@blamejs/exceptd-skills 0.18.18 → 0.18.20

package/data/cve-catalog.json

@@ -55,8 +55,8 @@
     "ai_discovery_methodology": {
       "field_added": "2026-05-15",
       "agents_md_target": "Hard Rule #7 — '41% of 2025 zero-days were AI-discovered'. Catalog target rate floor: 0.40.",
-      "current_rate": 0.025,
-      "current_floor_enforced_by_test": 0.025,
+      "current_rate": 0.024,
+      "current_floor_enforced_by_test": 0.024,
       "ladder_to_target": [
         0.027,
         0.028,
@@ -50085,5 +50085,2148 @@
     "_kev_short_description": "Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the CoreAudio memory-corruption RCE via a crafted media file, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2021-20035": {
+    "name": "SonicWall SMA100 Appliances OS Command Injection Vulnerability",
+    "type": "Command-Injection",
+    "cvss_score": 6.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-16",
+    "cisa_kev_due_date": "2025-05-07",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. Authenticated request to the SMA 100 management interface carrying unsanitized shell metacharacters in a parameter, executing injected OS commands as 'nobody'; weaponized in-wild by UNC6148 to stage and load the OVERSTEP ELF backdoor. No public standalone PoC widely circulated; exploitation details documented by GTIG/Mandiant.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Not AI-discovered. Originally reported to SonicWall in 2021 by human researchers — credited to Qihoo 360 Alpha (Alpha) Lab per security reporting (https://cybersecuritynews.com/sonicwall-os-command-injection-vulnerability/). The 2025 in-the-wild exploitation was characterized by Google Threat Intelligence Group (GTIG) and Mandiant Incident Response, plus SonicWall PSIRT (https://cloud.google.com/blog/topics/threat-intelligence/sonicwall-secure-mobile-access-exploitation-overstep-backdoor). No primary source credits any named AI system with discovery.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source attributes AI assistance to weaponization or exploit development. The UNC6148 campaign deploys the hand-built OVERSTEP ELF user-mode rootkit via established post-exploitation tradecraft (ld.so.preload injection, INITRD repacking); no AI-assisted tooling is referenced by GTIG/Mandiant.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-listed 2025-04-16 (exploitation confirmed). Attributed to UNC6148, a suspected financially-motivated actor active since at least October 2024, with tradecraft overlapping historical Abyss-branded ransomware deployments. UNC6148 chains stolen admin credentials/OTP seeds with CVE-2021-20035 on fully-patched but end-of-life SMA 100 appliances to deploy the OVERSTEP persistent backdoor/user-mode rootkit (GTIG/Mandiant, July 2025).",
+    "affected": "SonicWall SMA100 Appliances — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "SMA 100 series (models 200, 210, 400, 410, 500v): 9.0.0.10-28sv and earlier",
+      "SMA 100 series: 10.2.0.7-34sv and earlier",
+      "SMA 100 series: 10.2.1.0-17sv and earlier"
+    ],
+    "vector": "The SMA 100 web-based management interface fails to neutralize shell metacharacters in attacker-supplied input (CWE-78), so a remote attacker authenticated to the management plane can inject arbitrary OS commands that execute as the low-privilege 'nobody' account. SonicWall initially scored it DoS-only (CVSS 3.1 6.5, A:H) but later confirmed it can be driven to arbitrary code execution. In the UNC6148 campaign the actor first obtains valid admin credentials/OTP seeds (likely harvested in earlier intrusions), then uses this injection as the on-box code-execution primitive to repack the INITRD boot image and install the OVERSTEP rootkit via /etc/ld.so.preload — converting a limited 'nobody' command run into persistent, reboot-surviving, log-tampering control of the appliance and a credential-exfiltration foothold for lateral movement.",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level, local/physical access, or non-default config), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed authenticated OS command injection driven to code execution on SonicWall SMA100 Appliances; CISA set a 2025-05-07 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited authenticated OS command injection driven to code execution the timescale must collapse to the CISA due date (2025-05-07) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this authenticated OS command injection driven to code execution until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an attacker-reachable authenticated OS command injection driven to code execution in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — SonicWall SMA100 Appliances was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-SC-7": "SC-7 boundary protection treats this appliance as the boundary; when the boundary device itself carries a authenticated OS command injection driven to code execution, the control protects nothing in front of it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059",
+      "T1078"
+    ],
+    "rwep_score": 57,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.0389,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-20035",
+    "cwe_refs": [
+      "CWE-78"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022",
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-20035"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2021-20035",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "medium",
+        "published_date": "2025-04-16"
+      },
+      {
+        "vendor": "SonicWall",
+        "advisory_id": null,
+        "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022",
+        "severity": "medium",
+        "published_date": "2021-09-27"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Not AI-discovered. Originally reported to SonicWall in 2021 by human researchers — credited to Qihoo 360 Alpha (Alpha) Lab per security reporting (https://cybersecuritynews.com/sonicwall-os-command-injection-vulnerability/). The 2025 in-the-wild exploitation was characterized by Google Threat Intelligence Group (GTIG) and Mandiant Incident Response, plus SonicWall PSIRT (https://cloud.google.com/blog/topics/threat-intelligence/sonicwall-secure-mobile-access-exploitation-overstep-backdoor). No primary source credits any named AI system with discovery. CISA KEV-listed 2025-04-16 (due 2025-05-07). Curated 2026-06-28 from the NVD record and the SonicWall advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "/etc/ld.so.preload populated with >2 bytes (normally empty) pointing at a rogue ELF in /cf/ (e.g. libsamba-errors.so.6) — OVERSTEP preload persistence",
+        "Web server access-log requests whose query parameters contain the magic keywords dobackshell or dopasswords (OVERSTEP command channel via write() parsing)",
+        "Reverse shell egress from the appliance: bash -i >& /dev/tcp/<ip>/<port> 0>&1, plus outbound beaconing to attacker VPS (observed 64.52.80.80, 193.149.176.230)",
+        "Admin-credentialed VPN logins from low-reputation/VPS source IPs (observed 193.149.180.50 BitLaunch) followed by 'settings exported/imported' and manual 'clear all logs' events outside maintenance windows"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2021-20035, CISA KEV (added 2025-04-16), and the SonicWall advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the authenticated OS command injection driven to code execution, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2024-53150": {
+    "name": "Linux Kernel Out-of-Bounds Read Vulnerability",
+    "type": "Info-Disclosure",
+    "cvss_score": 7.1,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-09",
+    "cisa_kev_due_date": "2025-04-30",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. A crafted USB audio device advertising clock descriptors with under-sized bLength values triggers out-of-bounds reads during the driver's clock-source traversal on enumeration; weaponized in the wild as part of a physical-access USB chain to extract data from locked Android phones. No standalone public PoC repo; behavior reproducible with a programmable USB gadget emitting malformed UAC clock descriptors.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "No named AI tool is credited with discovery. The fix (\"ALSA: usb-audio: Fix out of bounds reads when finding clock sources\") was authored by ALSA maintainer Takashi Iwai and announced through the Linux kernel CVE process (gregkh, https://lore.kernel.org/linux-cve-announce/2024122427-CVE-2024-53150-3a7d@gregkh/). The CVE entered CISA KEV because it was found exploited in the wild against Android devices — Google's April 2025 Android Security Bulletin notes it \"may be under limited, targeted exploitation\" (https://source.android.com/docs/security/bulletin/2025-04-01). Public reporting attributes the broader USB-driver exploitation cluster to mobile-forensic/spyware tooling (Cellebrite), not to an AI-discovered finding. No syzkaller/syzbot or AI fuzzer attribution is present in primary sources.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI was used to weaponize or develop an exploit for CVE-2024-53150. The in-the-wild exploitation is associated with commercial mobile-forensic extraction tooling (Cellebrite-class) requiring physical USB access to a locked Android device; no AI-assisted exploit development is reported.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-listed 2025-04-09 (exploitation confirmed). Part of the Android USB-driver in-the-wild cluster alongside CVE-2024-53197 and CVE-2024-53104; Google's April 2025 Android Security Bulletin flags it as possibly \"under limited, targeted exploitation.\" Exploitation scenario is physical USB access to extract data from locked smartphones, consistent with mobile-forensic/spyware tooling. CVE-2024-53197 (same cluster) was confirmed by Amnesty International to be exploited by Cellebrite forensic tools against a Serbian activist (Dec 2024); GrapheneOS developers assess CVE-2024-53150 as likely part of the same batch. No public named-APT/ransomware-group attribution for this specific CVE.",
+    "affected": "Linux Kernel — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Linux kernel through 5.4.287 (fixed in 5.4.288)",
+      "5.5 through 5.10.231 (fixed in 5.10.232)",
+      "5.11 through 5.15.174 (fixed in 5.15.175)",
+      "5.16 through 6.1.120 (fixed in 6.1.121)",
+      "6.2 through 6.6.64 (fixed in 6.6.65)",
+      "6.7 through 6.11.11 (fixed in 6.11.12)",
+      "6.12 through 6.12.2 (fixed in 6.12.3)",
+      "Fixed in mainline 6.13; Android kernels patched via 2025-04-05 security patch level"
+    ],
+    "vector": "The Linux kernel's ALSA USB-audio driver (snd-usb-audio) traverses clock-source, clock-multiplier, and clock-selector descriptors of an attached USB audio device without validating each descriptor's bLength field. A malicious or bogus USB device can present a descriptor whose declared length is shorter than the structure the driver dereferences, so descriptor parsing reads past the end of the allocated descriptor buffer (CWE-125 out-of-bounds read). Reachability requires physical USB access and the (low) privilege of the kernel auto-binding the audio driver on enumeration; the primitive is an information leak of adjacent kernel memory (C:H), which in a forensic-extraction chain helps defeat at-rest protections / leak sensitive data from a locked device, and the malformed-parse path can also crash the driver (A:H). It is not remotely reachable (AV:L) and yields disclosure/DoS rather than direct code execution on its own.",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level, local/physical access, or non-default config), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed USB-audio out-of-bounds kernel read on Linux Kernel; CISA set a 2025-04-30 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited USB-audio out-of-bounds kernel read the timescale must collapse to the CISA due date (2025-04-30) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this USB-audio out-of-bounds kernel read until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited USB-audio out-of-bounds kernel read demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Linux Kernel was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1203",
+      "T1006"
+    ],
+    "rwep_score": 59,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.01325,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-53150",
+    "cwe_refs": [
+      "CWE-125"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://lore.kernel.org/linux-cve-announce/2024122427-CVE-2024-53150-3a7d@gregkh/",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-53150"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-53150",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-04-09"
+      },
+      {
+        "vendor": "Linux",
+        "advisory_id": null,
+        "url": "https://lore.kernel.org/linux-cve-announce/2024122427-CVE-2024-53150-3a7d@gregkh/",
+        "severity": "high",
+        "published_date": "2024-12-24"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "No named AI tool is credited with discovery. The fix (\"ALSA: usb-audio: Fix out of bounds reads when finding clock sources\") was authored by ALSA maintainer Takashi Iwai and announced through the Linux kernel CVE process (gregkh, https://lore.kernel.org/linux-cve-announce/2024122427-CVE-2024-53150-3a7d@gregkh/). The CVE entered CISA KEV because it was found exploited in the wild against Android devices — Google's April 2025 Android Security Bulletin notes it \"may be under limited, targeted exploitation\" (https://source.android.com/docs/security/bulletin/2025-04-01). Public reporting attributes the broader USB-driver exploitation cluster to mobile-forensic/spyware tooling (Cellebrite), not to an AI-discovered finding. No syzkaller/syzbot or AI fuzzer attribution is present in primary sources. CISA KEV-listed 2025-04-09 (due 2025-04-30). Curated 2026-06-28 from the NVD record and the Linux advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "A USB audio (UAC1/UAC2/UAC3) device enumerating with malformed clock-source/clock-multiplier/clock-selector descriptors whose bLength is shorter than the structure size",
+        "Unexpected USB-audio device attachment events on a locked/idle device, consistent with forensic-extraction USB hardware rather than a user-attached peripheral",
+        "Kernel reads of adjacent memory during snd-usb-audio clock-descriptor traversal (validate_clock_* paths) — may surface as KASAN out-of-bounds-read reports on instrumented kernels",
+        "Audio/USB subsystem activity (snd-usb-audio module load, descriptor parsing) immediately following physical USB connection with no corresponding legitimate audio use"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2024-53150, CISA KEV (added 2025-04-09), and the Linux advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the USB-audio out-of-bounds kernel read, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2024-53197": {
+    "name": "Linux Kernel Out-of-Bounds Access Vulnerability",
+    "type": "Memory-Corruption",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-09",
+    "cisa_kev_due_date": "2025-04-30",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. A USB device (emulating a Creative Extigy or Digidesign Mbox sound card) declares a bNumConfigurations exceeding its real descriptor set; when the snd-usb-audio quirk path walks the configuration array it accesses memory beyond the under-sized dev->config allocation, yielding an out-of-bounds read/write usable as a kernel memory-corruption primitive. Demonstrated in the wild via Cellebrite UFED USB-emulation hardware; no standalone public exploit code released, but Amnesty International documented the live forensic exploit chain.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Not AI-discovered. The vulnerability was identified through manual forensic analysis of a compromised Android device performed by Amnesty International's Security Lab, with the underlying USB driver vulnerabilities credited to a named human researcher — Benoit Sevens of Google's Threat Analysis Group (GTAG). Amnesty's report explicitly thanks Sevens for identifying the USB vulnerabilities; no AI tool, agent, or automated fuzzer is credited in any primary source. Source: https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI involvement reported in weaponization. The exploit was developed and packaged by Cellebrite as part of a hand-built USB-device-emulation chain (fake video/audio/HID devices) delivered via its UFED forensic extraction hardware. No primary source attributes any part of the exploit development to an AI system. Source: https://www.amnesty.org/en/wp-content/uploads/2025/03/EUR7091182025ENGLISH.pdf",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited in the wild by Cellebrite's UFED/UFED Premium forensic extraction tool. Used by Serbian authorities to unlock and root-access the locked Android phone of a Serbian student activist while in detention (first documented in-wild use ~December 25, 2024; broader campaign against journalists/activists disclosed by Amnesty International Security Lab in February 2025). Part of a multi-stage USB-driver exploit chain alongside CVE-2024-53104 (UVC) and CVE-2024-50302 (HID). Commercial forensic/lawful-intercept vendor abuse against civil society; no ransomware association.",
+    "affected": "Linux Kernel — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Linux kernel 2.6.12 through < 4.19.325 (fixed in 4.19.325)",
+      "4.20 through < 5.4.287 (fixed in 5.4.287)",
+      "5.5 through < 5.10.231 (fixed in 5.10.231)",
+      "5.11 through < 5.15.174 (fixed in 5.15.174)",
+      "5.16 through < 6.1.120 (fixed in 6.1.120)",
+      "6.2 through < 6.6.64 (fixed in 6.6.64)",
+      "6.7 through < 6.11.11 (fixed in 6.11.11)",
+      "6.12 through < 6.12.2 (fixed in 6.12.2)",
+      "Fixed in mainline 6.13-rc1; Android patched in April 2025 Android Security Bulletin (2025-04-05 patch level)"
+    ],
+    "vector": "An attacker with brief physical access plugs a malicious USB gadget into the target's locked Linux/Android device, reaching the kernel's ALSA USB-audio driver through normal USB enumeration. The crafted device matches the Extigy/Mbox quirk path and advertises a bNumConfigurations value larger than the configuration array actually allocated by usb_get_configuration(), so subsequent indexed access (e.g. in usb_destroy_configuration / snd_usb_create_quirk) reads and writes past the dev->config allocation — an out-of-bounds primitive (CWE-787). Combined with the other USB-driver bugs in the Cellebrite chain, this memory corruption is leveraged to bypass the lockscreen and escalate from the unprivileged USB-handling context to kernel/root code execution, giving full device compromise.",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level, local/physical access, or non-default config), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed USB-audio out-of-bounds kernel access on Linux Kernel; CISA set a 2025-04-30 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited USB-audio out-of-bounds kernel access the timescale must collapse to the CISA due date (2025-04-30) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this USB-audio out-of-bounds kernel access until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited USB-audio out-of-bounds kernel access demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Linux Kernel was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1068",
+      "T1212"
+    ],
+    "rwep_score": 59,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.0356,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-53197",
+    "cwe_refs": [
+      "CWE-787"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://lore.kernel.org/linux-cve-announce/2024122725-CVE-2024-53197-6aef@gregkh/",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-53197"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-53197",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-04-09"
+      },
+      {
+        "vendor": "Linux",
+        "advisory_id": null,
+        "url": "https://lore.kernel.org/linux-cve-announce/2024122725-CVE-2024-53197-6aef@gregkh/",
+        "severity": "high",
+        "published_date": "2024-12-27"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Not AI-discovered. The vulnerability was identified through manual forensic analysis of a compromised Android device performed by Amnesty International's Security Lab, with the underlying USB driver vulnerabilities credited to a named human researcher — Benoit Sevens of Google's Threat Analysis Group (GTAG). Amnesty's report explicitly thanks Sevens for identifying the USB vulnerabilities; no AI tool, agent, or automated fuzzer is credited in any primary source. Source: https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/ CISA KEV-listed 2025-04-09 (due 2025-04-30). Curated 2026-06-28 from the NVD record and the Linux advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Physical USB enumeration of a device claiming to be a Creative Extigy or Digidesign Mbox sound card immediately following enumeration of other anomalous USB devices (fake UVC video device, HID keyboard) — the signature of a multi-device forensic-tool exploit chain",
+        "Kernel out-of-bounds access / memory-corruption oops or KASAN slab-out-of-bounds report originating in snd-usb-audio (usb_destroy_configuration / snd_usb_create_quirk) triggered by a device advertising bNumConfigurations larger than its actual descriptor set",
+        "On Android: lockscreen bypass followed by unexpected escalation to root on a device that was physically connected to forensic extraction hardware (UFED) while seized/detained",
+        "USB device descriptor presenting an inconsistent bNumConfigurations field (declared configuration count exceeding the configurations actually returned during usb_get_configuration)"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2024-53197, CISA KEV (added 2025-04-09), and the Linux advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the USB-audio out-of-bounds kernel access, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-29824": {
+    "name": "Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability",
+    "type": "Use-After-Free",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-08",
+    "cisa_kev_due_date": "2025-04-29",
+    "poc_available": true,
+    "poc_description": "Public PoC/exploit available. Public detection/mitigation scripts and exploit write-ups exist (STAR Labs \"Blind Date\" analysis, BI.ZONE deep-dive, GitHub PoCs); in-the-wild exploit ran in-memory from dllhost.exe via PipeMagic, abusing a CLFS .blf UAF + RtlSetAllBits token overwrite to reach SYSTEM.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Credited to Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Security Response Center (MSRC), who discovered post-compromise in-the-wild exploitation of the CLFS zero-day against a small set of targets — a vendor threat-intel team, not an AI tool. No named AI system is credited with discovery. Source: Microsoft Security Blog \"Exploitation of CLFS zero-day leads to ransomware activity\" (https://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/) and the MSRC advisory acknowledgements.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source attributes the exploit development or weaponization to any AI system. The exploit was hand-crafted by the Storm-2460/RansomEXX actor and delivered in-memory via the PipeMagic backdoor; Microsoft's and BI.ZONE's technical write-ups describe a manually-developed kernel UAF exploit chain with no mention of AI assistance.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited in the wild as a zero-day by Storm-2460 (Microsoft tracking), the actor behind the RansomEXX ransomware family, delivered via the PipeMagic backdoor. Post-compromise privilege-escalation use observed before the April 8, 2025 patch against organizations in US IT and real-estate sectors, the Venezuelan financial sector, a Spanish software company, and the Saudi retail sector. CISA KEV-listed 2025-04-08 with known_ransomware = Known.",
+    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Windows Server 2008 R2 SP1 / 2012 / 2012 R2 / 2016 / 2019 / 2022 / 2022 23H2 / 2025 (x64) — fixed via April 2025 Patch Tuesday updates",
+      "Windows 10 (1607, 1809, 21H2, 22H2; 32-bit and x64) — vulnerable; fix released April 2025 (Windows 10 packages initially delayed at disclosure, then shipped)",
+      "Windows 11 22H2 and 23H2 (x64, ARM64) — vulnerable; fixed April 2025",
+      "Windows 11 24H2 — vulnerability present but the observed exploit did not work (NtQuerySystemInformation System Information Class access restricted to SeDebugPrivilege holders); still patched April 2025"
+    ],
+    "vector": "A local, low-privileged authenticated user reaches the Common Log File System (clfs.sys) kernel driver through standard CLFS APIs operating on a crafted base-log (.blf) file, triggering a use-after-free (CWE-416) on a freed CLFS structure. The actor leaks kernel addresses to user mode via NtQuerySystemInformation, then weaponizes the dangling pointer together with the RtlSetAllBits primitive to overwrite the exploiting process's token privileges field with 0xFFFFFFFF, granting all privileges and effectively SYSTEM. With SYSTEM, the chain injects into winlogon.exe, dumps LSASS for credentials, and launches RansomEXX from dllhost.exe — turning a post-compromise foothold into domain-wide ransomware impact.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed CLFS driver use-after-free privilege escalation on Microsoft Windows; CISA set a 2025-04-29 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited CLFS driver use-after-free privilege escalation the timescale must collapse to the CISA due date (2025-04-29) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this CLFS driver use-after-free privilege escalation until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited CLFS driver use-after-free privilege escalation demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Microsoft Windows was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1068",
+      "T1486",
+      "T1003"
+    ],
+    "rwep_score": 81,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.17982,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-29824",
+    "cwe_refs": [
+      "CWE-416"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29824",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-29824"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-29824",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-04-08"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": null,
+        "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29824",
+        "severity": "high",
+        "published_date": "2025-04-08"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Credited to Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Security Response Center (MSRC), who discovered post-compromise in-the-wild exploitation of the CLFS zero-day against a small set of targets — a vendor threat-intel team, not an AI tool. No named AI system is credited with discovery. Source: Microsoft Security Blog \"Exploitation of CLFS zero-day leads to ransomware activity\" (https://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/) and the MSRC advisory acknowledgements. CISA KEV-listed 2025-04-08 (due 2025-04-29). Curated 2026-06-28 from the NVD record and the Microsoft advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "CLFS base-log file written at C:\\ProgramData\\SkyPDF\\PDUDrv.blf immediately before a SYSTEM-level token swap (exploit artifact).",
+        "dllhost.exe spawned with anomalous command lines: '-accepteula -r -ma lsass.exe c:\\programdata\\<random>' (procdump-style LSASS dump) and '--do <path>' to launch ransomware.",
+        "certutil downloading a malicious MSBuild (.csproj/.xml) payload from a compromised third-party site / aaaaabbbbbbb.eastus.cloudapp.azure[.]com; PipeMagic decrypted via the EnumCalendarInfoA callback and injected into winlogon.exe.",
+        "Recovery-tampering sequence post-encryption: 'bcdedit /set {default} recoveryenabled no', 'wbadmin delete catalog -quiet', 'wevtutil cl Application', plus ransom note !_READ_ME_REXX2_!.txt and a random per-device file extension."
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-29824, CISA KEV (added 2025-04-08), and the Microsoft advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the CLFS driver use-after-free privilege escalation, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-30406": {
+    "name": "Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability",
+    "type": "Deserialization",
+    "cvss_score": 9,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-08",
+    "cisa_kev_due_date": "2025-04-29",
+    "poc_available": true,
+    "poc_description": "Public PoC/exploit available. Forge a __VIEWSTATE/ViewState payload signed with the product's hard-coded machineKey containing a .NET deserialization gadget chain and POST it to the CentreStack/Triofox portal to achieve unauthenticated RCE as the IIS portal app-pool user; Huntress developed working PoC exploits.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Not AI-discovered. Found during active in-the-wild exploitation by the Huntress SOC: on 2025-04-11 an internal Huntress 0-day detector alerted on the exploitation, and Huntress threat researchers (human team) then analyzed the root cause (hard-coded ASP.NET machineKey enabling ViewState deserialization). No named AI tool/agent is credited with discovery in any primary source. Vendor (Gladinet) advisory and NVD note exploitation in the wild since March 2025. Source: https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source credits any AI system with weaponization. The exploitation technique is the well-established public ASP.NET ViewState deserialization attack (ysoserial.net-style gadget chains) applied to a leaked/hard-coded machineKey; Huntress researchers hand-developed proof-of-concept exploits. No AI-assisted exploit development is reported.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (CISA added 2025-04-08, due 2025-04-29). Exploited in the wild since March 2025 per NVD/vendor; Huntress observed the earliest indicator of compromise in its partner base at 2025-04-11 16:59:44 UTC and documented seven compromised organizations (~120 endpoints running the software identified). No public named threat-actor/ransomware attribution. Observed post-exploitation tooling: out-of-band (oastify.com) connectivity tests via PowerShell, Cobalt Strike loaded via a sideloaded d3d11.dll (with a renamed Wallpaper Engine launcher \"Centre.exe\"), and MeshCentral for persistent remote access plus lateral movement.",
+    "affected": "Gladinet CentreStack — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Gladinet CentreStack through 16.1.10296.56315 (all versions below the fixed 16.4.10315.56368)",
+      "Gladinet Triofox: all versions below 16.4.10317.56372"
+    ],
+    "vector": "The CentreStack/Triofox web portal ships a hard-coded ASP.NET machineKey in its IIS web.config, so any unauthenticated remote attacker who knows that static key (it is the same across installs) can forge a valid, MAC-signed __VIEWSTATE payload. Because IIS trusts the signed ViewState and deserializes it server-side, the forged payload carries a malicious .NET object graph (a standard ViewState/ysoserial gadget chain) that executes arbitrary code at deserialization time. Code runs as the IIS application-pool identity (IISAPPPOOL\\portaluser / portal app pool), which is then trivially escalated toward NT AUTHORITY\\SYSTEM for full server compromise. Reachability is the internet-exposed portal endpoint; the primitive is signed-ViewState deserialization RCE; escalation is app-pool-to-SYSTEM plus lateral movement.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed hard-coded machineKey enabling ViewState deserialization RCE on Gladinet CentreStack; CISA set a 2025-04-29 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited hard-coded machineKey enabling ViewState deserialization RCE the timescale must collapse to the CISA due date (2025-04-29) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this hard-coded machineKey enabling ViewState deserialization RCE until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited hard-coded machineKey enabling ViewState deserialization RCE demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Gladinet CentreStack was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059",
+      "T1505.003"
+    ],
+    "rwep_score": 70,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.92727,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-30406",
+    "cwe_refs": [
+      "CWE-321",
+      "CWE-798"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-30406"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-30406",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-04-08"
+      },
+      {
+        "vendor": "Gladinet",
+        "advisory_id": null,
+        "url": "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf",
+        "severity": "critical",
+        "published_date": "2025-04-03"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Not AI-discovered. Found during active in-the-wild exploitation by the Huntress SOC: on 2025-04-11 an internal Huntress 0-day detector alerted on the exploitation, and Huntress threat researchers (human team) then analyzed the root cause (hard-coded ASP.NET machineKey enabling ViewState deserialization). No named AI tool/agent is credited with discovery in any primary source. Vendor (Gladinet) advisory and NVD note exploitation in the wild since March 2025. Source: https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild CISA KEV-listed 2025-04-08 (due 2025-04-29). Curated 2026-06-28 from the NVD record and the Gladinet advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "IIS worker process w3wp.exe spawning child processes (powershell.exe / cmd.exe) under the IISAPPPOOL\\portaluser (portal app-pool) identity",
+        "ViewState integrity/deserialization failures logged as Windows Application Event Log Event ID 1316 ('The viewstate supplied failed integrity check') on the CentreStack/Triofox portal host",
+        "Outbound out-of-band callbacks from the web server to interactsh/Burp Collaborator-style domains (e.g. *.oastify.com) via PowerShell Invoke-WebRequest connectivity tests",
+        "Post-exploitation artifacts: DLL sideloading of d3d11.dll (Cobalt Strike) next to a renamed binary, and installation of MeshCentral agent for persistent remote access"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-30406, CISA KEV (added 2025-04-08), and the Gladinet advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the hard-coded machineKey enabling ViewState deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-24813": {
+    "name": "Apache Tomcat Path Equivalence Vulnerability",
+    "type": "Deserialization",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-04-01",
+    "cisa_kev_due_date": "2025-04-22",
+    "poc_available": true,
+    "poc_description": "Public PoC/exploit available. Public PoC (GitHub iSee857, published 2025-03-13; later mirrored by multiple repos) sends a base64-encoded ysoserial deserialization gadget as the body of a partial PUT to the write-enabled default servlet, staging it into Tomcat's default file-based session store, then issues a GET with a crafted JSESSIONID to trigger deserialization and command execution.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Not AI-discovered. The Apache Tomcat security advisory (oss-security 2025-03-10 / tomcat.apache.org security pages) credits the finders as \"COSCO Shipping Lines DIC\" and GitHub user \"sw0rd1ight\" — human researchers / an organizational security team, not an AI system. No named AI tool/agent is credited with discovery in any primary source. Advisory: https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq ; mirror: http://www.openwall.com/lists/oss-security/2025/03/10/5",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted weaponization. The public PoC (GitHub iSee857, published 2025-03-13) and the in-the-wild exploitation first observed 2025-03-12 (Wallarm, detected in Poland) are attributed to conventional human researchers/operators. Wallarm and Zscaler ThreatLabz reporting describes manually crafted partial-PUT exploit chains with no AI tooling named.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (CISA added 2025-04-01, due 2025-04-22). No public threat-actor or ransomware-group attribution (CISA known_ransomware: Unknown). First in-the-wild exploitation attempt observed 2025-03-12 by Wallarm (detected in Poland), only ~2 days after the 2025-03-10 disclosure and before any public PoC existed; opportunistic mass-scanning/exploitation followed the 2025-03-13 public PoC (GitHub iSee857). Reported by Zscaler ThreatLabz, Wallarm, SonicWall, and Akamai as broadly exploited against internet-facing Tomcat.",
+    "affected": "Apache Tomcat — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Apache Tomcat 11.0.0-M1 through 11.0.2 (fixed in 11.0.3)",
+      "Apache Tomcat 10.1.0-M1 through 10.1.34 (fixed in 10.1.35)",
+      "Apache Tomcat 9.0.0.M1 through 9.0.98 (fixed in 9.0.99)",
+      "Apache Tomcat 8.5.0 through 8.5.100 (EOL at CVE creation; known affected)",
+      "Older EOL versions may also be affected"
+    ],
+    "vector": "An unauthenticated remote attacker reaches Tomcat's default servlet when write support is enabled (off by default) and partial PUT is supported (on by default). The original partial-PUT implementation wrote the request body to a temporary file whose name was derived from the user-supplied path with the path separator replaced by a dot (\"internal dot\" path equivalence, CWE-706/CWE-44), letting an attacker place attacker-controlled bytes at a predictable filesystem location outside the intended upload target. If the application uses Tomcat's file-based session persistence at the default storage location and ships a deserialization-exploitable library on the classpath, the attacker stages a malicious serialized session object via partial PUT, then forces Tomcat to deserialize it with a crafted JSESSIONID request (CWE-502), achieving remote code execution; absent the deserialization preconditions the same primitive yields read/inject of security-sensitive uploaded files (information disclosure / content tampering).",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed path-equivalence partial-PUT deserialization RCE on Apache Tomcat; CISA set a 2025-04-22 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited path-equivalence partial-PUT deserialization RCE the timescale must collapse to the CISA due date (2025-04-22) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this path-equivalence partial-PUT deserialization RCE until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited path-equivalence partial-PUT deserialization RCE demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Apache Tomcat was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059",
+      "T1505.003"
+    ],
+    "rwep_score": 76,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.99945,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24813",
+    "cwe_refs": [
+      "CWE-44",
+      "CWE-502",
+      "CWE-706"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-24813"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-24813",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-04-01"
+      },
+      {
+        "vendor": "Apache",
+        "advisory_id": null,
+        "url": "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq",
+        "severity": "critical",
+        "published_date": "2025-03-10"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Not AI-discovered. The Apache Tomcat security advisory (oss-security 2025-03-10 / tomcat.apache.org security pages) credits the finders as \"COSCO Shipping Lines DIC\" and GitHub user \"sw0rd1ight\" — human researchers / an organizational security team, not an AI system. No named AI tool/agent is credited with discovery in any primary source. Advisory: https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq ; mirror: http://www.openwall.com/lists/oss-security/2025/03/10/5 CISA KEV-listed 2025-04-01 (due 2025-04-22). Curated 2026-06-28 from the NVD record and the Apache advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Partial PUT requests carrying a Content-Range header to the default servlet, with a target filename whose path separators are encoded such that Tomcat maps them through internal-dot path equivalence (e.g. a request body written to a temp file named like 'foo.session' that collides with the file-based session store path)",
+        "Unexpected files appearing under Tomcat's file-based session persistence directory (default CATALINA_BASE/work/...) followed by a GET/JSESSIONID request that triggers deserialization of the attacker-staged object",
+        "Web-server access logs showing PUT then GET sequences to the same upload sub-directory from a single source IP, with the GET referencing a JSESSIONID cookie crafted to load the staged session file",
+        "Tomcat process spawning unexpected child processes (java -> cmd/sh, or arbitrary command execution) immediately after a partial-PUT upload, consistent with gadget-chain deserialization RCE"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-24813, CISA KEV (added 2025-04-01), and the Apache advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the path-equivalence partial-PUT deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2024-20439": {
+    "name": "Cisco Smart Licensing Utility Static Credential Vulnerability",
+    "type": "Auth-Bypass",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-31",
+    "cisa_kev_due_date": "2025-04-21",
+    "poc_available": true,
+    "poc_description": "Public PoC/exploit available. Send an HTTP request to the CSLU API (e.g. GET http://target:8182/cslu/v1/scheduler/jobs) with HTTP Basic auth using the hardcoded credentials cslu-windows-client:Library4C$LU to gain administrative API access; credential publicly disclosed by Nicholas Starke (Sept 2024).",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Not AI-discovered. The Cisco advisory (cisco-sa-cslu-7gHMzWmw) explicitly credits a named human: \"These vulnerabilities were found by Eric Vance of Cisco during internal security testing.\" No AI tool/agent is credited in any primary source. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No evidence of AI-assisted exploit development. The static backdoor credential (cslu-windows-client:Library4C$LU) was recovered and published by human researcher Nicholas Starke via manual reverse engineering shortly after the September 2024 advisory; in-the-wild exploitation followed that public disclosure. No primary source attributes weaponization to any named AI system. Sources: https://isc.sans.edu/diary/31782 ; https://www.helpnetsecurity.com/2025/04/03/attackers-are-leveraging-cisco-smart-licensing-utility-static-admin-credentials-cve-2024-20439/",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (added 2025-03-31). Cisco PSIRT became aware of attempted exploitation in the wild in March 2025; exploitation followed Nicholas Starke's September 2024 blog publishing the static credential. Johannes Ullrich / SANS ISC observed mass exploit attempts hitting the /cslu/v1 API with the hardcoded Basic-auth credentials, often chained with CVE-2024-20440 (info-disclosure log read). No specific named ransomware group or APT publicly attributed; KEV \"known_ransomware\" = Unknown.",
+    "affected": "Cisco Smart Licensing Utility — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Cisco Smart Licensing Utility (CSLU) 2.0.0",
+      "Cisco Smart Licensing Utility (CSLU) 2.1.0",
+      "Cisco Smart Licensing Utility (CSLU) 2.2.0",
+      "Fixed in 2.3.0 (and later); CSLU 1.0.0-cli and earlier not affected"
+    ],
+    "vector": "Cisco Smart Licensing Utility ships an undocumented static administrative account (CWE-798 / CWE-912) whose credentials (cslu-windows-client:Library4C$LU) are hardcoded in the binary. When the CSLU service is running, its REST API listens on TCP/8182, so an unauthenticated, remote attacker who reaches the host over the network can present the static Basic-auth credentials to authenticate as administrator with no prior access. That yields full administrative control over the CSLU application API, which an attacker chains with CVE-2024-20440 (an excessive-verbosity log endpoint) to harvest further credentials and tokens. Because CSLU only listens while actively invoked, exposure is intermittent, but any reachable, running 2.0.0–2.2.0 instance is trivially compromisable.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed undocumented static administrative credential on Cisco Smart Licensing Utility; CISA set a 2025-04-21 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited undocumented static administrative credential the timescale must collapse to the CISA due date (2025-04-21) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this undocumented static administrative credential until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited undocumented static administrative credential demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Cisco Smart Licensing Utility was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1078"
+    ],
+    "rwep_score": 70,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.9201,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-20439",
+    "cwe_refs": [
+      "CWE-798",
+      "CWE-912"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-20439"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-20439",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-03-31"
+      },
+      {
+        "vendor": "Cisco",
+        "advisory_id": null,
+        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw",
+        "severity": "critical",
+        "published_date": "2024-09-04"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Not AI-discovered. The Cisco advisory (cisco-sa-cslu-7gHMzWmw) explicitly credits a named human: \"These vulnerabilities were found by Eric Vance of Cisco during internal security testing.\" No AI tool/agent is credited in any primary source. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw CISA KEV-listed 2025-03-31 (due 2025-04-21). Curated 2026-06-28 from the NVD record and the Cisco advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Inbound HTTP requests to the CSLU API (default TCP/8182) carrying Basic auth that base64-decodes to cslu-windows-client:Library4C$LU, e.g. GET /cslu/v1/scheduler/jobs",
+        "Successful unauthenticated administrative API logins to CSLU originating from external/untrusted source IPs",
+        "CSLU process (running on Windows hosts) reached over the network despite being intended as a local-only utility — unexpected network exposure of port 8182",
+        "Reconnaissance probes from the same source IPs for /web.config.zip and other embedded-credential endpoints, often paired with CVE-2024-20440 log-disclosure requests"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2024-20439, CISA KEV (added 2025-03-31), and the Cisco advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the undocumented static administrative credential, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-2783": {
+    "name": "Google Chromium Mojo Sandbox Escape Vulnerability",
+    "type": "Sandbox-Escape",
+    "cvss_score": 8.3,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-27",
+    "cisa_kev_due_date": "2025-04-17",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public weaponized PoC; the only known working exploit is the private ForumTroll/Memento Labs zero-day chain. Public technical write-ups (Kaspersky/Securelist, elasticninja, SecureLayer7) describe the root cause — an unvalidated sentinel handle (-2 pseudo-handle) mishandled during Mojo broker-side handle duplication — enabling the sandbox escape when paired with a renderer RCE.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Discovered by human researchers at Kaspersky's Global Research & Analysis Team (GReAT) — Boris Larin and Igor Kuznetsov — who detected the in-the-wild exploit chain during \"Operation ForumTroll\" and reported it to Google on 2025-03-20. No AI tool/agent is credited with discovery in any primary source; Kaspersky attributes detection to its own telemetry/technologies. Sources: https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/ and https://www.kaspersky.com/about/press-releases/kaspersky-discovers-sophisticated-chrome-zero-day-exploit-used-in-active-attacks",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization. The exploit was attributed to the ForumTroll APT / Memento Labs (ex-Hacking Team) spyware tooling (Dante), with no mention of any named AI system in the build chain.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited in the wild as a zero-day since March 2025 in \"Operation ForumTroll\" by the ForumTroll APT (tracked by Kaspersky as Mem3nt0 mori), delivering the Dante commercial spyware developed by Memento Labs (formerly Hacking Team). Delivery was no-click spear-phishing with short-lived personalized links (Primakov Readings forum lure) targeting Russian media, government, education and diplomatic entities. A second actor, TaxOff, was separately reported exploiting it to deploy the Trinper backdoor. Reported to Google 2025-03-20; KEV-listed 2025-03-27.",
+    "affected": "Google Chromium Mojo — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Google Chrome on Windows prior to 134.0.6998.177",
+      "Chromium-based browsers using the affected Mojo IPC (e.g. Microsoft Edge, Opera) on Windows prior to their corresponding 134.0.6998.177-equivalent fix"
+    ],
+    "vector": "A victim using Chrome/Chromium on Windows visits an attacker-controlled page (delivered via spear-phishing), giving the compromised renderer a reachable path to the Mojo IPC layer. A logic error causes an incorrect/sentinel OS handle (the -2 pseudo-handle) to be supplied and used without validation when the broker process duplicates handles across the renderer-to-broker boundary, yielding a sandbox escape primitive that lets renderer-controlled data operate on a privileged broker-side handle. Combined with a renderer-side code-execution bug, this escalates the constrained, sandboxed renderer to arbitrary code execution in the medium-integrity browser/broker context, from which the ForumTroll operators staged the Dante spyware loader — all with no user interaction beyond opening the link.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed Mojo IPC sandbox escape via an incorrectly-provided handle on Google Chromium Mojo; CISA set a 2025-04-17 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited Mojo IPC sandbox escape via an incorrectly-provided handle the timescale must collapse to the CISA due date (2025-04-17) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this Mojo IPC sandbox escape via an incorrectly-provided handle until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited Mojo IPC sandbox escape via an incorrectly-provided handle demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Google Chromium Mojo was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1203",
+      "T1211"
+    ],
+    "rwep_score": 56,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.08404,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-2783",
+    "cwe_refs": [
+      "CWE-501"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-2783"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-2783",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-27"
+      },
+      {
+        "vendor": "Google",
+        "advisory_id": null,
+        "url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html",
+        "severity": "high",
+        "published_date": "2025-03-26"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Discovered by human researchers at Kaspersky's Global Research & Analysis Team (GReAT) — Boris Larin and Igor Kuznetsov — who detected the in-the-wild exploit chain during \"Operation ForumTroll\" and reported it to Google on 2025-03-20. No AI tool/agent is credited with discovery in any primary source; Kaspersky attributes detection to its own telemetry/technologies. Sources: https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/ and https://www.kaspersky.com/about/press-releases/kaspersky-discovers-sophisticated-chrome-zero-day-exploit-used-in-active-attacks CISA KEV-listed 2025-03-27 (due 2025-04-17). Curated 2026-06-28 from the NVD record and the Google advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "chrome.exe spawning an unexpected non-renderer child process (e.g. a shellcode loader / cmd.exe / rundll32.exe) immediately after a browsing session, indicating a renderer-to-broker sandbox escape",
+        "Chrome navigation to a short-lived, one-time-use phishing URL followed within seconds by a new persistence artifact or malware loader on disk (Operation ForumTroll lure domains)",
+        "Outbound C2 beaconing from the host shortly after Chrome rendered an attacker page, with no corresponding user-initiated download",
+        "Mojo IPC anomalies / unexpected broker-process handle duplication preceding privileged process creation under the browser process tree"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-2783, CISA KEV (added 2025-03-27), and the Google advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS retained; CWE assigned editorially (NVD lists none for this entry), ATT&CK + IOCs derived from the Mojo IPC sandbox escape via an incorrectly-provided handle, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2019-9875": {
+    "name": "Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability (post-authentication)",
+    "type": "Deserialization",
+    "cvss_score": 8.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-26",
+    "cisa_kev_due_date": "2025-04-16",
+    "poc_available": true,
+    "poc_description": "Public PoC/exploit available. Public PoC in the Synacktiv advisory: generate a payload with ysoserial.net (-g TypeConfuseDelegate -f ObjectStateFormatter) wrapping a PowerShell downloader, then POST it as __CSRFTOKEN with a dummy __CSRFCOOKIE to CreateNewUser.aspx — code executes on deserialize despite the CSRF check failing.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Discovered by human researchers at Synacktiv (Julien Legras and Adrien Peter) during a customer security assessment; vulnerability identified 2019-02-19 per the advisory timeline. No AI tool or agent is credited anywhere in the primary source. Source: https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "The public PoC was hand-built by Synacktiv using the open-source ysoserial.net gadget generator (TypeConfuseDelegate / ObjectStateFormatter formatter). No AI system is credited with weaponization in any primary or secondary source.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (CISA added 2019-9874 and 2019-9875 together on 2025-03-26, due 2025-04-16); no public threat-actor attribution. Notably the vendor (Sitecore) and reporting confirm active exploitation specifically of the UNAUTHENTICATED sibling CVE-2019-9874; CVE-2019-9875 (the authenticated variant) was KEV-listed alongside it but has no separately documented in-the-wild campaign or actor.",
+    "affected": "Sitecore CMS and Experience Platform (XP) — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Sitecore Experience Platform (XP) 9.x prior to 9.1.1 (9.1 Update-1) — authenticated exploitation (this CVE)",
+      "NVD scope: Sitecore through 9.1 (anti-CSRF module, authenticated)",
+      "Remediation per vendor/Tenable: upgrade to 9.1.1 (9.1 Update-1) or apply hotfix SC Hotfix 313001-1 Security.AntiCsrf 1.0.0 (KB0038556); note 8.x and CMS 6.6.3–8.2.x are the unauthenticated CVE-2019-9874 scope"
+    ],
+    "vector": "The Sitecore.Security.AntiCsrf module deserializes the attacker-supplied __CSRFTOKEN HTTP POST parameter via ASP.NET's ObjectStateFormatter BEFORE comparing it to the __CSRFCOOKIE value, and because the formatter is instantiated with a null _page it performs no MAC/signature validation on the LOSFormatter stream. An attacker who can reach a guarded Sitecore endpoint (e.g. CreateNewUser.aspx) supplies a ysoserial.net TypeConfuseDelegate gadget encoded for the ObjectStateFormatter, which executes during deserialization regardless of the subsequent cookie-mismatch error. For the 9.x branch this CVE requires a valid authenticated session (PR:L); code runs in-process as the IIS app-pool identity, after which the gadget's PowerShell stager pulls a second stage and opens a reverse shell, giving arbitrary command execution on the web server and access to the underlying filesystem.",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level, local/physical access, or non-default config), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed post-authentication deserialization RCE on Sitecore CMS and Experience Platform (XP); CISA set a 2025-04-16 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited post-authentication deserialization RCE the timescale must collapse to the CISA due date (2025-04-16) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this post-authentication deserialization RCE until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited post-authentication deserialization RCE demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Sitecore CMS and Experience Platform (XP) was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 68,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.142,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-9875",
+    "cwe_refs": [
+      "CWE-502"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556",
+      "https://nvd.nist.gov/vuln/detail/CVE-2019-9875"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2019-9875",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-26"
+      },
+      {
+        "vendor": "Sitecore",
+        "advisory_id": null,
+        "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556",
+        "severity": "high",
+        "published_date": "2019-05-31"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Discovered by human researchers at Synacktiv (Julien Legras and Adrien Peter) during a customer security assessment; vulnerability identified 2019-02-19 per the advisory timeline. No AI tool or agent is credited anywhere in the primary source. Source: https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf CISA KEV-listed 2025-03-26 (due 2025-04-16). Curated 2026-06-28 from the NVD record and the Sitecore advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "HTTP POST to /sitecore/shell/Applications/Security/CreateNewUser/CreateNewUser.aspx (or any Sitecore page guarded by the AntiCSRF module) carrying a large base64 __CSRFTOKEN form value plus a __CSRFCOOKIE cookie",
+        "IIS application-pool worker process (w3wp.exe running as iis apppool\\<site>) spawning powershell.exe / cmd.exe child processes — a CMS web tier should not be launching shells",
+        "Outbound HTTP from the web server to an unfamiliar host immediately after a CSRF-token POST (second-stage downloader, e.g. GET /reverse.ps1) followed by a reverse-shell TCP connection",
+        "PotentialCsrfException 'The CSRF cookie value did not match the CSRF parameter value' entries in Sitecore/ASP.NET logs co-occurring with command execution — the deserialize/exec fires before the mismatch comparison fails"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2019-9875, CISA KEV (added 2025-03-26), and the Sitecore advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the post-authentication deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2019-9874": {
+    "name": "Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability (unauthenticated)",
+    "type": "Deserialization",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-26",
+    "cisa_kev_due_date": "2025-04-16",
+    "poc_available": true,
+    "poc_description": "Public PoC/exploit available. Send an HTTP POST to an AntiCSRF-protected Sitecore page with a malicious serialized .NET gadget chain in the __CSRFTOKEN parameter; insecure BinaryFormatter deserialization executes the gadget, achieving unauthenticated RCE on Sitecore CMS 7.x / XP 8.x (public PoC by Synacktiv).",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Discovered by human consultants at Synacktiv during manual security testing of a Sitecore instance, who noticed that a POST to CreateNewUser.aspx triggered a CSRF protection error and traced the __CSRFTOKEN parameter to an unsafe .NET BinaryFormatter deserialization. Published in Synacktiv security advisory 2019-04-16 (\"Unsafe Object Deserialization in Sitecore <= 9.1.0\"). No AI tool, fuzzer, or AI agent is credited with discovery in any primary source. Source: https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No source indicates AI/LLM assistance in building the exploit. Weaponization is a standard .NET deserialization gadget chain (ysoserial.net-style) injected via the __CSRFTOKEN POST parameter; Synacktiv published a manually written proof-of-concept. No AI tooling credited.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (CISA KEV 2025-03-26); no public actor attribution. CISA KEV lists known_ransomware as \"Unknown\". Sitecore stated it became aware of active exploitation in an advisory update dated 2020-03-30; CISA's KEV addition in March 2025 cites evidence of active exploitation but names no threat actor, ransomware group, or campaign. Synacktiv published a public PoC.",
+    "affected": "Sitecore CMS and Experience Platform (XP) — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Sitecore CMS 7.0 through 7.2",
+      "Sitecore XP (Experience Platform) 7.5 through 8.2",
+      "Per Synacktiv advisory: Sitecore <= 9.1.0 affected; 8.x exploitable unauthenticated, 9.x < 9.1.1 require authentication. Fixed in Sitecore XP 9.1.1 / vendor hotfix per KB0334035."
+    ],
+    "vector": "The Sitecore.Security.AntiCSRF module accepts the value of the HTTP POST parameter __CSRFTOKEN and deserializes it with .NET BinaryFormatter without type restriction, reachable over the network on any AntiCSRF-protected page. On affected 8.x and earlier builds the deserialization occurs before authentication is enforced, so an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N) can submit a crafted serialized object. Supplying a known deserialization gadget chain turns this primitive into arbitrary command execution in the context of the IIS application pool identity hosting Sitecore, yielding full server compromise without needing a separate privilege-escalation step.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed unauthenticated deserialization RCE on Sitecore CMS and Experience Platform (XP); CISA set a 2025-04-16 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited unauthenticated deserialization RCE the timescale must collapse to the CISA due date (2025-04-16) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this unauthenticated deserialization RCE until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited unauthenticated deserialization RCE demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Sitecore CMS and Experience Platform (XP) was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 68,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=18 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.83857,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-9874",
+    "cwe_refs": [
+      "CWE-502"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035",
+      "https://nvd.nist.gov/vuln/detail/CVE-2019-9874"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2019-9874",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-03-26"
+      },
+      {
+        "vendor": "Sitecore",
+        "advisory_id": null,
+        "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035",
+        "severity": "critical",
+        "published_date": "2019-05-31"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Discovered by human consultants at Synacktiv during manual security testing of a Sitecore instance, who noticed that a POST to CreateNewUser.aspx triggered a CSRF protection error and traced the __CSRFTOKEN parameter to an unsafe .NET BinaryFormatter deserialization. Published in Synacktiv security advisory 2019-04-16 (\"Unsafe Object Deserialization in Sitecore <= 9.1.0\"). No AI tool, fuzzer, or AI agent is credited with discovery in any primary source. Source: https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf CISA KEV-listed 2025-03-26 (due 2025-04-16). Curated 2026-06-28 from the NVD record and the Sitecore advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "HTTP POST requests carrying a base64/serialized .NET object in the __CSRFTOKEN parameter to Sitecore endpoints (e.g. /sitecore/admin or CreateNewUser.aspx) instead of a normal short CSRF token value",
+        "w3wp.exe (IIS worker process hosting the Sitecore .NET app) spawning child processes such as cmd.exe, powershell.exe, or whoami immediately after a request to an AntiCSRF-protected page",
+        "Outbound connections or file writes (web shell drops) under the Sitecore app pool identity following a POST with an oversized/serialized __CSRFTOKEN",
+        "Exceptions / errors in Sitecore logs referencing BinaryFormatter or AntiCSRF deserialization failures from malformed __CSRFTOKEN values"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2019-9874, CISA KEV (added 2025-03-26), and the Sitecore advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2017-12637": {
+    "name": "SAP NetWeaver Directory Traversal Vulnerability",
+    "type": "Path-Traversal",
+    "cvss_score": 7.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-19",
+    "cisa_kev_due_date": "2025-04-09",
+    "poc_available": true,
+    "poc_description": "Public PoC/exploit available. Send an unauthenticated HTTP request to /scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS with a `..`-based traversal in the query string to read arbitrary files (public PoC scanners confirm /etc/passwd disclosure).",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Not AI-discovered. The 2017 disclosure was published by a human security researcher on a personal blog (sh0w.top, archived at https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/) and addressed by SAP Security Note 2486657. The 2025 KEV listing stems from active-exploitation telemetry identified by Onapsis Research Labs via its SAP Threat Intelligence Network (https://onapsis.com/blog/active-exploitation-cve-2017-12637-sap/), which briefed SAP and CISA. No named AI tool or AI agent is credited with discovery in any primary source.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No source credits AI-assisted exploit development. Public PoCs (e.g. abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal on GitHub) are hand-written directory-traversal scanners; exploitation uses a simple `..` query-string payload plus publicly available SAP Secure Store credential-decryption tools, with no AI tooling described.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (added 2025-03-19, due 2025-04-09). Per NVD, originally exploited in the wild in August 2017 (SAP Security Note 2486657). Onapsis Research Labs reported renewed active exploitation in 2025 via its global SAP Threat Intelligence Network; attackers demonstrate deep SAP knowledge, exfiltrating SAP system files (including the SAP Secure Store binary) to decrypt stored credentials and pivot into full SAP-application compromise. No public named threat-actor/ransomware/campaign attribution.",
+    "affected": "SAP NetWeaver — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "SAP NetWeaver Application Server (AS) Java 7.5",
+      "Component ENGINEAPI 7.50 SP02 through SP05",
+      "SAP Central Process Scheduling (CPS) by Redwood 8.0 (and all versions per SAP Note 3476549)",
+      "Older/earlier NetWeaver AS Java releases may also be affected; systems can remain exposed even above the original 2486657 patch level (re-addressed by SAP Note 3476549)"
+    ],
+    "vector": "The vulnerable scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS handler in SAP NetWeaver AS Java 7.5 is reachable pre-authentication over HTTP and fails to normalize `..` sequences in its query string. An unauthenticated remote attacker supplies dot-dot traversal to read arbitrary files outside the intended web directory (the primitive: arbitrary file read, CWE-22). Escalation comes from targeting SAP-specific files — chiefly the SAP Secure Store — and decrypting the recovered credentials with publicly available tooling, after which the attacker logs in to SAP applications and pivots to full compromise of the SAP environment despite the flaw itself yielding only confidentiality impact.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed directory-traversal arbitrary file disclosure on SAP NetWeaver; CISA set a 2025-04-09 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited directory-traversal arbitrary file disclosure the timescale must collapse to the CISA due date (2025-04-09) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this directory-traversal arbitrary file disclosure until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited directory-traversal arbitrary file disclosure demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — SAP NetWeaver was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1083"
+    ],
+    "rwep_score": 70,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.94557,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2017-12637",
+    "cwe_refs": [
+      "CWE-22"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://me.sap.com/notes/3476549",
+      "https://nvd.nist.gov/vuln/detail/CVE-2017-12637"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2017-12637",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-19"
+      },
+      {
+        "vendor": "SAP",
+        "advisory_id": null,
+        "url": "https://me.sap.com/notes/3476549",
+        "severity": "high",
+        "published_date": "2017-08-07"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Not AI-discovered. The 2017 disclosure was published by a human security researcher on a personal blog (sh0w.top, archived at https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/) and addressed by SAP Security Note 2486657. The 2025 KEV listing stems from active-exploitation telemetry identified by Onapsis Research Labs via its SAP Threat Intelligence Network (https://onapsis.com/blog/active-exploitation-cve-2017-12637-sap/), which briefed SAP and CISA. No named AI tool or AI agent is credited with discovery in any primary source. CISA KEV-listed 2025-03-19 (due 2025-04-09). Curated 2026-06-28 from the NVD record and the SAP advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "HTTP GET requests to /scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS containing directory-traversal sequences (../ or encoded dot-dot) in the query string",
+        "Unauthenticated reads of OS-level files (e.g. /etc/passwd, SAP profile/config files) returned via the scheduler UI endpoint",
+        "Retrieval of the SAP Secure Store binary file (SecStore.properties / key files) from the AS Java filesystem, followed by offline credential decryption",
+        "Subsequent authenticated SAP logins using credentials extracted from the Secure Store, originating from the same external source IPs that performed the traversal probing"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2017-12637, CISA KEV (added 2025-03-19), and the SAP advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the directory-traversal arbitrary file disclosure, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2024-48248": {
+    "name": "NAKIVO Backup and Replication Absolute Path Traversal Vulnerability",
+    "type": "Path-Traversal",
+    "cvss_score": 8.6,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-19",
+    "cisa_kev_due_date": "2025-04-09",
+    "poc_available": true,
+    "poc_description": "Public PoC/exploit available. Unauthenticated POST to /c/router with {\"action\":\"STPreLoadManagement\",\"method\":\"getImageByPath\",\"data\":[\"<absolute-path>\"]} returns the target file's bytes; watchTowr published a working file-read PoC on GitHub.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Discovered by human researchers at watchTowr Labs (author credited as \"Sonny\") via manual reverse-engineering/decompilation of the NAKIVO Director Java code (the STPreLoadFacade.getImageByPath path-handling). No AI system is credited in any primary source. Source: https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "watchTowr's public PoC (https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/) was hand-built from decompiled-Java analysis of the /c/router dispatcher and STPreLoadManagement action; no AI tool/agent is credited with building or accelerating the exploit in any primary source.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (CISA added 2025-03-19, due 2025-04-09). Exploitation is opportunistic/mass and unattributed at the time of KEV listing — no named threat actor, ransomware group, or campaign tied to it in public reporting; security press (Help Net Security, BleepingComputer) noted exploitation against unpatched internet-facing instances after watchTowr's 2025-02-26 public disclosure + PoC release, with no confirmed ransomware attribution.",
+    "affected": "NAKIVO Backup and Replication — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "NAKIVO Backup & Replication before 11.0.0.88174 (all versions prior, including 10.11.3.86570 and earlier)",
+      "Fixed in 11.0.0.88174 (silently patched 2024-11-04)"
+    ],
+    "vector": "The NAKIVO Director web service exposes an unauthenticated /c/router dispatcher; the STPreLoadFacade.getImageByPath handler takes an attacker-controlled path, naively rewrites the leading \"/c\" to \"userdata\" and passes the result straight to a File read, so an absolute path such as C:/windows/win.ini or /etc/passwd escapes the intended directory and yields arbitrary file read (CWE-36, no auth, network-reachable). The primitive is escalated by reading NAKIVO's own configuration: the encryption key in config.properties plus the bundled H2 database let an attacker decrypt the PhysicalDiscovery feature's stored cleartext credentials for the systems being backed up. Because a backup product holds privileged credentials across the estate, this file-read pivots into broad credential theft and remote code execution on integrated hypervisors/hosts, which is why the CVSS scope is Changed (8.6). Patched releases replace the path handling with FilenameUtils.getName(), stripping any directory component before the read.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed unauthenticated absolute-path arbitrary file read on NAKIVO Backup and Replication; CISA set a 2025-04-09 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited unauthenticated absolute-path arbitrary file read the timescale must collapse to the CISA due date (2025-04-09) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this unauthenticated absolute-path arbitrary file read until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited unauthenticated absolute-path arbitrary file read demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — NAKIVO Backup and Replication was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1083",
+      "T1552.001"
+    ],
+    "rwep_score": 70,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.93995,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-48248",
+    "cwe_refs": [
+      "CWE-36"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://helpcenter.nakivo.com/Knowledge-Base/Content/Security-Advisory/CVE-2024-48248.htm",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-48248"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-48248",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-19"
+      },
+      {
+        "vendor": "NAKIVO",
+        "advisory_id": null,
+        "url": "https://helpcenter.nakivo.com/Knowledge-Base/Content/Security-Advisory/CVE-2024-48248.htm",
+        "severity": "high",
+        "published_date": "2025-03-04"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Discovered by human researchers at watchTowr Labs (author credited as \"Sonny\") via manual reverse-engineering/decompilation of the NAKIVO Director Java code (the STPreLoadFacade.getImageByPath path-handling). No AI system is credited in any primary source. Source: https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/ CISA KEV-listed 2025-03-19 (due 2025-04-09). Curated 2026-06-28 from the NVD record and the NAKIVO advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Unauthenticated HTTP POST to the /c/router endpoint with a JSON body invoking action STPreLoadManagement / method getImageByPath, e.g. data [\"C:/windows/win.ini\"] or [\"/etc/passwd\"]",
+        "Director process (Java/Tomcat) reading files outside its userdata/ web root — absolute paths or config files like config.properties accessed via FileUtils.readFileToByteArray",
+        "Read access to the embedded H2 database / config.properties retrieving the encryption key, followed by decryption of stored PhysicalDiscovery cleartext credentials",
+        "Subsequent lateral authentication into backup-integrated hosts (hypervisors, NAS, cloud accounts) using credentials harvested from the NAKIVO config store"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2024-48248, CISA KEV (added 2025-03-19), and the NAKIVO advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated absolute-path arbitrary file read, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-1316": {
+    "name": "Edimax IC-7100 IP Camera OS Command Injection Vulnerability",
+    "type": "Command-Injection",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-19",
+    "cisa_kev_due_date": "2025-04-09",
+    "poc_available": true,
+    "poc_description": "Public PoC/exploit available. Authenticated (default-credential) HTTP request to /camera-cgi/admin/param.cgi injecting a shell command into the NTP_serverName parameter of ipcamSource, e.g. setting it to a value containing backticked/embedded commands that fetch and execute curl.sh from attacker infrastructure; public PoC has existed since June 2023.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Not AI-discovered. The vulnerability was surfaced through human-led honeypot/telemetry analysis by Akamai's Security Intelligence and Response Team (SIRT), which observed in-the-wild exploitation attempts and traced a public proof-of-concept dating to June 2023; CISA published it as ICS advisory ICSA-25-063-08 via coordinated disclosure. No named AI tool, agent, or automated fuzzer is credited with discovery in any primary source. Sources: https://www.akamai.com/blog/security-research/march-edimax-cameras-command-injection-mirai , https://thehackernews.com/2025/03/unpatched-edimax-camera-flaw-exploited.html",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No evidence of AI-assisted exploit development. Weaponization is conventional commodity-botnet tooling: Mirai-variant droppers injected via a CGI parameter, fetching multi-architecture (x86/ARM/MIPS) ELF payloads through curl/wget shell scripts. No primary source attributes the exploit or loader to an AI system.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (CISA added 2025-03-19). Exploited in the wild by at least two Mirai-variant botnets: a strain Akamai labels \"Unstable Mirai\" beaconing to angela.spklove.com:3093 (string \"VagneRHere\"), and a second anti-debugging variant (\"Hello, World!\") using merisprivate.net / ziparchive.xyz C2 infrastructure. Akamai SIRT honeypots logged earliest activity in May 2024 (some reporting cites October 2024 campaign detection), with a public PoC available since June 2023. No nation-state actor attributed; activity is financially/DDoS-motivated commodity botnet operators. No known ransomware association.",
+    "affected": "Edimax IC-7100 IP Camera — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Edimax IC-7100 IP camera — all firmware versions (no fixed version exists; product is end-of-life / end-of-service and will not receive a security patch)"
+    ],
+    "vector": "The Edimax IC-7100's web management interface exposes the /camera-cgi/admin/param.cgi endpoint, which fails to neutralize OS shell metacharacters in the NTP_serverName field of the ipcamSource option. An attacker who reaches the endpoint (commonly via unchanged default credentials admin:1234, often on internet-exposed cameras) injects a shell command string that the device executes as the CGI's privileged context, yielding remote code execution. In observed campaigns the injected command downloads a curl.sh/wget.sh stager that pulls architecture-matched Mirai ELF payloads into a world-writable directory and runs them, enrolling the camera into a DDoS botnet. Because the device is end-of-life with no patch, the only durable remediation is network isolation or hardware replacement.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": false,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed unauthenticated OS command injection on Edimax IC-7100 IP Camera; CISA set a 2025-04-09 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited unauthenticated OS command injection the timescale must collapse to the CISA due date (2025-04-09) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this unauthenticated OS command injection until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an attacker-reachable unauthenticated OS command injection in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Edimax IC-7100 IP Camera was exploited before a normal cycle would have reached it.",
+      "IEC-62443-3-3": "62443-3-3 zone-and-conduit segmentation is the compensating control, but an internet-reachable device with a unauthenticated OS command injection bridges the IT and OT zones it is supposed to keep apart.",
+      "NIST-800-82r3": "800-82r3 treats the device as a trusted endpoint inside a segmented cell; compromise via this unauthenticated OS command injection turns it into an OT pivot, which a segmentation-only reading of the guide does not address."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059",
+      "T1499"
+    ],
+    "rwep_score": 85,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": 0,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.7227,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-1316",
+    "cwe_refs": [
+      "CWE-78"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-1316"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-1316",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-03-19"
+      },
+      {
+        "vendor": "Edimax",
+        "advisory_id": null,
+        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08",
+        "severity": "critical",
+        "published_date": "2025-03-05"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Not AI-discovered. The vulnerability was surfaced through human-led honeypot/telemetry analysis by Akamai's Security Intelligence and Response Team (SIRT), which observed in-the-wild exploitation attempts and traced a public proof-of-concept dating to June 2023; CISA published it as ICS advisory ICSA-25-063-08 via coordinated disclosure. No named AI tool, agent, or automated fuzzer is credited with discovery in any primary source. Sources: https://www.akamai.com/blog/security-research/march-edimax-cameras-command-injection-mirai , https://thehackernews.com/2025/03/unpatched-edimax-camera-flaw-exploited.html CISA KEV-listed 2025-03-19 (due 2025-04-09). Curated 2026-06-28 from the NVD record and the Edimax advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "HTTP POST/GET to /camera-cgi/admin/param.cgi with shell metacharacters in the NTP_serverName field of the ipcamSource option (default creds admin:1234 used to reach the endpoint)",
+        "Outbound retrieval and execution of staging scripts (curl.sh / wget.sh) writing multi-architecture ELF binaries into /tmp, /var/ftper, or /var/Sofia",
+        "Beaconing to known Mirai C2 such as angela.spklove.com:3093 (193.143.1.118) or merisprivate.net / ziparchive.xyz / virtuehub.one domains",
+        "Presence of Mirai-variant marker strings in process memory or dropped binaries (\"VagneRHere\", \"Hello, World!\") and outbound TCP/UDP DDoS flood traffic from the camera"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-1316, CISA KEV (added 2025-03-19), and the Edimax advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated OS command injection, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-24472": {
+    "name": "Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability",
+    "type": "Auth-Bypass",
+    "cvss_score": 8.1,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-18",
+    "cisa_kev_due_date": "2025-04-08",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. Unauthenticated super-admin takeover by replaying crafted CSF/Security-Fabric proxy requests over the Node.js websocket alternate channel with known upstream/downstream device serial numbers; public technical analysis exists (watchTowr, Forescout) but no full weaponized exploit script is publicly posted.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Not AI-discovered. The vendor advisory FG-IR-24-535 and reporting credit human researchers: CVE-2025-24472 was reported to Fortinet PSIRT by \"Sonny of watchTowr\" under responsible disclosure, and the in-the-wild exploitation (SuperBlack/Mora_001 campaign) was discovered by Forescout Research (Vedere Labs) human analysts. No named AI system is credited with discovery in any primary source. Sources: https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://www.quorumcyber.com/threat-intelligence/new-ransomware-operator-mora_001-exploits-fortinet-vulnerabilities-with-superblack/",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source attributes AI tooling to exploit development or weaponization. The SuperBlack toolchain (Forescout-attributed) consists of conventional custom scripts, a LockBit 3.0-derived encryptor, and a custom wiper; no AI-assisted exploit-generation is reported.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited in the wild by the financially-motivated ransomware operator tracked as \"Mora_001\" (LockBit-linked; LockBit 3.0 builder leak lineage) deploying the \"SuperBlack\" ransomware (a rebranded/modified LockBit 3.0 strain). Forescout Research observed the campaign between late January and early March 2025, chaining CVE-2025-24472 with the sibling auth-bypass CVE-2024-55591 against internet-exposed FortiGate firewalls. CISA added CVE-2025-24472 to KEV on 2025-03-18 (due 2025-04-08); the KEV record flags known_ransomware = \"Known\".",
+    "affected": "Fortinet FortiOS and FortiProxy — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "FortiOS 7.0.0 through 7.0.16 (fixed in 7.0.17 and above)",
+      "FortiProxy 7.2.0 through 7.2.12 (fixed in 7.2.13 and above)",
+      "FortiProxy 7.0.0 through 7.0.19 (fixed in 7.0.20 and above)"
+    ],
+    "vector": "A remote, unauthenticated attacker who can reach the FortiGate/FortiProxy management plane and who knows the serial numbers of the upstream and downstream Security Fabric (CSF) devices sends crafted CSF proxy requests over an alternate path/channel (the Node.js websocket and CSF request handler). Because authentication is enforced on the primary path but not consistently on this alternate channel (CWE-288, Authentication Bypass Using an Alternate Path or Channel), the request is processed with downstream-device super-admin authority. The bypass yields full super-admin on the downstream device, from which the operator creates persistent admin and SSL-VPN accounts, alters firewall policy, and pivots into the internal network. Reachability requires the Security Fabric to be enabled and the HTTP/HTTPS admin interface (or CSF proxy) to be exposed.",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level, local/physical access, or non-default config), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed authentication bypass via a crafted CSF proxy request on Fortinet FortiOS and FortiProxy; CISA set a 2025-04-08 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited authentication bypass via a crafted CSF proxy request the timescale must collapse to the CISA due date (2025-04-08) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this authentication bypass via a crafted CSF proxy request until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an attacker-reachable authentication bypass via a crafted CSF proxy request in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Fortinet FortiOS and FortiProxy was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-SC-7": "SC-7 boundary protection treats this appliance as the boundary; when the boundary device itself carries a authentication bypass via a crafted CSF proxy request, the control protects nothing in front of it.",
+      "NIST-800-53-AC-6": "AC-6 least-privilege presumes an intact authorization check; this authentication bypass via a crafted CSF proxy request bypasses or escalates past the check, so the carefully-scoped privilege grants behind it are moot."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1078",
+      "T1556"
+    ],
+    "rwep_score": 59,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.02988,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24472",
+    "cwe_refs": [
+      "CWE-288"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://fortiguard.fortinet.com/psirt/FG-IR-24-535",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-24472"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-24472",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-18"
+      },
+      {
+        "vendor": "Fortinet",
+        "advisory_id": null,
+        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535",
+        "severity": "high",
+        "published_date": "2025-02-11"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Not AI-discovered. The vendor advisory FG-IR-24-535 and reporting credit human researchers: CVE-2025-24472 was reported to Fortinet PSIRT by \"Sonny of watchTowr\" under responsible disclosure, and the in-the-wild exploitation (SuperBlack/Mora_001 campaign) was discovered by Forescout Research (Vedere Labs) human analysts. No named AI system is credited with discovery in any primary source. Sources: https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://www.quorumcyber.com/threat-intelligence/new-ransomware-operator-mora_001-exploits-fortinet-vulnerabilities-with-superblack/ CISA KEV-listed 2025-03-18 (due 2025-04-08). Curated 2026-06-28 from the NVD record and the Fortinet advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Creation of new super-admin / local administrator accounts on the FortiGate, frequently named to mimic legitimate services and configured to be auto-recreated if deleted (persistence)",
+        "Creation of new SSL-VPN local user accounts with names resembling existing legitimate users to enable later re-entry and lateral movement",
+        "Anomalous administrative API/config-change activity (firewall policy edits, automation-stitch creation, dashboard reconnaissance) from an unauthenticated source over the CSF/Security-Fabric proxy port",
+        "Inbound crafted requests to the Node.js websocket / jsconsole and CSF proxy management interface from external IPs immediately preceding privileged config changes; later SuperBlack encryptor execution plus a wiper that erases forensic logs"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-24472, CISA KEV (added 2025-03-18), and the Fortinet advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": " Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the authentication bypass via a crafted CSF proxy request, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-21590": {
+    "name": "Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability",
+    "type": "Code-Injection",
+    "cvss_score": 4.4,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-13",
+    "cisa_kev_due_date": "2025-04-03",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. UNC3886 in-the-wild chain (no public exploit PoC): from a root FreeBSD shell, inject base64-decoded loader.bin/pc.bin into a hung cat process via dd to /proc/pid/mem, overwrite the fclose GOT entry, then send EOF so cat runs the loader and loads payload.bin (lmpad backdoor), bypassing Veriexec.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Credited to Mandiant / Google Threat Intelligence Group (GTIG), a human threat-intel team that found UNC3886 exploiting it in the wild on Juniper routers; no named AI tool is credited with discovery. Quote: \"This specific technique is now tracked as CVE-2025-21590, as detailed in Juniper Network's security bulletin JSA93446.\" Source: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development. UNC3886 hand-built the process-injection chain (loader.bin/pc.bin/payload.bin, /proc/pid/mem writes, GOT overwrite of fclose) to bypass Junos Veriexec and load TINYSHELL-based PIC backdoors. No AI tooling is referenced in Mandiant's analysis. Source: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited in the wild by UNC3886, a China-nexus cyber-espionage group targeting defense, technology, and telecom organizations in the US and Asia. Mandiant first observed the activity in mid-2024 (custom backdoors deployed on end-of-life Juniper MX routers). KEV-listed 2025-03-13 with a 2025-04-03 federal remediation due date. No ransomware association (\"Known ransomware: Unknown\").",
+    "affected": "Juniper Junos OS — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Junos OS: all versions before 21.2R3-S9",
+      "21.4 before 21.4R3-S10",
+      "22.2 before 22.2R3-S6",
+      "22.4 before 22.4R3-S6",
+      "23.2 before 23.2R2-S3",
+      "23.4 before 23.4R2-S4",
+      "24.2 before 24.2R1-S2 and 24.2R2",
+      "Fixed in: 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, 24.2R1-S2, 24.2R2, 24.4R1 and all later releases"
+    ],
+    "vector": "Reachability requires a local attacker who already holds high (root/shell) privileges on the device and can drop from the Junos CLI into the underlying FreeBSD shell — it is explicitly not exploitable from the Junos CLI itself. The primitive is improper process isolation (CWE-653): the attacker writes attacker-controlled shellcode into the memory of a legitimate hung process via /proc/<pid>/mem and overwrites the GOT entry for fclose, so triggering EOF on the process executes the loader instead. This circumvents Junos OS Veriexec verified-execution integrity protection, allowing arbitrary unsigned code (PIC TINYSHELL backdoors) to run despite file-integrity controls — converting existing root shell access into persistent, signature-evading implant execution on the router.",
+    "complexity": "high",
+    "complexity_notes": "Constrained by the stated precondition (auth level, local/physical access, or non-default config), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed improper isolation allowing local code injection into Junos on Juniper Junos OS; CISA set a 2025-04-03 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited improper isolation allowing local code injection into Junos the timescale must collapse to the CISA due date (2025-04-03) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this improper isolation allowing local code injection into Junos until its next window.",
+      "NIS2-Art21-network-security": "NIS2 Art. 21 network-security obligations are met by perimeter and segmentation controls that assume the appliance is trustworthy; an attacker-reachable improper isolation allowing local code injection into Junos in the network device itself defeats that assumption.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Juniper Junos OS was exploited before a normal cycle would have reached it.",
+      "NIST-800-53-SC-7": "SC-7 boundary protection treats this appliance as the boundary; when the boundary device itself carries a improper isolation allowing local code injection into Junos, the control protects nothing in front of it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1059",
+      "T1211",
+      "T1078"
+    ],
+    "rwep_score": 57,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.01657,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-21590",
+    "cwe_refs": [
+      "CWE-653"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-Bulletin-Junos-OS-A-local-attacker-with-shell-access-can-execute-arbitrary-code-CVE-2025-21590?language=en_US",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-21590"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-21590",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "medium",
+        "published_date": "2025-03-13"
+      },
+      {
+        "vendor": "Juniper",
+        "advisory_id": null,
+        "url": "https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-Bulletin-Junos-OS-A-local-attacker-with-shell-access-can-execute-arbitrary-code-CVE-2025-21590?language=en_US",
+        "severity": "medium",
+        "published_date": "2025-03-12"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Credited to Mandiant / Google Threat Intelligence Group (GTIG), a human threat-intel team that found UNC3886 exploiting it in the wild on Juniper routers; no named AI tool is credited with discovery. Quote: \"This specific technique is now tracked as CVE-2025-21590, as detailed in Juniper Network's security bulletin JSA93446.\" Source: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers CISA KEV-listed 2025-03-13 (due 2025-04-03). Curated 2026-06-28 from the NVD record and the Juniper advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "FreeBSD shell entry from Junos CLI followed by creation of a named pipe (mkfifo null) and a hung 'cat' process feeding a here-document-built Base64 payload (e.g. ldb.b64)",
+        "dd writes into /proc/<pid>/mem (conv=notrunc, oseek targeting addresses such as 0x4012f0 / 0x602820) to inject loader.bin/pc.bin and overwrite the GOT entry for fclose",
+        "Presence of TINYSHELL-derived backdoor binaries masquerading as legitimate Junos daemons (appid~appidd, to~top, irad~irsd, lmpad~lmpd, jdosd~jddosd, oemd~oamd); lmpad selectively disables logging",
+        "Outbound SSH (port 22) to UNC3886 C2 IPs including 129.126.109.50, 116.88.34.184, 223.25.78.136, 45.77.39.28, 101.100.182.122, 118.189.188.122, 158.140.135.244, 8.222.225.8; Juniper Malware Removal Tool (JMRT) integrity-check failures"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-21590, CISA KEV (added 2025-03-13), and the Juniper advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the improper isolation allowing local code injection into Junos, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-24993": {
+    "name": "Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability",
+    "type": "Buffer-Overflow",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-11",
+    "cisa_kev_due_date": "2025-04-01",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public weaponized PoC; exploitation is by delivering a specially crafted VHD/VHDX whose malformed NTFS metadata overflows an ntfs.sys heap buffer when the victim mounts it, yielding local code execution.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "No AI tool or agent is credited. The three NTFS file-system zero-days patched together (CVE-2025-24993 RCE, CVE-2025-24991 OOB-read, CVE-2025-24984 info-disclosure) were reported anonymously to Microsoft, per The Hacker News coverage of the March 2025 Patch Tuesday (https://thehackernews.com/2025/03/urgent-microsoft-patches-57-security.html). The named-researcher discovery in the same batch (ESET's Filip Jurcacko, via the PipeMagic backdoor) applies to a SEPARATE CVE, CVE-2025-24983 (Win32k use-after-free LPE) — not to this NTFS RCE. Microsoft's advisory lists no acknowledged finder for CVE-2025-24993.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source describes AI-assisted exploit development or weaponization for CVE-2025-24993. Public reporting describes a conventional VHD-mount trigger; no AI tooling is referenced in any exploitation account.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed exploited as a zero-day prior to the 2025-03-11 patch (added to CISA KEV 2025-03-11, due 2025-04-01); no public threat-actor attribution for the NTFS RCE specifically. The CVE was disclosed in the same March 2025 Patch Tuesday cluster as CVE-2025-24983, which ESET tied to the PipeMagic backdoor, but that attribution is for the Win32k LPE, not this NTFS heap overflow. CISA KEV marks known_ransomware = Unknown for this entry.",
+    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Windows 10 Version 1507 (RTM) - all 32-bit/x64 builds prior to the March 2025 update",
+      "Windows 10 Version 1607, 1809, 21H2, 22H2",
+      "Windows 11 Version 22H2, 23H2, 24H2",
+      "Windows Server 2008 / 2008 R2 (ESU)",
+      "Windows Server 2012 and 2012 R2",
+      "Windows Server 2016",
+      "Windows Server 2019",
+      "Windows Server 2022 (incl. 23H2)",
+      "Windows Server 2025"
+    ],
+    "vector": "Reachability is via the NTFS driver (ntfs.sys) parsing attacker-controlled on-disk metadata: an attacker crafts a malicious VHD/VHDX (or other disk image) and induces a local user to mount it — Windows auto-mounts a double-clicked VHD through Explorer, so this needs only file delivery plus a single user action (UI:R). The malformed NTFS structure causes improper bounds checking in the driver to overflow a heap buffer (CWE-122). Controlling the overwrite of adjacent kernel/heap structures yields local arbitrary code execution; because the parsing happens in the file-system driver running with high privilege, a successful exploit escalates from an ordinary user to SYSTEM, giving full host compromise that can stage ransomware or further implants.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed NTFS heap-based buffer overflow on mounting a crafted VHD on Microsoft Windows; CISA set a 2025-04-01 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited NTFS heap-based buffer overflow on mounting a crafted VHD the timescale must collapse to the CISA due date (2025-04-01) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this NTFS heap-based buffer overflow on mounting a crafted VHD until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited NTFS heap-based buffer overflow on mounting a crafted VHD demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Microsoft Windows was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1204.002",
+      "T1203"
+    ],
+    "rwep_score": 61,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.02092,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24993",
+    "cwe_refs": [
+      "CWE-122"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24993",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-24993"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-24993",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-11"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": null,
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24993",
+        "severity": "high",
+        "published_date": "2025-03-11"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "No AI tool or agent is credited. The three NTFS file-system zero-days patched together (CVE-2025-24993 RCE, CVE-2025-24991 OOB-read, CVE-2025-24984 info-disclosure) were reported anonymously to Microsoft, per The Hacker News coverage of the March 2025 Patch Tuesday (https://thehackernews.com/2025/03/urgent-microsoft-patches-57-security.html). The named-researcher discovery in the same batch (ESET's Filip Jurcacko, via the PipeMagic backdoor) applies to a SEPARATE CVE, CVE-2025-24983 (Win32k use-after-free LPE) — not to this NTFS RCE. Microsoft's advisory lists no acknowledged finder for CVE-2025-24993. CISA KEV-listed 2025-03-11 (due 2025-04-01). Curated 2026-06-28 from the NVD record and the Microsoft advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "A VHD/VHDX or ISO file being mounted (Mount-DiskImage / VirtualDisk service activity) immediately before an unexpected child process spawns under a user-mounted volume",
+        "ntfs.sys / NTFS heap corruption signatures: a System or ntoskrnl crash dump (0x00000139 KERNEL_SECURITY_CHECK_FAILURE or pool-corruption bugcheck) correlated with a recent disk-image mount",
+        "A non-privileged process gaining SYSTEM-level token or executing code from a freshly mounted removable/virtual volume path",
+        "Delivery of a .vhd/.vhdx attachment or download followed by user double-click (Explorer auto-mount), preceding anomalous process creation"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-24993, CISA KEV (added 2025-03-11), and the Microsoft advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS heap-based buffer overflow on mounting a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-24991": {
+    "name": "Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability",
+    "type": "Info-Disclosure",
+    "cvss_score": 5.5,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-11",
+    "cisa_kev_due_date": "2025-04-01",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public PoC located; exploitation requires luring a local user to mount a crafted malicious VHD/VHDX whose malformed NTFS metadata triggers an out-of-bounds heap read, leaking memory contents to the attacker.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "No named AI system is credited. Microsoft's acknowledgments list this NTFS vulnerability as reported anonymously (no individual or vendor named). Independent reporting (Krebs on Security, Zero Day Initiative, BleepingComputer) confirms the anonymous-reporter credit and links it to the same entity that reported the sibling VHD-mounting flaws. By contrast, only CVE-2025-24983 (Win32k) in this March 2025 batch carries a named human discoverer (Filip Jurcacko / ESET). No AI attribution anywhere. Sources: https://krebsonsecurity.com/2025/03/microsoft-6-zero-days-in-march-2025-patch-tuesday/ ; https://www.zerodayinitiative.com/blog/2025/3/11/the-march-2025-security-update-review",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source attributes the in-the-wild exploit code or its weaponization to any AI tool or AI-assisted workflow. Exploitation is described as crafting a malicious VHD/VHDX and socially engineering a user into mounting it; no AI-generation claim is made by Microsoft, ESET, Trend Micro, or ZDI.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (CISA added 2025-03-11, due 2025-04-01); exploited as a zero-day in limited, targeted attacks before the March 2025 Patch Tuesday fix. One of six Windows file-system zero-days patched together; reported as chained for info-disclosure with CVE-2025-24984 and adjacent to the RCE chain CVE-2025-24985/CVE-2025-24993. No public threat-actor attribution is tied specifically to CVE-2025-24991 (the named actors in this batch — PipeMagic/RansomEXX on CVE-2025-24983 and EncryptHub/LARVA-208 on CVE-2025-26633 — attach to sibling CVEs). CISA KEV lists known-ransomware-use as Unknown for this CVE. KEV-confirmed; no public actor attribution specific to this CVE.",
+    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Windows 10 Version 1507 (RTM)",
+      "Windows 10 Version 1607",
+      "Windows 10 Version 1809",
+      "Windows 10 Version 21H2",
+      "Windows 10 Version 22H2",
+      "Windows 11 Version 22H2",
+      "Windows 11 Version 23H2",
+      "Windows 11 Version 24H2",
+      "Windows Server 2012 and 2012 R2",
+      "Windows Server 2016",
+      "Windows Server 2019",
+      "Windows Server 2022 (incl. 23H2)",
+      "Windows Server 2025"
+    ],
+    "vector": "Reachability requires local presence plus user interaction (CVSS UI:R): an attacker must get a victim to mount a specially crafted VHD/VHDX, typically delivered through phishing or a bundled archive. When the NTFS driver parses the malicious file-system structures on the mounted volume, missing bounds validation lets a read operation run past the allocated buffer (CWE-125), returning adjacent kernel/heap memory to the attacker-controlled context. The primitive is an out-of-bounds read that discloses small portions of heap memory, which can leak secrets such as cached credentials, cryptographic key material, or addresses useful for defeating ASLR. There is no direct privilege escalation from this bug alone, but the leaked data is commonly chained with the co-patched NTFS/FAT memory-corruption flaws (CVE-2025-24993 RCE, CVE-2025-24985) to harden an exploit chain into code execution.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed NTFS out-of-bounds read on a crafted VHD on Microsoft Windows; CISA set a 2025-04-01 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited NTFS out-of-bounds read on a crafted VHD the timescale must collapse to the CISA due date (2025-04-01) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this NTFS out-of-bounds read on a crafted VHD until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited NTFS out-of-bounds read on a crafted VHD demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Microsoft Windows was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1204.002",
+      "T1006"
+    ],
+    "rwep_score": 59,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.01852,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24991",
+    "cwe_refs": [
+      "CWE-125"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24991",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-24991"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-24991",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "medium",
+        "published_date": "2025-03-11"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": null,
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24991",
+        "severity": "medium",
+        "published_date": "2025-03-11"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "No named AI system is credited. Microsoft's acknowledgments list this NTFS vulnerability as reported anonymously (no individual or vendor named). Independent reporting (Krebs on Security, Zero Day Initiative, BleepingComputer) confirms the anonymous-reporter credit and links it to the same entity that reported the sibling VHD-mounting flaws. By contrast, only CVE-2025-24983 (Win32k) in this March 2025 batch carries a named human discoverer (Filip Jurcacko / ESET). No AI attribution anywhere. Sources: https://krebsonsecurity.com/2025/03/microsoft-6-zero-days-in-march-2025-patch-tuesday/ ; https://www.zerodayinitiative.com/blog/2025/3/11/the-march-2025-security-update-review CISA KEV-listed 2025-03-11 (due 2025-04-01). Curated 2026-06-28 from the NVD record and the Microsoft advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "User-initiated mount of an unexpected .vhd/.vhdx file (often arriving via phishing/archive), followed by NTFS driver activity against the mounted volume",
+        "VHD/VHDX files written to user-writable paths (Downloads, Temp, mail attachment cache) shortly before a mount event",
+        "Disk-management / VirtualDisk service (vds) or PowerShell Mount-DiskImage / Mount-VHD invocations not originating from an admin or backup workflow",
+        "Process memory reads / sensitive-data access immediately after a VHD mount, consistent with heap-memory disclosure rather than normal file I/O"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-24991, CISA KEV (added 2025-03-11), and the Microsoft advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS out-of-bounds read on a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-24985": {
+    "name": "Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability",
+    "type": "RCE",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-11",
+    "cisa_kev_due_date": "2025-04-01",
+    "poc_available": true,
+    "poc_description": "Public PoC/exploit available. Public detection/mitigation scripts and PoC material exist (vicarius.io vsociety, GitHub); exploitation triggers by inducing a victim to mount a specially crafted VHD whose malformed FAT structures overflow fastfat.sys for kernel code execution.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Microsoft's MSRC advisory credits an anonymous reporter for CVE-2025-24985 (acknowledged together with the same-month NTFS bugs CVE-2025-24984/24991/24993, all attributed to \"Anonymous\"). No named AI tool/agent is credited with discovery. Multiple independent reports (BleepingComputer, ZDI, Tenable) describe it as disclosed/reported anonymously. Sources: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985 ; https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2025-patch-tuesday-fixes-7-zero-days-57-flaws/",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source describes any AI tool or agent being used to weaponize or develop an exploit for CVE-2025-24985. Exploitation was observed in the wild as a zero-day; the delivery technique (malicious VHD mounted by a tricked local user) is conventional and pre-dates this CVE. No AI involvement reported.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (added 2025-03-11, due 2025-04-01); exploited in the wild as a zero-day at the time of the March 2025 Patch Tuesday disclosure. No public threat-actor/campaign attribution and CISA lists known-ransomware use as \"Unknown.\" Observed delivery for this VHD-mount class historically uses phishing lures and pirated-software/cracked-app sites; first-in-wild date not publicly pinned beyond pre-2025-03-11.",
+    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Windows 10 Version 1507 (all editions)",
+      "Windows 10 Version 1607 / Windows Server 2016",
+      "Windows 10 Version 1809 / Windows Server 2019",
+      "Windows 10 Version 21H2 and 22H2",
+      "Windows 11 Version 22H2, 23H2, and 24H2",
+      "Windows Server 2008 SP2 and Server 2008 R2 SP1 (ESU)",
+      "Windows Server 2012 and 2012 R2",
+      "Windows Server 2022 (incl. 23H2) and Windows Server 2025",
+      "Fixed by the March 11, 2025 (March 2025 Patch Tuesday) cumulative security updates for each OS"
+    ],
+    "vector": "CVE-2025-24985 is an integer overflow/wraparound (CWE-190) in the Windows Fast FAT file-system driver (fastfat.sys) leading to a heap-based buffer overflow (CWE-122). Reachability requires a local user to be tricked into mounting an attacker-crafted virtual hard disk (VHD/VHDX); when the kernel parses the malformed FAT metadata, the size miscalculation overflows a heap allocation. The corrupted-heap primitive yields kernel-mode memory corruption that an attacker shapes into arbitrary code execution in the context of the file-system driver, escalating from a normal user to SYSTEM. Net effect is local code execution gated only by user interaction (the mount), with no prior privileges required.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed Fast FAT integer overflow leading to a heap overflow on a crafted VHD on Microsoft Windows; CISA set a 2025-04-01 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited Fast FAT integer overflow leading to a heap overflow on a crafted VHD the timescale must collapse to the CISA due date (2025-04-01) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this Fast FAT integer overflow leading to a heap overflow on a crafted VHD until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited Fast FAT integer overflow leading to a heap overflow on a crafted VHD demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Microsoft Windows was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1204.002",
+      "T1203"
+    ],
+    "rwep_score": 79,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.03705,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24985",
+    "cwe_refs": [
+      "CWE-122",
+      "CWE-190"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-24985"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-24985",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-11"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": null,
+        "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985",
+        "severity": "high",
+        "published_date": "2025-03-11"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Microsoft's MSRC advisory credits an anonymous reporter for CVE-2025-24985 (acknowledged together with the same-month NTFS bugs CVE-2025-24984/24991/24993, all attributed to \"Anonymous\"). No named AI tool/agent is credited with discovery. Multiple independent reports (BleepingComputer, ZDI, Tenable) describe it as disclosed/reported anonymously. Sources: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985 ; https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2025-patch-tuesday-fixes-7-zero-days-57-flaws/ CISA KEV-listed 2025-03-11 (due 2025-04-01). Curated 2026-06-28 from the NVD record and the Microsoft advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "A user mounting an unexpected VHD/VHDX file (vhdmp.sys / fastfat.sys driver activity) sourced from email, download, or removable media",
+        "fastfat.sys parsing a FAT volume immediately followed by an anomalous child process or kernel-mode crash/bugcheck referencing FASTFAT",
+        "Newly downloaded .vhd/.vhdx/.iso files in user-writable paths (Downloads, Temp) shortly before disk-mount events in the Microsoft-Windows-VHDMP operational log",
+        "Post-exploitation: unexpected SYSTEM-context process spawned from a session that had just mounted a removable virtual disk"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-24985, CISA KEV (added 2025-03-11), and the Microsoft advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the Fast FAT integer overflow leading to a heap overflow on a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-24984": {
+    "name": "Microsoft Windows NTFS Information Disclosure Vulnerability",
+    "type": "Info-Disclosure",
+    "cvss_score": 4.6,
+    "cvss_vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-11",
+    "cisa_kev_due_date": "2025-04-01",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public weaponized PoC; exploitation requires physically mounting a crafted NTFS volume (malicious USB/VHD) so the NTFS driver logs heap memory the attacker then reads back to disclose sensitive data.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "No named AI system credited. The three March 2025 Windows NTFS vulnerabilities (CVE-2025-24984, -24991, -24993) were reported to Microsoft anonymously per Patch Tuesday coverage; the MSRC advisory and NVD list no acknowledgment. Reported anonymously to a vendor PSIRT is a human/anonymous disclosure, not AI discovery. Sources: https://www.theregister.com/2025/03/12/patch_tuesday/ , https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source attributes the discovery, PoC, or any in-the-wild exploitation tooling for CVE-2025-24984 to an AI system. KEV-confirmed exploitation carries no public actor attribution and no public weaponization narrative.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-confirmed (CISA added 2025-03-11, due 2025-04-01); no public actor attribution. Physical-access information disclosure shipped alongside CVE-2025-24993 (NTFS heap overflow, RCE) and CVE-2025-24985 (Fast FAT) in the same March 2025 Patch Tuesday cluster of six exploited zero-days, where the practical chain is a malicious crafted VHD/USB image mounted by the victim. Microsoft marked it exploited; no ransomware association recorded in KEV. Some trackers (Tenable) annotate exploitation activity predating disclosure, but no named campaign or threat group is publicly tied to this specific CVE.",
+    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Windows 10 Version 1507 / 1607 / 1809 / 21H2 / 22H2 (x86, x64, ARM64 as applicable)",
+      "Windows 11 Version 22H2 / 23H2 / 24H2 (x64, ARM64)",
+      "Windows Server 2012 and 2012 R2 (incl. Server Core)",
+      "Windows Server 2016",
+      "Windows Server 2019",
+      "Windows Server 2022 (incl. 22H2 / 23H2 Server Core)",
+      "Windows Server 2025"
+    ],
+    "vector": "CVE-2025-24984 is a CWE-532 flaw in the Windows NTFS driver that inserts sensitive in-memory data (portions of heap, potentially containing cached credentials, tokens, or keys) into NTFS log/metadata structures. Reachability requires physical/local access (CVSS AV:P) — the attacker mounts a crafted NTFS volume, typically via a malicious USB device or VHD image, prompting the driver to process attacker-influenced filesystem structures. The primitive is an out-of-bounds/uninitialized read disclosed into log data that the attacker can then read back, yielding heap-memory disclosure (C:H, I:N, A:N). It does not by itself grant code execution or privilege escalation, but the leaked heap contents can seed a follow-on attack and it was shipped/exploited in the same window as the NTFS heap-overflow RCE CVE-2025-24993, making it a useful information-leak primitive in a physical-access chain.",
+    "complexity": "moderate",
+    "complexity_notes": "Constrained by the stated precondition (auth level, local/physical access, or non-default config), but exploited in the wild — treat as high-priority. Derived from the NVD vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed NTFS information disclosure via sensitive data written to a log on Microsoft Windows; CISA set a 2025-04-01 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited NTFS information disclosure via sensitive data written to a log the timescale must collapse to the CISA due date (2025-04-01) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this NTFS information disclosure via sensitive data written to a log until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited NTFS information disclosure via sensitive data written to a log demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Microsoft Windows was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1006",
+      "T1083"
+    ],
+    "rwep_score": 57,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.163,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24984",
+    "cwe_refs": [
+      "CWE-532"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-24984"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-24984",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "medium",
+        "published_date": "2025-03-11"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": null,
+        "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984",
+        "severity": "medium",
+        "published_date": "2025-03-11"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "No named AI system credited. The three March 2025 Windows NTFS vulnerabilities (CVE-2025-24984, -24991, -24993) were reported to Microsoft anonymously per Patch Tuesday coverage; the MSRC advisory and NVD list no acknowledgment. Reported anonymously to a vendor PSIRT is a human/anonymous disclosure, not AI discovery. Sources: https://www.theregister.com/2025/03/12/patch_tuesday/ , https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984 CISA KEV-listed 2025-03-11 (due 2025-04-01). Curated 2026-06-28 from the NVD record and the Microsoft advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Mounting of an attacker-supplied VHD/VHDX or external NTFS volume (USB removable media) on a target host, observed via VDS/mountvol and Microsoft-Windows-VHDMP-Operational events",
+        "NTFS metadata/log (e.g. $LogFile/$UsnJrnl) read access by a low-privilege or interactive local process immediately after volume mount",
+        "Console/physical login sessions (LogonType 2/11) correlated with removable-media insertion events (EventID 6416 Plug and Play device) on systems missing the March 2025 cumulative KB",
+        "Absence of the March 2025 NTFS cumulative update (e.g. KB5053606/KB5053602/KB5053618 family) on a host showing the above mount-then-read pattern"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-24984, CISA KEV (added 2025-03-11), and the Microsoft advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS information disclosure via sensitive data written to a log, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2025-24983": {
+    "name": "Microsoft Windows Win32k Use-After-Free Vulnerability",
+    "type": "Use-After-Free",
+    "cvss_score": 7,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-11",
+    "cisa_kev_due_date": "2025-04-01",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public exploit code from the original disclosure; the working exploit was the in-the-wild Storm-2460/PipeMagic build that races the W32PROCESS UAF in Win32k to gain a kernel primitive and elevate a local process to SYSTEM on Windows 8.1 / Server 2012 R2 and other pre-1809 builds.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Discovered by ESET researcher Filip Jurcacko, who found the zero-day exploited in the wild and reported it to Microsoft. ESET Research's disclosure (infosec.exchange/@ESETresearch/114148213672762050) and BleepingComputer credit the human ESET research team; no AI tool/agent is named with discovery. Found in-the-wild, not via an automated AI discovery system. https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-windows-kernel-zero-day-exploited-since-2023/",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source credits an AI system with weaponizing or developing the exploit. The exploit was crafted and operated by the Storm-2460 threat cluster and delivered via the PipeMagic backdoor; the only AI tie-in is thematic social-engineering (PipeMagic later masqueraded as an open-source ChatGPT desktop app), which is lure branding, not AI-assisted exploit development.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited in the wild as a zero-day since approximately March 2023 (roughly two years before the March 2025 patch). ESET attributes deployment to the PipeMagic modular backdoor; Microsoft tracks the operator as Storm-2460, which chained PipeMagic into post-compromise privilege escalation and (via the companion CLFS zero-day CVE-2025-29824) RansomEXX-family ransomware. Targets spanned IT/real-estate (US), financial (Venezuela), a Spanish software firm, and retail (Saudi Arabia). KEV-listed 2025-03-11. Note: CISA KEV marks this specific CVE known_ransomware=\"Unknown\" (the ransomware payload chain ran through the CLFS bug, not this Win32k EoP).",
+    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Windows 8.1 (x64/x86) and Windows Server 2012 R2 — primary in-the-wild exploitation targets",
+      "Windows Server 2016 (still-supported, vulnerable)",
+      "Windows 10 Version 1607 (build 1607) and earlier, including Version 1507",
+      "Windows Server 2008 R2 SP1 and Windows Server 2012",
+      "Affects OS releases prior to Windows 10 build 1809; Windows 11 and current Windows 10/Server 2019+ builds are not affected"
+    ],
+    "vector": "An attacker who already has low-privilege local code execution on an affected, pre-1809 Windows build triggers a use-after-free in the Win32k kernel subsystem: by winning a race condition, the W32PROCESS structure is dereferenced one more time than its reference count allows, leaving a dangling pointer to freed kernel memory. Grooming the kernel pool to reclaim that allocation with attacker-controlled data turns the stale dereference into a controlled kernel write/execute primitive, escalating the process token to SYSTEM. Because the bug is reached only after initial foothold (here, via the PipeMagic backdoor), it is a second-stage local privilege escalation that hands the operator full machine takeover for follow-on actions such as credential theft, persistence, and ransomware staging. The high attack complexity reflects the race that must be won, which is why Microsoft rated it Important rather than Critical.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as trivially exploitable. Derived from the NVD vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed Win32k use-after-free privilege escalation on Microsoft Windows; CISA set a 2025-04-01 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited Win32k use-after-free privilege escalation the timescale must collapse to the CISA due date (2025-04-01) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this Win32k use-after-free privilege escalation until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited Win32k use-after-free privilege escalation demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — Microsoft Windows was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1068",
+      "T1203"
+    ],
+    "rwep_score": 59,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
+    "epss_score": 0.01267,
+    "epss_date": "2026-06-28",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24983",
+    "cwe_refs": [
+      "CWE-416"
+    ],
+    "source_verified": "2026-06-28",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24983",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-24983"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-24983",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-11"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": null,
+        "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24983",
+        "severity": "high",
+        "published_date": "2025-03-11"
+      }
+    ],
+    "last_updated": "2026-06-28",
+    "discovery_attribution_note": "Discovered by ESET researcher Filip Jurcacko, who found the zero-day exploited in the wild and reported it to Microsoft. ESET Research's disclosure (infosec.exchange/@ESETresearch/114148213672762050) and BleepingComputer credit the human ESET research team; no AI tool/agent is named with discovery. Found in-the-wild, not via an automated AI discovery system. https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-windows-kernel-zero-day-exploited-since-2023/ CISA KEV-listed 2025-03-11 (due 2025-04-01). Curated 2026-06-28 from the NVD record and the Microsoft advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "A low-privileged user-mode process spins a tight thread race to win a kernel timing window, then a Win32k UAF dereferences a freed W32PROCESS structure — visible as a kernel-mode integrity crash/bugcheck or an unexpected SYSTEM-token process spawned from a medium/low-integrity parent",
+        "Presence of the PipeMagic modular backdoor: named-pipe IPC channels (e.g. \\\\.\\pipe\\ patterns), an injected loader, and a process masquerading as an open-source ChatGPT desktop application",
+        "A non-elevated process acquiring SYSTEM privileges with no corresponding UAC/consent prompt or service start (token theft / EoP signature)",
+        "Outbound C2 from the compromised host (data exfiltration / remote access via PipeMagic), and on the ransomware-chained hosts a ransom note referencing a RansomEXX-tied TOR domain"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-24983, CISA KEV (added 2025-03-11), and the Microsoft advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the Win32k use-after-free privilege escalation, framework gaps mapped global-first, and a paired zero-day lesson added."
   }
 }