manager; CISA set a 2026-06-29 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited path traversal the timescale must collapse to the CISA due date (2026-06-29) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this path traversal until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an unauthenticated path traversal in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Cisco Catalyst SD-WAN Manager was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-SC-7": "SC-7 boundary protection treats this appliance as the boundary; when the boundary device itself carries an unauthenticated path traversal, the control protects nothing in front of it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1083"
+    ],
+    "rwep_score": 77,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.01741,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-20262",
+    "cwe_refs": [
+      "CWE-22"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-20262"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2026-20262",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "medium",
+        "published_date": "2026-06-15"
+      },
+      {
+        "vendor": "Cisco",
+        "advisory_id": null,
+        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ",
+        "severity": "medium",
+        "published_date": "2026-06-15"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Not AI-discovered. The Cisco security advisory (cisco-sa-sdwan-arbfw-c2rZvQ) attributes the finding to internal Cisco security testing; Help Net Security reporting likewise states it \"was found during internal security testing.\" No external researcher and no named AI system (Big Sleep, XBOW, ZeroPath, etc.) is credited with discovery. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ and https://www.helpnetsecurity.com/2026/06/16/cisco-sd-wan-cve-2026-20262-exploited/ CISA KEV-listed 2026-06-15 (due 2026-06-29). Curated 2026-06-26 from the NVD record and the Cisco advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "New or modified files appearing outside the application's intended upload directory on the SD-WAN Manager OS (e.g. writes into system, cron, startup, or web-root paths)",
+        "Crafted HTTP file-upload requests to the Remote Access / AnyConnect profile-upload API endpoint containing directory-traversal sequences (../) in path/filename parameters",
+        "File-upload API activity initiated by a low-privileged, single-task user account shortly after that account authenticates",
+        "Unexpected root-owned processes or privilege-escalation events following an authenticated arbitrary-file-write on the appliance"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-20262, CISA KEV (added 2026-06-15), and the Cisco advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the path traversal, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-34028": {
+    "name": "Commvault Command Center Path Traversal Vulnerability",
+    "type": "RCE",
+    "cvss_score": 10,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-05-02",
+    "cisa_kev_due_date": "2025-05-23",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited unauthenticated path-traversal to RCE. Public PoC by watchTowr Labs (github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028) chains the pre-auth SSRF on deployWebpackage.do with servicePack path traversal to drop and execute a malicious JSP web shell; a Metasploit module also exists.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Credited to a HUMAN researcher: Sonny Macdonald of watchTowr Labs, who reported it to Commvault on 2025-04-07 and published the technical writeup. No AI tool/agent is credited with discovery in any primary source. watchTowr blog (\"Fire in the Hole, We're Breaching the Vault\", https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-commvault-remote-code-execution-cve-2025-34028/) and Help Net Security (https://www.helpnetsecurity.com/2025/04/24/critical-commvault-rce-vulnerability-fixed-poc-available-cve-2025-34028/) both name Sonny Macdonald / watchTowr Labs. Greenbone: \"discovered by Sonny Macdonald of watchTowr Labs.\" Manual human research, not AI.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No source indicates AI-assisted exploit development. The public exploit chain was hand-built by watchTowr Labs (human researchers) and released as a GitHub PoC (https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028); a Metasploit module followed. No primary source credits an AI system with weaponization.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed exploitation; no public actor attribution. CISA added CVE-2025-34028 to the KEV catalog on 2025-05-02, about a week after public disclosure (advisory + PoC published 2025-04-23/24). No named threat actor, campaign, or spyware vendor is tied specifically to this CVE in public reporting; exploitation was opportunistic/mass-scanning-driven, accelerated by the public watchTowr PoC and a subsequent Metasploit module. (Distinct from the earlier nation-state-linked Commvault SaaS/Metallic intrusion associated with CVE-2025-3928.)",
+    "affected": "Commvault Command Center — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Commvault Command Center Innovation Release 11.38.0 through 11.38.19 (Linux and Windows)",
+      "NVD-stated affected range: 11.38.0 to 11.38.20",
+      "Fixed in 11.38.20 via maintenance packs SP38-CU20-433 and SP38-CU20-436",
+      "Fixed in 11.38.25 via maintenance packs SP38-CU25-434 and SP38-CU25-438",
+      "Feature/long-term releases on the 11.38 line below 11.38.20 are vulnerable; patches released 2025-04-10"
+    ],
+    "vector": "The Command Center exposes the deployWebpackage.do endpoint without authentication (CWE-306), making it remotely reachable by any unauthenticated network actor. The attacker abuses a server-side request forgery there (no host validation) to force the server to download an attacker-hosted ZIP \"install package,\" which the server unzips into a temporary directory; a path-traversal in the servicePack parameter (CWE-22) then relocates a malicious JSP from that temp directory into a web-accessible path. Requesting the planted JSP executes attacker code, yielding unauthenticated remote code execution in the context of the Commvault service account. The chain requires no credentials and no user interaction (CVSS 3.1 = 10.0, AV:N/AC:L/PR:N/UI:N/S:C).",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed unauthenticated path-traversal to RCE on Commvault Command Center; CISA set a 2025-05-23 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited unauthenticated path-traversal to RCE the timescale must collapse to the CISA due date (2025-05-23) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this unauthenticated path-traversal to RCE until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited unauthenticated path-traversal to RCE demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Commvault Command Center was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1505.003"
+    ],
+    "rwep_score": 72,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.97157,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-34028",
+    "cwe_refs": [
+      "CWE-22",
+      "CWE-306"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-34028"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-34028",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-05-02"
+      },
+      {
+        "vendor": "Commvault",
+        "advisory_id": null,
+        "url": "https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html",
+        "severity": "critical",
+        "published_date": "2025-04-22"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Credited to a HUMAN researcher: Sonny Macdonald of watchTowr Labs, who reported it to Commvault on 2025-04-07 and published the technical writeup. No AI tool/agent is credited with discovery in any primary source. watchTowr blog (\"Fire in the Hole, We're Breaching the Vault\", https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-commvault-remote-code-execution-cve-2025-34028/) and Help Net Security (https://www.helpnetsecurity.com/2025/04/24/critical-commvault-rce-vulnerability-fixed-poc-available-cve-2025-34028/) both name Sonny Macdonald / watchTowr Labs. Greenbone: \"discovered by Sonny Macdonald of watchTowr Labs.\" Manual human research, not AI. CISA KEV-listed 2025-05-02 (due 2025-05-23). Curated 2026-06-26 from the NVD record and the Commvault advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Unauthenticated inbound HTTP requests to the Command Center /commandcenter/deployWebpackage.do endpoint (pre-auth SSRF entry point)",
+        "Outbound HTTP connection initiated BY the Commvault server to an external/attacker-controlled host to fetch a ZIP install package (SSRF egress, unusual server-originated download)",
+        "New or unexpected .jsp files appearing under a web-accessible Command Center directory (malicious JSP planted via path traversal in the servicePack parameter after the ZIP is unzipped to a temp dir)",
+        "Commvault/Tomcat (Java) service process spawning a shell (cmd.exe / /bin/sh) consistent with JSP web shell execution under the service account"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-34028, CISA KEV (added 2025-05-02), and the Commvault advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated path-traversal to RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2024-58136": {
+    "name": "Yiiframework Yii Improper Protection of Alternate Path Vulnerability",
+    "type": "RCE",
+    "cvss_score": 9,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-05-02",
+    "cisa_kev_due_date": "2025-05-23",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited alternate-path protection bypass to RCE. Public PoCs/analysis chain Craft CMS CVE-2025-32432 into Yii: a crafted asset `generate-transform` request injects a Yii `__class` object-injection payload that instantiates an arbitrary class to write a PHP web shell, yielding unauthenticated RCE; remediated by upgrading yiisoft/yii2 to 2.0.52.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Not AI-discovered. Found by human researchers at Orange Cyberdefense / SensePost during a forensic incident-response investigation. The SensePost write-up credits \"Thomas Reynolds from the CSIRT team, Nicolas Bourras from the Ethical Hacking team, Wilfried Pascault from the CERT team,\" and the Yii advisory credits \"Nicolas Bourras & Thomas Reynolds from Orange Cyberdefense.\" No AI tool/agent is named anywhere as the discoverer. Sources: https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/ and https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates the in-the-wild exploit chain or public PoCs were AI-built. The campaign was reconstructed from forensic artifacts by human IR/ethical-hacking teams; public exploit/analysis (Rapid7, Medium PoC walkthroughs) is human-authored with no AI tooling credited.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed exploitation; no public actor/campaign attribution. Reconstructed by Orange Cyberdefense (SensePost) from a forensic IR engagement: reconnaissance began 2025-02-10 (repeated hits to Craft CMS /index.php?p=admin/actions/assets/generate-transform) and the first observed server compromise was 2025-02-14, exploited in the wild February through April 2025. Used as the object-injection sink in a chain with Craft CMS pre-auth RCE CVE-2025-32432; the threat actor is described only as \"a threat actor\" with no named group/spyware-vendor attribution. Used to deploy web shells, overwrite legitimate files, and exfiltrate sensitive data.",
+    "affected": "Yii framework Yii — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Yii 2 framework (yiisoft/yii2) before 2.0.52",
+      "Fixed in Yii 2.0.52",
+      "Regression of CVE-2024-4990 (GHSA-cjcc-p67m-7qxm): partial fix shipped in 2.0.50, complete fix in 2.0.52 — versions 2.0.50/2.0.51 still affected by the __class regression",
+      "Downstream impact on products embedding Yii, e.g. Craft CMS (reachable via CVE-2025-32432)"
+    ],
+    "vector": "A Yii 2 application that lets attacker-controlled array input reach Yii's behavior/configuration attachment logic is reachable over the network with no authentication. When the supplied array contains a `__class` key, Yii instantiates the named class with attacker-chosen parameters — an unsafe-reflection / object-injection primitive reintroduced as a regression of CVE-2024-4990 (incompletely fixed in 2.0.50). By selecting a class whose constructor or destructor performs file writes or command execution, the attacker converts that instantiation into remote code execution. In the observed campaign the input was delivered by chaining Craft CMS pre-auth RCE CVE-2025-32432, so a single unauthenticated request escalated straight to web-shell deployment and data theft on the host.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed alternate-path protection bypass to RCE on Yii framework Yii; CISA set a 2025-05-23 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited alternate-path protection bypass to RCE the timescale must collapse to the CISA due date (2025-05-23) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this alternate-path protection bypass to RCE until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited alternate-path protection bypass to RCE demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Yii framework Yii was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 72,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.87714,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-58136",
+    "cwe_refs": [
+      "CWE-424"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-58136"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-58136",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-05-02"
+      },
+      {
+        "vendor": "Yii framework",
+        "advisory_id": null,
+        "url": "https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52",
+        "severity": "critical",
+        "published_date": "2025-04-10"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Not AI-discovered. Found by human researchers at Orange Cyberdefense / SensePost during a forensic incident-response investigation. The SensePost write-up credits \"Thomas Reynolds from the CSIRT team, Nicolas Bourras from the Ethical Hacking team, Wilfried Pascault from the CERT team,\" and the Yii advisory credits \"Nicolas Bourras & Thomas Reynolds from Orange Cyberdefense.\" No AI tool/agent is named anywhere as the discoverer. Sources: https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/ and https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52 CISA KEV-listed 2025-05-02 (due 2025-05-23). Curated 2026-06-26 from the NVD record and the Yii framework advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Inbound HTTP requests carrying an `__class` array key in the request body/parameters that Yii passes into its behavior-attachment/configuration logic (object-injection payload)",
+        "Repeated requests to the Craft CMS chained recon endpoint `/index.php?p=admin/actions/assets/generate-transform` (when Yii is reached via CVE-2025-32432)",
+        "New PHP web shells dropped in the web root: `filemanager.php`, `autoload_classmap.php` (a renamed file manager), `wp-22.php`, `style.php`",
+        "PHP/php-fpm worker spawning unexpected shell commands or filesystem writes, and overwrites of legitimate application files (sites observed taken offline)"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2024-58136, CISA KEV (added 2025-05-02), and the Yii framework advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the alternate-path protection bypass to RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2024-38475": {
+    "name": "Apache HTTP Server Improper Escaping of Output Vulnerability",
+    "type": "Path-Traversal",
+    "cvss_score": 9.1,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-05-01",
+    "cisa_kev_due_date": "2025-05-22",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited mod_rewrite output-escaping flaw enabling unauthorized file mapping/disclosure. Public PoCs and full write-ups exist: Orange Tsai's \"Confusion Attacks\" blog and Black Hat USA 2024 slides detail the mod_rewrite filesystem-mapping technique, watchTowr published a working SonicWall SMA100 SonicBoom chain (CVE-2024-38475 + CVE-2023-44221), and 16+ PoC repos are indexed on GitHub.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Not AI-discovered. Credited to human researcher Orange Tsai (Cheng-Da Tsai, @orange_8361) of DEVCORE, who reported it to the Apache HTTP Server project on 2024-04-01 and disclosed it as part of the \"Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server\" research at Black Hat USA 2024. The Apache security advisory and oss-security disclosure both credit Orange Tsai; no AI tool/agent is named anywhere in the discovery chain. Sources: https://httpd.apache.org/security/vulnerabilities_24.html ; https://www.openwall.com/lists/oss-security/2024/07/01/8 ; https://blog.orange.tw/posts/2024-08-confusion-attacks-en/",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No evidence of AI-assisted exploit development. The exploitation technique was authored manually by Orange Tsai/DEVCORE and published with case studies; the in-the-wild weaponization by UNC6148 against SonicWall SMA100 (GTIG reporting) describes hands-on-keyboard operation with stolen credentials/OTP seeds and a custom rootkit (OVERSTEP), with no AI tooling attributed.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (added 2025-05-01). Exploited by UNC6148, a suspected financially-motivated actor tracked by Google Threat Intelligence Group (GTIG), against internet-facing SonicWall SMA 100 series appliances (which bundle Apache httpd). UNC6148 used CVE-2024-38475 as an unauthenticated path traversal to exfiltrate SQLite databases containing admin credentials and OTP seeds, then replayed those secrets to regain access to fully-patched/EoL appliances and deploy the previously-unknown OVERSTEP user-mode rootkit/backdoor. GTIG observed scanning since at least October 2024 and credential exfiltration as early as January 2025; activity overlaps with Abyss-branded ransomware and World Leaks extortion. watchTowr separately published a SonicBoom chain combining CVE-2024-38475 with CVE-2023-44221 for full SMA100 compromise.",
+    "affected": "Apache HTTP Server — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Apache HTTP Server 2.4.0 through 2.4.59 (all 2.4.x up to and including 2.4.59)",
+      "Affected configurations: server-context RewriteRule substitutions whose first segment is a backreference or variable (some unsafe RewriteRules)",
+      "Fixed in Apache HTTP Server 2.4.60 (new UnsafePrefixStat rewrite flag re-enables prior behavior for appropriately-constrained rules)",
+      "SonicWall SMA 100 series appliances bundle a vulnerable Apache httpd and were exploited in the wild (SNWLID-2024-0018; fixed in SMA100 firmware 10.2.1.15-81sv)"
+    ],
+    "vector": "mod_rewrite is reachable on any internet-facing Apache HTTP Server 2.4.59 or earlier whose configuration uses a server-context RewriteRule where the substitution's first segment is a backreference or variable. Because the substituted output is improperly escaped, attacker-controlled request input can steer the post-rewrite target to a filesystem location the server is permitted to serve but that no URL was ever meant to reach. The primitive yields source-code disclosure of on-disk files, or code execution when the mapped path lands on an executable handler. In the SonicWall SMA100 deployment that bundles Apache, UNC6148 used the unauthenticated traversal to read SQLite databases holding admin credentials and OTP seeds, then replayed those secrets to regain privileged access and install the OVERSTEP rootkit for persistence and data theft.",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level or local context), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed mod_rewrite output-escaping flaw enabling unauthorized file mapping/disclosure on Apache HTTP Server; CISA set a 2025-05-22 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited mod_rewrite output-escaping flaw enabling unauthorized file mapping/disclosure the timescale must collapse to the CISA due date (2025-05-22) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this mod_rewrite output-escaping flaw enabling unauthorized file mapping/disclosure until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited mod_rewrite output-escaping flaw enabling unauthorized file mapping/disclosure demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Apache HTTP Server was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1083"
+    ],
+    "rwep_score": 76,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.9393,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-38475",
+    "cwe_refs": [
+      "CWE-116"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://httpd.apache.org/security/vulnerabilities_24.html",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-38475"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-38475",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-05-01"
+      },
+      {
+        "vendor": "Apache",
+        "advisory_id": null,
+        "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+        "severity": "critical",
+        "published_date": "2024-07-01"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Not AI-discovered. Credited to human researcher Orange Tsai (Cheng-Da Tsai, @orange_8361) of DEVCORE, who reported it to the Apache HTTP Server project on 2024-04-01 and disclosed it as part of the \"Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server\" research at Black Hat USA 2024. The Apache security advisory and oss-security disclosure both credit Orange Tsai; no AI tool/agent is named anywhere in the discovery chain. Sources: https://httpd.apache.org/security/vulnerabilities_24.html ; https://www.openwall.com/lists/oss-security/2024/07/01/8 ; https://blog.orange.tw/posts/2024-08-confusion-attacks-en/ CISA KEV-listed 2025-05-01 (due 2025-05-22). Curated 2026-06-26 from the NVD record and the Apache advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Apache/appliance access logs showing requests that, after mod_rewrite server-context substitution, resolve to filesystem paths outside the intended document root (e.g. config files, .so handlers, or SQLite databases) reachable with no legitimate URL mapping",
+        "Source code (e.g. PHP/CGI script) returned verbatim in HTTP responses instead of being executed, or unexpected 200s for sensitive on-disk files",
+        "On SonicWall SMA100: unauthenticated reads/exfiltration of the appliance SQLite credential/OTP-seed databases, followed by successful logins replaying stolen admin credentials and OTP seeds",
+        "Post-exploitation persistence consistent with OVERSTEP: modified /etc/ld.so.preload (LD_PRELOAD hooking of libc functions), altered appliance boot/INITRD process, and hidden processes/files evading standard tooling"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2024-38475, CISA KEV (added 2025-05-01), and the Apache advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the mod_rewrite output-escaping flaw enabling unauthorized file mapping/disclosure, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2023-44221": {
+    "name": "SonicWall SMA100 Appliances OS Command Injection Vulnerability",
+    "type": "Command-Injection",
+    "cvss_score": 7.2,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-05-01",
+    "cisa_kev_due_date": "2025-05-22",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited OS command injection. watchTowr Labs published a full \"SonicBoom\" write-up and exploit chain (CVE-2024-38475 admin session-token leak → CVE-2023-44221 command injection) demonstrating an unauthenticated-to-remote-shell path on SMA100 appliances; public technical PoC available.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Not AI-discovered. SonicWall's advisory SNWLID-2023-0018 and corroborating reporting credit human security researcher Wenjie Zhong (alias \"H4lo\") of DBappSecurity Co. Ltd.'s Webin lab with finding and reporting the flaw; it was disclosed in December 2023. No AI tool/agent is named in any primary source. Sources: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018 ; https://thehackernews.com/2025/05/sonicwall-confirms-active-exploitation.html",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No source indicates AI-assisted exploit development. The public end-to-end exploit chain (codenamed \"SonicBoom\") was researched, built, and documented by human analysts at watchTowr Labs. Source: https://labs.watchtowr.com/sonicboom-from-stolen-tokens-to-remote-shells-sonicwall-sma100-cve-2023-44221-cve-2024-38475/",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed exploitation (CISA added 2025-05-01; SonicWall publicly confirmed active in-the-wild exploitation ~2025-04-29). No public threat-actor or campaign attribution by the vendor or CISA. watchTowr Labs coined \"SonicBoom\" for the demonstrated exploit chain (a researcher codename, not a named adversary). In the wild the post-auth requirement is satisfied by chaining CVE-2024-38475 (an Apache mod_rewrite path-mapping/auth-bypass flaw in the SMA100) to leak a logged-in administrator's session token, then using CVE-2023-44221 for command execution.",
+    "affected": "SonicWall SMA100 Appliances — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "SonicWall SMA 100 series (SMA 200, 210, 400, 410, 500v) running firmware 10.2.1.9-57sv and earlier — affected",
+      "Fixed in firmware 10.2.1.10-62sv (released 2023-12-04) and later",
+      "SonicWall recommends upgrading to 10.2.1.14-75sv or later"
+    ],
+    "vector": "The SMA100 SSL-VPN management interface is network-reachable, and an attacker holding administrative privilege submits a crafted request whose special shell metacharacters are not neutralized (CWE-78), producing OS command injection executed as the low-privileged 'nobody' user. In observed in-the-wild activity the post-authentication precondition is met by chaining CVE-2024-38475 — an Apache mod_rewrite path-mapping flaw in the SMA100 — to leak a logged-in administrator's session token, eliminating the need for valid credentials. The injected commands are then used to stage tooling and obtain interactive remote shells on the appliance, after which further on-box privilege escalation can target root.",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level or local context), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed OS command injection on SonicWall SMA100 Appliances; CISA set a 2025-05-22 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited OS command injection the timescale must collapse to the CISA due date (2025-05-22) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this OS command injection until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an unauthenticated OS command injection in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — SonicWall SMA100 Appliances was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-SC-7": "SC-7 boundary protection treats this appliance as the boundary; when the boundary device itself carries an unauthenticated OS command injection, the control protects nothing in front of it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 77,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.7493,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-44221",
+    "cwe_refs": [
+      "CWE-78"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018",
+      "https://nvd.nist.gov/vuln/detail/CVE-2023-44221"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2023-44221",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-05-01"
+      },
+      {
+        "vendor": "SonicWall",
+        "advisory_id": null,
+        "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018",
+        "severity": "high",
+        "published_date": "2023-12-05"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Not AI-discovered. SonicWall's advisory SNWLID-2023-0018 and corroborating reporting credit human security researcher Wenjie Zhong (alias \"H4lo\") of DBappSecurity Co. Ltd.'s Webin lab with finding and reporting the flaw; it was disclosed in December 2023. No AI tool/agent is named in any primary source. Sources: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018 ; https://thehackernews.com/2025/05/sonicwall-confirms-active-exploitation.html CISA KEV-listed 2025-05-01 (due 2025-05-22). Curated 2026-06-26 from the NVD record and the SonicWall advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Child processes (sh/busybox/curl/wget) spawned by the SMA100 SSL-VPN management web server and running as the low-privileged 'nobody' user",
+        "Unexpected outbound connections from the appliance to external infrastructure consistent with payload retrieval or reverse shells",
+        "Administrative session activity from anomalous source IPs immediately preceding command-injection requests (stolen-session-token replay from the CVE-2024-38475 chain)",
+        "New or modified files / web shells under the appliance web root or temp directories that are not part of the signed firmware image"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2023-44221, CISA KEV (added 2025-05-01), and the SonicWall advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the OS command injection, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-1976": {
+    "name": "Broadcom Brocade Fabric OS Code Injection Vulnerability",
+    "type": "Code-Injection",
+    "cvss_score": 6.7,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-28",
+    "cisa_kev_due_date": "2025-05-19",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited authenticated code injection to root. No public PoC or exploit code released; KEV-confirmed in-the-wild abuse where an admin-privileged Fabric OS user supplies a crafted IP-address value to inject code and gain full root execution on Fabric OS 9.1.0 through 9.1.1d6.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "No AI involvement in discovery. The Broadcom/Brocade vendor advisory (BSA-2025-2930, doc 25602) credits no researcher, firm, or tool at all; neither The Hacker News nor CSO Online reporting names a discoverer. There is no primary source crediting any named AI system (Big Sleep, XBOW, ZeroPath, OpenAI o-series, GTIG, etc.) with finding this. Per the conservative rule, ai_discovered=FALSE. Sources: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602 ; https://thehackernews.com/2025/04/cisa-adds-actively-exploited-broadcom.html",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No public exploit code or PoC exists, and no source indicates AI-assisted exploit development. Exploitation is KEV-confirmed in-the-wild but no weaponization tooling, exploit author, or AI-build claim has been published.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed exploitation (CISA KEV 2025-04-28). Broadcom's advisory explicitly states the vulnerability \"has been actively exploited in the field.\" No public threat-actor, campaign, or spyware-vendor attribution; no first-observed-in-wild date has been disclosed. Exploitation is constrained to actors who already hold a valid admin-level Fabric OS account on the SAN switch.",
+    "affected": "Broadcom (Brocade) Brocade Fabric OS — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Brocade Fabric OS 9.1.0 through 9.1.1d6 (inclusive) — affected",
+      "Fixed in Brocade Fabric OS 9.1.1d7",
+      "Fabric OS 9.2.x and 10.x release trains are not listed as affected by this advisory (covered separately under advisory doc 25000)"
+    ],
+    "vector": "Exploitation requires a pre-authenticated local user already holding a pre-defined admin role or a user-defined role with admin-level privileges on the Fabric OS switch (CVSS 3.1 AV:L / PR:H; CVSS 4.0 rescored AV:A adjacent). A flaw in IP-address input validation lets that admin user smuggle arbitrary code into a command path that executes as root, breaking out of the restricted admin shell. The primitive yields full root code execution — letting the attacker run any Fabric OS command or modify the OS itself (e.g. inserting custom subroutines), which defeats the root-access removal Broadcom introduced starting in Fabric OS 9.1.0. Net effect is an admin-to-root privilege escalation on the SAN fabric switch.",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level or local context), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed authenticated code injection to root on Broadcom (Brocade) Brocade Fabric OS; CISA set a 2025-05-19 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited authenticated code injection to root the timescale must collapse to the CISA due date (2025-05-19) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this authenticated code injection to root until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an unauthenticated authenticated code injection to root in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Broadcom (Brocade) Brocade Fabric OS was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-SC-7": "SC-7 boundary protection treats this appliance as the boundary; when the boundary device itself carries an unauthenticated authenticated code injection to root, the control protects nothing in front of it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1059",
+      "T1068"
+    ],
+    "rwep_score": 75,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.00736,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-1976",
+    "cwe_refs": [
+      "CWE-94",
+      "CWE-78"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-1976"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-1976",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "medium",
+        "published_date": "2025-04-28"
+      },
+      {
+        "vendor": "Broadcom (Brocade)",
+        "advisory_id": null,
+        "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602",
+        "severity": "medium",
+        "published_date": "2025-04-24"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "No AI involvement in discovery. The Broadcom/Brocade vendor advisory (BSA-2025-2930, doc 25602) credits no researcher, firm, or tool at all; neither The Hacker News nor CSO Online reporting names a discoverer. There is no primary source crediting any named AI system (Big Sleep, XBOW, ZeroPath, OpenAI o-series, GTIG, etc.) with finding this. Per the conservative rule, ai_discovered=FALSE. Sources: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602 ; https://thehackernews.com/2025/04/cisa-adds-actively-exploited-broadcom.html CISA KEV-listed 2025-04-28 (due 2025-05-19). Curated 2026-06-26 from the NVD record and the Broadcom (Brocade) advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Root-owned processes or shells spawned from an admin-role (non-root) Fabric OS CLI session, where 9.1.0+ should have stripped root access",
+        "Audit-log entries showing admin/user-defined-role commands taking IP-address arguments with malformed, oversized, or shell-metacharacter-laden values",
+        "Unauthorized modification of Fabric OS itself — added subroutines, altered system binaries, or config/firmware changes outside a sanctioned firmwaredownload maintenance window",
+        "Creation or privilege-bump of user-defined roles immediately preceding anomalous root-level activity on the switch"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-1976, CISA KEV (added 2025-04-28), and the Broadcom (Brocade) advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the authenticated code injection to root, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-42599": {
+    "name": "Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability",
+    "type": "RCE",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-28",
+    "cisa_kev_due_date": "2025-05-19",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited unauthenticated stack buffer overflow RCE. A single crafted HTTP request carrying an over-length field to the Active! Mail webmail endpoint overflows a stack buffer, producing pre-auth RCE (or a service-crashing DoS); used as a zero-day against Japanese mail/hosting providers with no public weaponized PoC released.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Not AI-discovered. Per the JPCERT/CC JVN advisory (JVN#22348866), \"QUALITIA CO., LTD. reported this vulnerability to JPCERT/CC.\" The vendor PSIRT is the credited reporter; no individual researcher and no AI system (Big Sleep, XBOW, ZeroPath, OpenAI o-series, GTIG/Project Zero, etc.) is named in any primary source. The flaw surfaced through in-the-wild zero-day exploitation against Japanese mail providers, then was coordinated-disclosed by the vendor. Source: https://jvn.jp/en/jp/JVN22348866/ ; vendor note https://www.qualitia.com/jp/news/2025/04/18_1030.html",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source attributes the exploit to AI-assisted development. The in-the-wild exploitation is described as a hand-crafted malicious HTTP request against the Active! Mail webmail front-end; no public weaponized PoC and no AI-tooling claim exists in the JVN advisory, vendor note, JPCERT/CC reporting, or security press (BleepingComputer, SecurityAffairs).",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited as a zero-day against Japanese organizations, primarily mail/hosting providers. IIJ (Internet Initiative Japan) detected attacks on 2025-04-15, before the 2025-04-18 vendor disclosure; subsequent forensics indicate some systems were compromised as early as August 2024 (8+ months of zero-day use). Impacted providers include IIJ Secure MX, Kagoya Japan, and WADAX. The IIJ Secure MX breach exposed ~311,288 email accounts and 488 cloud-admin credentials. KEV-confirmed exploitation; no public threat-actor/APT attribution.",
+    "affected": "Qualitia Active! Mail — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Active! mail 6 BuildInfo 6.60.05008561 and earlier (all Active! mail 6 builds up to and including 6.60.05008561)",
+      "Fixed in Active! mail 6 BuildInfo 6.60.06008562"
+    ],
+    "vector": "Active! Mail's webmail front-end is internet-facing and parses incoming HTTP requests prior to authentication. A remote, unauthenticated attacker sends a specially crafted request whose over-length field overflows a fixed-size stack buffer (CWE-121), overwriting the saved return address and redirecting execution into attacker-controlled data. On successful control this yields arbitrary code execution in the context of the web service on the mail server; on failed control it crashes the service for a denial of service. In observed incidents the foothold was used to reach hosted mailboxes and harvest stored credentials (including cloud-admin credentials at affected providers).",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed unauthenticated stack buffer overflow RCE on Qualitia Active! Mail; CISA set a 2025-05-19 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited unauthenticated stack buffer overflow RCE the timescale must collapse to the CISA due date (2025-05-19) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this unauthenticated stack buffer overflow RCE until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited unauthenticated stack buffer overflow RCE demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Qualitia Active! Mail was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1203"
+    ],
+    "rwep_score": 68,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=18 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.0302,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-42599",
+    "cwe_refs": [
+      "CWE-121"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.qualitia.com/jp/news/2025/04/18_1030.html",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-42599"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-42599",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-04-28"
+      },
+      {
+        "vendor": "Qualitia",
+        "advisory_id": null,
+        "url": "https://www.qualitia.com/jp/news/2025/04/18_1030.html",
+        "severity": "critical",
+        "published_date": "2025-04-18"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Not AI-discovered. Per the JPCERT/CC JVN advisory (JVN#22348866), \"QUALITIA CO., LTD. reported this vulnerability to JPCERT/CC.\" The vendor PSIRT is the credited reporter; no individual researcher and no AI system (Big Sleep, XBOW, ZeroPath, OpenAI o-series, GTIG/Project Zero, etc.) is named in any primary source. The flaw surfaced through in-the-wild zero-day exploitation against Japanese mail providers, then was coordinated-disclosed by the vendor. Source: https://jvn.jp/en/jp/JVN22348866/ ; vendor note https://www.qualitia.com/jp/news/2025/04/18_1030.html CISA KEV-listed 2025-04-28 (due 2025-05-19). Curated 2026-06-26 from the NVD record and the Qualitia advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Anomalous or oversized HTTP request(s) to the Active! Mail webmail endpoint that trigger a stack overflow (over-length field in the request body/headers)",
+        "Active! Mail / IIS web service process crashes, restarts, or DoS conditions (segfault-style aborts, abnormal CPU) on the webmail host",
+        "Unexpected child processes or shell/command execution spawned by the Active! Mail web service following a malformed request",
+        "Bulk access to hosted mailboxes and stored account/cloud-admin credentials, with outbound connections from the mail server to unfamiliar hosts"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-42599, CISA KEV (added 2025-04-28), and the Qualitia advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated stack buffer overflow RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-3928": {
+    "name": "Commvault Web Server Unspecified Vulnerability",
+    "type": "RCE",
+    "cvss_score": 8.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-28",
+    "cisa_kev_due_date": "2025-05-19",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited webshell creation on the web server. No public exploit code or technical PoC has been released; the vendor classes the flaw as \"unspecified,\" and it was exploited only as an in-the-wild zero-day via authenticated webshell creation/execution against the Commvault Web Server.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "No AI tool is credited with discovery. The vulnerability surfaced through incident detection: Microsoft notified Commvault of anomalous activity within Commvault's Azure environment on 2025-02-20, exposing the nation-state zero-day exploitation. Both the Commvault advisory (https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html) and downstream reporting (Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-3928) name no discoverer/AI system — it was found-in-the-wild via cloud-provider telemetry, not by Big Sleep/XBOW/ZeroPath/o-series or any named AI. Conservative determination: FALSE.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source attributes the exploit/webshell tooling to any AI system. The observed weaponization was conventional: an authenticated actor wrote and executed .aspx webshells on the Commvault Web Server, then pivoted to stored Azure/M365 application secrets. No AI-assisted exploit development is reported.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited as a zero-day by a suspected nation-state threat actor in the Commvault Metallic (SaaS/Azure) breach. Microsoft notified Commvault of the activity on 2025-02-20; the actor deployed webshells via the zero-day to gain persistent remote access and accessed Commvault-held Azure/M365 application credentials (client secrets) used for customer integrations, enabling service-principal impersonation into customer M365 tenants. No specific named APT group has been publicly attributed by CISA or Commvault. KEV-confirmed exploitation; added to CISA KEV 2025-04-28. CISA published an updated advisory with IOCs on 2025-05-22.",
+    "affected": "Commvault Web Server — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Commvault 11.36.0 through 11.36.45 (Windows and Linux) — fixed in 11.36.46",
+      "Commvault 11.32.0 through 11.32.88 (Windows and Linux) — fixed in 11.32.89",
+      "Commvault 11.28.0 through 11.28.140 (Windows and Linux) — fixed in 11.28.141",
+      "Commvault 11.20.0 through 11.20.216 (Windows and Linux) — fixed in 11.20.217"
+    ],
+    "vector": "The Commvault Web Server is internet-reachable, and an attacker holding valid (low-privilege) authenticated user credentials can send crafted requests that let them create and execute a webshell on the server — yielding remote code execution within the web-application context. Unauthenticated access is not exploitable, so the primitive requires a prior valid-account foothold, but it then provides persistent code execution. In the observed Metallic SaaS breach this foothold was used to read Commvault-stored Azure/M365 application credentials (client secrets), allowing impersonation of customer service principals and lateral movement into downstream M365 tenants — turning a single web-server compromise into cross-tenant cloud access.",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level or local context), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed webshell creation on the web server on Commvault Web Server; CISA set a 2025-05-19 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited webshell creation on the web server the timescale must collapse to the CISA due date (2025-05-19) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this webshell creation on the web server until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited webshell creation on the web server demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Commvault Web Server was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1505.003"
+    ],
+    "rwep_score": 72,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.019,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-3928",
+    "cwe_refs": [
+      "CWE-434"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-3928"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-3928",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-04-28"
+      },
+      {
+        "vendor": "Commvault",
+        "advisory_id": null,
+        "url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html",
+        "severity": "high",
+        "published_date": "2025-04-25"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "No AI tool is credited with discovery. The vulnerability surfaced through incident detection: Microsoft notified Commvault of anomalous activity within Commvault's Azure environment on 2025-02-20, exposing the nation-state zero-day exploitation. Both the Commvault advisory (https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html) and downstream reporting (Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-3928) name no discoverer/AI system — it was found-in-the-wild via cloud-provider telemetry, not by Big Sleep/XBOW/ZeroPath/o-series or any named AI. Conservative determination: FALSE. CISA KEV-listed 2025-04-28 (due 2025-05-19). Curated 2026-06-26 from the NVD record and the Commvault advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "New .aspx webshell files (e.g. shell.aspx, default.aspx) written into Commvault Web Server / IIS-served directories, followed by command execution in the web-app context",
+        "Outbound callback traffic to attacker C2 domains cloudsyncsvc.net and metabackup.org",
+        "Authentication / service-principal use from IPs outside Commvault's allowlisted range — flagged malicious IPs include 108.69.148.100, 128.92.80.210, 184.153.42.129, 108.6.189.53, 154.223.17.243, 159.242.42.20",
+        "Anomalous use of Commvault-held Azure/M365 app client secrets (service-principal sign-ins) and the suspicious user-agent 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0'"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-3928, CISA KEV (added 2025-04-28), and the Commvault advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the webshell creation on the web server, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-24054": {
+    "name": "Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability",
+    "type": "Spoofing",
+    "cvss_score": 6.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-17",
+    "cisa_kev_due_date": "2025-05-08",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited NTLM hash disclosure via crafted .library-ms files. Public PoCs (Exploit-DB 52280/52478/52480, seclists full-disclosure) ship a crafted .library-ms XML file pointing to a UNC path on an attacker SMB server; merely viewing the folder that holds it causes Explorer to authenticate and disclose the user's NTLMv2-SSP hash for offline cracking or relay.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "No AI system is credited. The underlying .library-ms NTLM hash-leak primitive was originally reported to Microsoft MSRC by human researcher John Page (aka hyp3rlinx) in 2018, dismissed at the time, and re-reported by other human researchers before the March 2025 fix; the in-the-wild exploitation was discovered and attributed by Check Point Research (human threat-intel team). Provenance is human/vendor throughout — no Big Sleep / XBOW / ZeroPath / o-series / GTIG attribution exists. Sources: https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/ and https://www.exploit-db.com/exploits/52280",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No evidence of AI-assisted exploit development. Public PoCs are hand-authored XML .library-ms files published to Exploit-DB (52280, 52478, 52480) and the seclists full-disclosure list; the weaponized campaign samples are simple crafted .library-ms/.url files delivered via malspam, with no reporting of AI involvement in their creation.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed exploitation. Check Point Research observed the \"NTLM Exploits Bomb\" malspam campaign first in the wild on ~19-21 March 2025 (eight days after the 11 March 2025 patch), targeting Polish and Romanian government and private institutions via Dropbox-hosted ZIP archives. One NTLM-collection SMB server used in the campaign (159.196.128[.]120) was previously attributed by HarfangLab to APT28 / Fancy Bear / Forest Blizzard (Russian GRU state-sponsored). The closely related predecessor flaw CVE-2024-43451 was exploited by Russia-affiliated UAC-0194; multiple groups have leveraged this NTLM-leak class.",
+    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "All supported Windows releases prior to the 2025-03-11 (March 2025) cumulative security update are affected",
+      "Windows 10 Version 1507 — fixed by KB5053618",
+      "Windows 10 Version 1607 and Windows Server 2016 — fixed by KB5053594",
+      "Windows 10 Version 1809 and Windows Server 2019 — fixed by KB5053596",
+      "Windows 10 Version 21H2 and 22H2 — fixed by KB5053606",
+      "Windows 11 Version 22H2 and 23H2 — fixed by KB5053602",
+      "Windows 11 Version 24H2 and Windows Server 2025 — fixed by KB5053598",
+      "Windows Server 2012 — KB5053886; Server 2012 R2 — KB5053887",
+      "Windows Server 2022 (21H2/22H2) — KB5053603; Server 2022 23H2 — KB5053599"
+    ],
+    "vector": "Reachable with minimal user interaction: an attacker delivers a malicious .library-ms (XML library-description) file, typically inside a ZIP archive sent via malspam or a Dropbox link. The file embeds a UNC path to an attacker-controlled SMB server, so when Windows Explorer parses it — triggered merely by navigating to, viewing, or single-clicking the containing folder, with no file actually opened — Windows initiates an outbound SMB/NTLM authentication and leaks the victim's NTLMv2-SSP hash (external-control-of-path / forced authentication, CWE-73). The captured hash is then cracked offline for the cleartext password or relayed (NTLM relay) to authenticate to other services, enabling lateral movement and, against privileged accounts, potential domain compromise.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed NTLM hash disclosure via crafted .library-ms files on Microsoft Windows; CISA set a 2025-05-08 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited NTLM hash disclosure via crafted .library-ms files the timescale must collapse to the CISA due date (2025-05-08) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this NTLM hash disclosure via crafted .library-ms files until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited NTLM hash disclosure via crafted .library-ms files demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Microsoft Windows was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1187",
+      "T1557",
+      "T1040"
+    ],
+    "rwep_score": 81,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.1193,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24054",
+    "cwe_refs": [
+      "CWE-73"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-24054"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-24054",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "medium",
+        "published_date": "2025-04-17"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": null,
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054",
+        "severity": "medium",
+        "published_date": "2025-03-11"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "No AI system is credited. The underlying .library-ms NTLM hash-leak primitive was originally reported to Microsoft MSRC by human researcher John Page (aka hyp3rlinx) in 2018, dismissed at the time, and re-reported by other human researchers before the March 2025 fix; the in-the-wild exploitation was discovered and attributed by Check Point Research (human threat-intel team). Provenance is human/vendor throughout — no Big Sleep / XBOW / ZeroPath / o-series / GTIG attribution exists. Sources: https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/ and https://www.exploit-db.com/exploits/52280 CISA KEV-listed 2025-04-17 (due 2025-05-08). Curated 2026-06-26 from the NVD record and the Microsoft advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Outbound SMB (TCP 445) NTLM authentication attempts to external/untrusted IP addresses (e.g., 159.196.128[.]120, 194.127.179[.]157) initiated shortly after a user browses or extracts a downloaded folder",
+        "Presence of .library-ms (XML library-description) files — or paired .url/.website/.lnk files — containing UNC paths (\\\\attacker\\share) to remote SMB servers, often inside Dropbox-delivered ZIP archives",
+        "NTLMv2-SSP authentication events from endpoints to non-domain, internet-facing hosts in SMB/auth logs",
+        "Malspam ZIP archives whose extraction or mere folder-view triggers Explorer-initiated remote SMB connections without the user opening any file"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-24054, CISA KEV (added 2025-04-17), and the Microsoft advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the NTLM hash disclosure via crafted .library-ms files, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-31201": {
+    "name": "Apple Multiple Products Arbitrary Read and Write Vulnerability",
+    "type": "Memory-Corruption",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-17",
+    "cisa_kev_due_date": "2025-05-08",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited pointer-authentication (RPAC) bypass giving arbitrary read/write. No public weaponized PoC for the in-the-wild chain; Apple removed the vulnerable code in 18.4.1, and public Full Disclosure / GitHub write-ups reconstruct the zero-click CoreAudio-RCE to PAC-bypass escalation flow conceptually rather than providing a working exploit.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "No AI tool or agent is credited with discovery. Apple's advisory and reputable reporting attribute CVE-2025-31201 to Apple itself (\"flagged by Apple\"); the paired CVE-2025-31200 is credited to \"Apple and the Google Threat Analysis Group (TAG).\" Both are human/vendor-PSIRT discoveries surfaced from in-the-wild exploitation, not an AI system. Sources: https://support.apple.com/en-us/122282 ; https://www.helpnetsecurity.com/2025/04/17/apple-plugs-zero-days-holes-used-in-targeted-iphone-attacks-cve-2025-31200-cve-2025-31201/",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No public source indicates the exploit was AI-built. This was a mercenary/commercial-spyware-grade zero-click iMessage chain consistent with human exploit-development tradecraft; no named AI tooling is referenced in any primary or secondary reporting.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (added 2025-04-17). Apple states the issue \"may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.\" It served as the kernel Pointer-Authentication-bypass / privilege-escalation stage of a zero-click iMessage exploit chain paired with CVE-2025-31200 (CoreAudio RCE), first patched 2025-04-16 in iOS 18.4.1. Widely assessed as mercenary/commercial spyware activity against high-risk individuals (journalists, activists/dissidents, diplomats, executives). No public named threat-actor or spyware-vendor attribution.",
+    "affected": "Apple Multiple Products — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "iOS and iPadOS before 18.4.1",
+      "macOS Sequoia before 15.4.1",
+      "tvOS before 18.4.1",
+      "visionOS before 2.4.1"
+    ],
+    "vector": "Reachability is network-based and zero-click: a maliciously crafted media file delivered over iMessage/SMS is processed by CoreAudio's AudioConverterService (CVE-2025-31200), yielding initial code execution without user interaction. CVE-2025-31201 then supplies an arbitrary read/write primitive that defeats ARM Pointer Authentication (RPAC), neutralizing Apple's primary ROP/JOP control-flow mitigation. Bypassing PAC lets the attacker forge/redirect protected pointers and escalate from the initial foothold toward kernel-level control and full device compromise. The two CVEs are exploited together as one chain against specifically targeted individuals.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed pointer-authentication (RPAC) bypass giving arbitrary read/write on Apple Multiple Products; CISA set a 2025-05-08 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited pointer-authentication (RPAC) bypass giving arbitrary read/write the timescale must collapse to the CISA due date (2025-05-08) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this pointer-authentication (RPAC) bypass giving arbitrary read/write until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited pointer-authentication (RPAC) bypass giving arbitrary read/write demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Apple Multiple Products was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1203",
+      "T1211"
+    ],
+    "rwep_score": 81,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.1236,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-31201",
+    "cwe_refs": [
+      "CWE-1220"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://support.apple.com/en-us/122282",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-31201"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-31201",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-04-17"
+      },
+      {
+        "vendor": "Apple",
+        "advisory_id": null,
+        "url": "https://support.apple.com/en-us/122282",
+        "severity": "critical",
+        "published_date": "2025-04-16"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "No AI tool or agent is credited with discovery. Apple's advisory and reputable reporting attribute CVE-2025-31201 to Apple itself (\"flagged by Apple\"); the paired CVE-2025-31200 is credited to \"Apple and the Google Threat Analysis Group (TAG).\" Both are human/vendor-PSIRT discoveries surfaced from in-the-wild exploitation, not an AI system. Sources: https://support.apple.com/en-us/122282 ; https://www.helpnetsecurity.com/2025/04/17/apple-plugs-zero-days-holes-used-in-targeted-iphone-attacks-cve-2025-31200-cve-2025-31201/ CISA KEV-listed 2025-04-17 (due 2025-05-08). Curated 2026-06-26 from the NVD record and the Apple advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Apple device running iOS/iPadOS below 18.4.1 (or macOS Sequoia below 15.4.1, tvOS below 18.4.1, visionOS below 2.4.1) that has not rebooted into the fixed build",
+        "Unexpected/anomalous process or kernel crash logs around media handling (CoreAudio / AudioConverterService) consistent with the paired CVE-2025-31200 trigger",
+        "Inbound iMessage/SMS media from unknown senders that arrives with no user interaction and may be auto-deleted (zero-click delivery)",
+        "Receipt of an Apple Threat Notification or other mercenary-spyware indicators (unexplained battery/network anomalies, unknown configuration/MDM profiles) on a high-risk target device"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-31201, CISA KEV (added 2025-04-17), and the Apple advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the pointer-authentication (RPAC) bypass giving arbitrary read/write, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-31200": {
+    "name": "Apple Multiple Products Memory Corruption Vulnerability",
+    "type": "Memory-Corruption",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-17",
+    "cisa_kev_due_date": "2025-05-08",
+    "poc_available": true,
+    "poc_description": "KEV-listed, actively-exploited CoreAudio memory-corruption RCE via a crafted media file. No clean standalone weaponized PoC is publicly published for the bug itself; a Full Disclosure write-up (seclists, Jun 2025) describes the zero-click iMessage chain (CVE-2025-31200 CoreAudio RCE + CVE-2025-31201 PAC bypass), and an independent researcher reported a live crafted-media-file trigger on iOS 18.2 to Apple.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Not AI-discovered. Apple's security advisory (support.apple.com/en-us/122282) credits the fix to \"Apple\" and the discovery is jointly attributed to Apple and Google's Threat Analysis Group (TAG) — a human threat-intelligence team that tracks commercial/mercenary surveillance vendors. An independent researcher (Joseph Goydish II) is also reported to have found and disclosed a live CoreAudio media-file zero-day to Apple in Dec 2024. No primary source credits any named AI system (Big Sleep, XBOW, ZeroPath, OpenAI o-series, etc.) with discovery. Sources: https://support.apple.com/en-us/122282 ; https://www.bleepingcomputer.com/news/security/apple-fixes-two-zero-days-exploited-in-targeted-iphone-attacks/ ; https://www.wiz.io/vulnerability-database/cve/cve-2025-31200",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No evidence of AI-assisted exploit development. The in-the-wild exploitation matches the commercial/mercenary-spyware pattern (zero-click iMessage delivery against targeted high-risk individuals, co-reported by Google TAG). No primary source attributes the exploit chain to any AI tooling.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed exploitation (added 2025-04-17). Apple states the issue \"may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1\" — the commercial/mercenary-spyware targeting pattern. Co-reported by Google Threat Analysis Group, which tracks commercial surveillance vendors (CSVs); reporting links the activity to targeting of journalists/activists/diplomats. Exploited as part of a zero-click iMessage exploit chain alongside CVE-2025-31201 (PAC bypass / arbitrary read-write). No specific named threat actor or spyware vendor is publicly attributed to this CVE; patched April 16, 2025.",
+    "affected": "Apple Multiple Products — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "iOS and iPadOS before 18.4.1 (iPhone XS and later; iPad Pro 13-inch, iPad Pro 13.9-inch 3rd gen and later, iPad Pro 11-inch 1st gen and later, iPad Air 3rd gen and later, iPad 7th gen and later, iPad mini 5th gen and later)",
+      "macOS Sequoia before 15.4.1",
+      "tvOS before 18.4.1 (Apple TV HD and Apple TV 4K, all models)",
+      "visionOS before 2.4.1 (Apple Vision Pro)",
+      "watchOS before 11.5"
+    ],
+    "vector": "Apple's CoreAudio framework parses audio streams embedded in media files without adequate bounds checking (CWE-119). A remotely delivered, maliciously crafted media file — reachable with no user interaction via zero-click iMessage delivery — triggers an out-of-bounds memory write during audio-stream decoding, yielding the primitive for arbitrary code execution in the media-processing context (network attack vector, no privileges, no UI: CVSS 9.8). In observed in-the-wild use it was chained with CVE-2025-31201 (Pointer Authentication / RPAC bypass with arbitrary read-write) to defeat memory-safety mitigations and escalate toward fuller device compromise as part of a sophisticated spyware operation.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor fix per the linked advisory."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed CoreAudio memory-corruption RCE via a crafted media file on Apple Multiple Products; CISA set a 2025-05-08 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited CoreAudio memory-corruption RCE via a crafted media file the timescale must collapse to the CISA due date (2025-05-08) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence (monthly/fortnightly), not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this CoreAudio memory-corruption RCE via a crafted media file until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited CoreAudio memory-corruption RCE via a crafted media file demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Apple Multiple Products was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1203",
+      "T1204.002"
+    ],
+    "rwep_score": 81,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.21255,
+    "epss_date": "2026-06-26",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-31200",
+    "cwe_refs": [
+      "CWE-119"
+    ],
+    "source_verified": "2026-06-26",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://support.apple.com/en-us/122282",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-31200"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-31200",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-04-17"
+      },
+      {
+        "vendor": "Apple",
+        "advisory_id": null,
+        "url": "https://support.apple.com/en-us/122282",
+        "severity": "critical",
+        "published_date": "2025-04-16"
+      }
+    ],
+    "last_updated": "2026-06-26",
+    "discovery_attribution_note": "Not AI-discovered. Apple's security advisory (support.apple.com/en-us/122282) credits the fix to \"Apple\" and the discovery is jointly attributed to Apple and Google's Threat Analysis Group (TAG) — a human threat-intelligence team that tracks commercial/mercenary surveillance vendors. An independent researcher (Joseph Goydish II) is also reported to have found and disclosed a live CoreAudio media-file zero-day to Apple in Dec 2024. No primary source credits any named AI system (Big Sleep, XBOW, ZeroPath, OpenAI o-series, etc.) with discovery. Sources: https://support.apple.com/en-us/122282 ; https://www.bleepingcomputer.com/news/security/apple-fixes-two-zero-days-exploited-in-targeted-iphone-attacks/ ; https://www.wiz.io/vulnerability-database/cve/cve-2025-31200 CISA KEV-listed 2025-04-17 (due 2025-05-08). Curated 2026-06-26 from the NVD record and the Apple advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Anomalous CoreAudio / mediaserverd crashes or memory-fault panic logs coinciding with processing of an inbound media/audio file",
+        "Receipt of a maliciously crafted media file (often zero-click via iMessage) followed by unexpected process spawn, sandbox-escape behavior, or outbound C2 beaconing",
+        "Device running an iOS/iPadOS build prior to 18.4.1 (or macOS prior to 15.4.1 / tvOS prior to 18.4.1 / visionOS prior to 2.4.1 / watchOS prior to 11.5)",
+        "Spyware-implant indicators on high-risk targets: unexpected configuration/provisioning profiles, BlastDoor-bypass artifacts, or Apple threat-notification to the user"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-31200, CISA KEV (added 2025-04-17), and the Apple advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the CoreAudio memory-corruption RCE via a crafted media file, framework gaps mapped global-first, and a paired zero-day lesson added."
   }
 }