@blamejs/exceptd-skills 0.18.20 → 0.18.21

package/data/cve-catalog.json

@@ -55,8 +55,8 @@
     "ai_discovery_methodology": {
       "field_added": "2026-05-15",
       "agents_md_target": "Hard Rule #7 — '41% of 2025 zero-days were AI-discovered'. Catalog target rate floor: 0.40.",
-      "current_rate": 0.024,
-      "current_floor_enforced_by_test": 0.024,
+      "current_rate": 0.023,
+      "current_floor_enforced_by_test": 0.023,
       "ladder_to_target": [
         0.027,
         0.028,
@@ -93,6 +93,2133 @@
     },
     "last_threat_review": "2026-05-30"
   },
+  "CVE-2026-45659": {
+    "name": "Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability",
+    "type": "RCE",
+    "cvss_score": 8.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-07-01",
+    "cisa_kev_due_date": "2026-07-04",
+    "poc_available": false,
+    "poc_description": "No confirmed public standalone weaponized PoC specific to CVE-2026-45659 as of early July 2026; reporting from late May 2026 stated no public technical details or exploit were available. GitHub hits such as 'MS-SharePoint-July-Patch-RCE-PoC' and CVE-2025-53770 (ToolShell) repos are for different, older SharePoint bugs.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Credited to Microsoft (MSRC) via the update guide; no external finder is publicly named. In-the-wild exploitation attribution is unknown per CISA/press. No AI system is credited in any primary source.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "CISA added this SharePoint deserialization RCE to the KEV catalog on 2026-07-01 citing confirmed active exploitation, notable because Microsoft's own advisory had rated exploitation 'Less Likely.' As of the KEV listing, public reporting states it is not yet known who is behind the activity, how the flaw is being weaponized in the wild, or the end objective; no threat actor, ransomware crew, or campaign has been publicly attributed. Exploitation requires an authenticated account with at least Site Member permissions, so observed activity likely leverages stolen/low-privilege SharePoint credentials to reach the deserialization sink. FCEB remediation was due 2026-07-04.",
+    "affected": "Microsoft SharePoint Server — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "SharePoint Server Subscription Edition",
+      "SharePoint Server 2019",
+      "SharePoint Enterprise Server 2016 (all before the May 2026 security update)"
+    ],
+    "vector": "Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Microsoft SharePoint Server; CISA set a 2026-07-04 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited rce on Microsoft SharePoint Server the timescale must collapse to the CISA due date (2026-07-04) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this rce on Microsoft SharePoint Server until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited rce on Microsoft SharePoint Server demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this rce on Microsoft SharePoint Server was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 59,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=24. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.03219,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-45659",
+    "cwe_refs": [
+      "CWE-502"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-45659"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2026-45659",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2026-07-01"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2026-45659",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659",
+        "severity": "high",
+        "published_date": "2026-05-12"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Credited to Microsoft (MSRC) via the update guide; no external finder is publicly named. In-the-wild exploitation attribution is unknown per CISA/press. No AI system is credited in any primary source. CISA KEV-listed 2026-07-01 (due 2026-07-04). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "SharePoint Server process spawning an unexpected child (cmd.exe/powershell.exe/sh/webshell interpreter) shortly after an inbound request, indicating code execution through the vulnerable endpoint",
+        "Inbound exploitation attempts against SharePoint Server from KEV-tracked scanning infrastructure shortly after Microsoft disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the SharePoint Server host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-45659, CISA KEV (added 2026-07-01), and the vendor advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2026-48558": {
+    "name": "SimpleHelp Authentication Bypass Vulnerability",
+    "type": "Auth-Bypass",
+    "cvss_score": 10,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-06-29",
+    "cisa_kev_due_date": "2026-07-02",
+    "poc_available": false,
+    "poc_description": "Horizon3.ai published a technical root-cause writeup and added a NodeZero detection test, but released no public standalone PoC/exploit. Exploitation observed is in-the-wild only; no Metasploit/ExploitDB/GitHub weaponized reproducer confirmed.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Discovered and responsibly disclosed by Horizon3.ai (researcher Zach Hanley); found 2026-05-21, reported 2026-05-22, published 2026-06-12. Some secondary press stated the finding was aided by generative AI, but the primary Horizon3 advisory names no specific AI system.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "BlackPoint Cyber's Adversary Pursuit Group reported on 2026-06-29 that attackers bypassed OIDC auth on an internet-facing SimpleHelp RMM server, obtained a Technician session, and used it to push files and remotely execute malware across managed endpoints — deploying two previously undocumented samples, the TaskWeaver loader and the Djinn Stealer. This is an MSP/RMM supply-chain vector: one compromised SimpleHelp server grants downstream access to all managed systems, and the flaw defeats technician MFA because first-login self-enrollment lets the attacker register their own MFA. Horizon3 estimated ~14,000 internet-exposed SimpleHelp servers with ~7.2% using the vulnerable OIDC config. CISA KEV-listed 2026-06-29.",
+    "affected": "SimpleHelp  SimpleHelp — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "SimpleHelp <= 5.5.15",
+      "SimpleHelp 6.0 pre-release versions",
+      "Fixed in 5.5.16 and 6.0 RC2 (OIDC-configured deployments only)"
+    ],
+    "vector": "SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed auth bypass on SimpleHelp SimpleHelp; CISA set a 2026-07-02 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited auth bypass on SimpleHelp SimpleHelp the timescale must collapse to the CISA due date (2026-07-02) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this auth bypass on SimpleHelp SimpleHelp until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited auth bypass on SimpleHelp SimpleHelp demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this auth bypass on SimpleHelp SimpleHelp was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1078",
+      "T1199"
+    ],
+    "rwep_score": 50,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=20. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.0116,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-48558",
+    "cwe_refs": [
+      "CWE-347"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://simple-help.com/security/simplehelp-security-update-2026-05",
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-48558"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2026-48558",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2026-06-29"
+      },
+      {
+        "vendor": "SimpleHelp ",
+        "advisory_id": "SimpleHelp Security Update 2026-05",
+        "url": "https://simple-help.com/security/simplehelp-security-update-2026-05",
+        "severity": "critical",
+        "published_date": null
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Discovered and responsibly disclosed by Horizon3.ai (researcher Zach Hanley); found 2026-05-21, reported 2026-05-22, published 2026-06-12. Some secondary press stated the finding was aided by generative AI, but the primary Horizon3 advisory names no specific AI system. CISA KEV-listed 2026-06-29 (due 2026-07-02). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Successful authenticated actions on SimpleHelp from a session that never completed a legitimate credential/MFA challenge, indicating an authentication or authorization bypass",
+        "Inbound exploitation attempts against SimpleHelp from KEV-tracked scanning infrastructure shortly after SimpleHelp  disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the SimpleHelp host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-48558, CISA KEV (added 2026-06-29), and the vendor advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 10 and CWE(s) CWE-347 retained; ATT&CK + IOCs derived from the Auth-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2025-26633": {
+    "name": "Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability",
+    "type": "Security-Feature-Bypass",
+    "cvss_score": 7,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-11",
+    "cisa_kev_due_date": "2025-04-01",
+    "poc_available": true,
+    "poc_description": "Multiple public GitHub PoCs exist, e.g. github.com/sandsoncosta/CVE-2025-26633 (arbitrary command execution via a malicious .msc/MMC snap-in) and github.com/mbanyamer/MSC-EvilTwin-Local-Privilege-Escalation (creates a local admin via a crafted MSC file on unpatched Windows). Both marked authorized-testing-only.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Detected in-the-wild and reported through Trend Micro / Trend Zero Day Initiative (ZDI) in cooperation with Microsoft; patched on the March 11, 2025 Patch Tuesday. No AI system credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited as a zero-day by the suspected Russian actor Water Gamayun (aka EncryptHub / LARVA-208), documented by Trend Micro in the 'MSC EvilTwin' campaign. Delivery chains use social engineering plus provisioning packages (.ppkg), signed .msi installers, and rogue .msc console files to drop info-stealers and backdoors including SilentPrism, DarkWisp, Rhadamanthys, StealC, and custom EncryptHub PowerShell stealer variants. Targeting spanned telecom, finance, defense, and manufacturing. CISA KEV-listed 2025-03-11 with a Known ransomware association.",
+    "affected": "Microsoft Windows — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Microsoft Windows 10",
+      "Windows 11",
+      "Windows Server (supported branches) before the March 2025 cumulative update"
+    ],
+    "vector": "Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed security feature bypass on Microsoft Windows; CISA set a 2025-04-01 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited security feature bypass on Microsoft Windows the timescale must collapse to the CISA due date (2025-04-01) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this security feature bypass on Microsoft Windows until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited security feature bypass on Microsoft Windows demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this security feature bypass on Microsoft Windows was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1218",
+      "T1036",
+      "T1204"
+    ],
+    "rwep_score": 82,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 27,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=27. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.31894,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-26633",
+    "cwe_refs": [
+      "CWE-707"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26633",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-26633"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-26633",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-11"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2025-26633",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26633",
+        "severity": "high",
+        "published_date": "2025-03-11"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Detected in-the-wild and reported through Trend Micro / Trend Zero Day Initiative (ZDI) in cooperation with Microsoft; patched on the March 11, 2025 Patch Tuesday. No AI system credited. CISA KEV-listed 2025-03-11 (due 2025-04-01). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "payload_artifacts": [
+        "Malicious .msc console file planted in a localized 'en-US' MUIPath subdirectory to override (EvilTwin) the legitimate console so mmc.exe loads the attacker copy on open",
+        "Delivery via provisioning packages (.ppkg), signed .msi installers, and rogue .msc files",
+        "Follow-on payloads: SilentPrism and DarkWisp backdoors, Rhadamanthys and StealC stealers, and EncryptHub custom PowerShell stealer variants"
+      ],
+      "c2_indicators": [
+        "Water Gamayun / EncryptHub (LARVA-208) C2 retrieving second-stage stealers after the MMC security bypass"
+      ],
+      "behavioral": [
+        "A low-privileged process on the host gaining SYSTEM/root or bypassing a security control immediately after loading a crafted object/file, indicating local privilege escalation",
+        "Inbound exploitation attempts against Windows from KEV-tracked scanning infrastructure shortly after Microsoft disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Windows host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: Trend Micro 'MSC EvilTwin' campaign report; public PoCs github.com/sandsoncosta/CVE-2025-26633 and github.com/mbanyamer/MSC-EvilTwin-Local-Privilege-Escalation. Cross-referenced with NVD CVE-2025-26633 and the CISA KEV listing (added 2025-03-11)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 7 and CWE(s) CWE-707 retained; ATT&CK + IOCs derived from the Security-Feature-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2024-13161": {
+    "name": "Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (GetHashForSingleFile)",
+    "type": "Credential-Coercion",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-10",
+    "cisa_kev_due_date": "2025-03-31",
+    "poc_available": true,
+    "poc_description": "Horizon3.ai published full technical details plus a working proof-of-concept exploit on 2025-02-19 covering all four EPM CVEs, demonstrating the crafted-UNC-path credential coercion.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "One of three related Ivanti EPM absolute-path-traversal/credential-coercion flaws (with CVE-2024-13160 and CVE-2024-13159) that CISA added to KEV on 2025-03-10 warning of active in-the-wild exploitation. This bug is the credential coercion in the GetHashForSingleFile method of WSVulnerabilityCore.dll. No named threat actor/ransomware group has been publicly attributed; activity is unauthenticated attackers coercing the EPM machine-account credential for NTLM relay. Federal remediation due 2025-03-31.",
+    "affected": "Ivanti Endpoint Manager (EPM) — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Ivanti EPM 2024 before the January 2025 Security Update",
+      "Ivanti EPM 2022 before the SU6 January 2025 Security Update"
+    ],
+    "vector": "Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed credential coercion on Ivanti Endpoint Manager (EPM); CISA set a 2025-03-31 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited credential coercion on Ivanti Endpoint Manager (EPM) the timescale must collapse to the CISA due date (2025-03-31) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this credential coercion on Ivanti Endpoint Manager (EPM) until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited credential coercion on Ivanti Endpoint Manager (EPM) demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this credential coercion on Ivanti Endpoint Manager (EPM) was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1187",
+      "T1557"
+    ],
+    "rwep_score": 73,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.88518,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-13161",
+    "cwe_refs": [
+      "CWE-36"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-13161"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-13161",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-03-10"
+      },
+      {
+        "vendor": "Ivanti",
+        "advisory_id": "Security Advisory EPM January 2025 (EPM 2024 and EPM 2022 SU6)",
+        "url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6",
+        "severity": "critical",
+        "published_date": "2025-01-13"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited. CISA KEV-listed 2025-03-10 (due 2025-03-31). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "payload_artifacts": [
+        "Crafted absolute/UNC path passed to WSVulnerabilityCore.dll GetHashForSingleFile to coerce the EPM machine account into SMB authentication to an attacker-controlled share"
+      ],
+      "credential_paths_scanned": [
+        "Captured EPM machine-account NTLM hash suitable for NTLM relay toward server compromise"
+      ],
+      "host_recon": [
+        "Unauthenticated calls to the Ivanti EPM WSVulnerabilityCore endpoint invoking the hash-for-file method"
+      ],
+      "behavioral": [
+        "Outbound SMB/HTTP/file-read requests originating from the Endpoint Manager (EPM) service account to attacker-controlled or unexpected destinations, indicating coerced authentication or arbitrary file read",
+        "Inbound exploitation attempts against Endpoint Manager (EPM) from KEV-tracked scanning infrastructure shortly after Ivanti disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Endpoint Manager (EPM) host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: Horizon3.ai technical writeup + working PoC published 2025-02-19 covering the four Ivanti EPM CVEs. Cross-referenced with NVD CVE-2024-13161 and the CISA KEV listing (added 2025-03-10)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2024-13160": {
+    "name": "Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (GetHashForWildcard)",
+    "type": "Credential-Coercion",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-10",
+    "cisa_kev_due_date": "2025-03-31",
+    "poc_available": true,
+    "poc_description": "Covered by the same Horizon3.ai research and proof-of-concept exploit published 2025-02-19 for the four Ivanti EPM CVEs.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Companion Ivanti EPM absolute-path-traversal/credential-coercion flaw (the GetHashForWildcard method) grouped with CVE-2024-13161 and CVE-2024-13159; CISA KEV-listed 2025-03-10 for active in-the-wild exploitation. No specific threat actor or ransomware operator has been publicly named; exploitation is unauthenticated coercion of the EPM machine-account credential for SMB/NTLM relay. Federal remediation due 2025-03-31.",
+    "affected": "Ivanti Endpoint Manager (EPM) — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Ivanti EPM 2024 before the January 2025 Security Update",
+      "Ivanti EPM 2022 before the SU6 January 2025 Security Update"
+    ],
+    "vector": "Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed credential coercion on Ivanti Endpoint Manager (EPM); CISA set a 2025-03-31 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited credential coercion on Ivanti Endpoint Manager (EPM) the timescale must collapse to the CISA due date (2025-03-31) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this credential coercion on Ivanti Endpoint Manager (EPM) until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited credential coercion on Ivanti Endpoint Manager (EPM) demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this credential coercion on Ivanti Endpoint Manager (EPM) was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1187",
+      "T1557"
+    ],
+    "rwep_score": 73,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.89738,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-13160",
+    "cwe_refs": [
+      "CWE-36"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-13160"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-13160",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-03-10"
+      },
+      {
+        "vendor": "Ivanti",
+        "advisory_id": "Security Advisory EPM January 2025 (EPM 2024 and EPM 2022 SU6)",
+        "url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6",
+        "severity": "critical",
+        "published_date": "2025-01-13"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited. CISA KEV-listed 2025-03-10 (due 2025-03-31). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "payload_artifacts": [
+        "Crafted absolute/UNC path passed to WSVulnerabilityCore.dll GetHashForWildcard to coerce the EPM machine account into SMB authentication to an attacker-controlled share"
+      ],
+      "credential_paths_scanned": [
+        "Captured EPM machine-account NTLM hash suitable for NTLM relay toward server compromise"
+      ],
+      "host_recon": [
+        "Unauthenticated calls to the Ivanti EPM WSVulnerabilityCore endpoint invoking the wildcard hash method"
+      ],
+      "behavioral": [
+        "Outbound SMB/HTTP/file-read requests originating from the Endpoint Manager (EPM) service account to attacker-controlled or unexpected destinations, indicating coerced authentication or arbitrary file read",
+        "Inbound exploitation attempts against Endpoint Manager (EPM) from KEV-tracked scanning infrastructure shortly after Ivanti disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Endpoint Manager (EPM) host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: Horizon3.ai technical writeup + working PoC published 2025-02-19 covering the four Ivanti EPM CVEs. Cross-referenced with NVD CVE-2024-13160 and the CISA KEV listing (added 2025-03-10)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2024-13159": {
+    "name": "Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (GetHashForWildcardRecursive)",
+    "type": "Credential-Coercion",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-10",
+    "cisa_kev_due_date": "2025-03-31",
+    "poc_available": true,
+    "poc_description": "Included in Horizon3.ai's 2025-02-19 technical writeup and public proof-of-concept exploit spanning all four EPM CVEs.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Third of the related Ivanti EPM absolute-path-traversal/credential-coercion flaws (the GetHashForWildcardRecursive method), listed alongside CVE-2024-13161 and CVE-2024-13160; CISA added it to KEV on 2025-03-10 citing active exploitation. As with its siblings, no named APT or ransomware group has been publicly attributed; the observed primitive is unauthenticated coercion of the EPM machine-account credential enabling NTLM relay and server takeover. Federal remediation due 2025-03-31.",
+    "affected": "Ivanti Endpoint Manager (EPM) — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Ivanti EPM 2024 before the January 2025 Security Update",
+      "Ivanti EPM 2022 before the SU6 January 2025 Security Update"
+    ],
+    "vector": "Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed credential coercion on Ivanti Endpoint Manager (EPM); CISA set a 2025-03-31 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited credential coercion on Ivanti Endpoint Manager (EPM) the timescale must collapse to the CISA due date (2025-03-31) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this credential coercion on Ivanti Endpoint Manager (EPM) until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited credential coercion on Ivanti Endpoint Manager (EPM) demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this credential coercion on Ivanti Endpoint Manager (EPM) was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1187",
+      "T1557"
+    ],
+    "rwep_score": 73,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.99762,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-13159",
+    "cwe_refs": [
+      "CWE-36"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-13159"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-13159",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-03-10"
+      },
+      {
+        "vendor": "Ivanti",
+        "advisory_id": "Security Advisory EPM January 2025 (EPM 2024 and EPM 2022 SU6)",
+        "url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6",
+        "severity": "critical",
+        "published_date": "2025-01-13"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited. CISA KEV-listed 2025-03-10 (due 2025-03-31). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "payload_artifacts": [
+        "Crafted absolute/UNC path passed to WSVulnerabilityCore.dll GetHashForWildcardRecursive to coerce the EPM machine account into SMB authentication to an attacker-controlled share"
+      ],
+      "credential_paths_scanned": [
+        "Captured EPM machine-account NTLM hash suitable for NTLM relay toward server compromise"
+      ],
+      "host_recon": [
+        "Unauthenticated calls to the Ivanti EPM WSVulnerabilityCore endpoint invoking the recursive wildcard hash method"
+      ],
+      "behavioral": [
+        "Outbound SMB/HTTP/file-read requests originating from the Endpoint Manager (EPM) service account to attacker-controlled or unexpected destinations, indicating coerced authentication or arbitrary file read",
+        "Inbound exploitation attempts against Endpoint Manager (EPM) from KEV-tracked scanning infrastructure shortly after Ivanti disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Endpoint Manager (EPM) host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: Horizon3.ai technical writeup + working PoC published 2025-02-19 covering the four Ivanti EPM CVEs. Cross-referenced with NVD CVE-2024-13159 and the CISA KEV listing (added 2025-03-10)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2024-57968": {
+    "name": "Advantive VeraCore Unrestricted File Upload Vulnerability",
+    "type": "RCE",
+    "cvss_score": 9.9,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-10",
+    "cisa_kev_due_date": "2025-03-31",
+    "poc_available": false,
+    "poc_description": "No public standalone weaponized PoC/Metasploit/ExploitDB module identified; the flaw is trivially reproducible (authenticated file upload) and was documented via in-the-wild webshell activity by Intezer/Solis, which are incident writeups rather than a published exploit.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Detected in-the-wild and reported by Intezer researchers (Nicole Fishbein, Joakim Kennedy, Justin Lentz) with Solis Security. No AI system credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited as a zero-day by the cybercrime crew XE Group (which pivoted from Magecart-style skimming to zero-day supply-chain intrusions), documented by Intezer and Solis Security. Attackers chained a VeraCore SQL-injection (CVE-2025-25181) to steal valid credentials, then abused this authenticated upload flaw via upload.aspx to plant ASPX webshells; targets were manufacturing and order-fulfillment firms. Intezer documented one victim compromised in 2020 with access maintained for over four years. CISA KEV-listed 2025-03-10.",
+    "affected": "Advantive VeraCore — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Advantive VeraCore before 2024.4.2.1",
+      "Fixed in 2024.4.2.1"
+    ],
+    "vector": "Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Advantive VeraCore; CISA set a 2025-03-31 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited rce on Advantive VeraCore the timescale must collapse to the CISA due date (2025-03-31) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this rce on Advantive VeraCore until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited rce on Advantive VeraCore demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this rce on Advantive VeraCore was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1505.003"
+    ],
+    "rwep_score": 44,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 14,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=14. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.30477,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-57968",
+    "cwe_refs": [
+      "CWE-434"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-57968"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-57968",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-03-10"
+      },
+      {
+        "vendor": "Advantive",
+        "advisory_id": "VeraCore Release Notes 2024.4.2.1",
+        "url": "https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1",
+        "severity": "critical",
+        "published_date": null
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Detected in-the-wild and reported by Intezer researchers (Nicole Fishbein, Joakim Kennedy, Justin Lentz) with Solis Security. No AI system credited. CISA KEV-listed 2025-03-10 (due 2025-03-31). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "VeraCore process spawning an unexpected child (cmd.exe/powershell.exe/sh/webshell interpreter) shortly after an inbound request, indicating code execution through the vulnerable endpoint",
+        "Inbound exploitation attempts against VeraCore from KEV-tracked scanning infrastructure shortly after Advantive disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the VeraCore host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2024-57968, CISA KEV (added 2025-03-10), and the vendor advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.9 and CWE(s) CWE-434 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2025-25181": {
+    "name": " Advantive VeraCore SQL Injection Vulnerability",
+    "type": "SQL-Injection",
+    "cvss_score": 5.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-10",
+    "cisa_kev_due_date": "2025-03-31",
+    "poc_available": true,
+    "poc_description": "The exact injectable endpoint and parameter (GET timeoutWarning.asp, PmSess1) are published in the Intezer and Solis Security writeups, making it directly sqlmap-exploitable; CVE aggregators list 2-3 public GitHub PoCs and a Tenable WAS detection plugin (114935) exists. Treat as publicly reproducible.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Discovered in-the-wild by Intezer and Solis Security researchers while investigating XE Group intrusions; reported early Feb 2025. No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited as a zero-day by XE Group, a Vietnamese-linked cybercrime crew that pivoted from credit-card skimming to zero-day exploitation. XE Group chained this SQLi (in timeoutWarning.asp) with the file-upload flaw CVE-2024-57968 to retrieve valid credentials from the database and plant ASPX web shells for long-term persistence, in some cases maintaining access for years and targeting manufacturing/distribution supply chains. Reactivated intrusion observed Nov 5, 2024; documented jointly by Intezer and Solis Security in Feb 2025. Added to CISA KEV March 10, 2025.",
+    "affected": "Advantive VeraCore — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Affected: VeraCore through 2025.1.0",
+      "Fixed: 2025.1.1.3"
+    ],
+    "vector": "A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed sql injection on Advantive VeraCore; CISA set a 2025-03-31 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited sql injection on Advantive VeraCore the timescale must collapse to the CISA due date (2025-03-31) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this sql injection on Advantive VeraCore until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited sql injection on Advantive VeraCore demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this sql injection on Advantive VeraCore was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1078"
+    ],
+    "rwep_score": 64,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 14,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=14. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.50557,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-25181",
+    "cwe_refs": [
+      "CWE-89"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://advantive.my.site.com/support/s/knowledge",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-25181"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-25181",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "medium",
+        "published_date": "2025-03-10"
+      },
+      {
+        "vendor": "Advantive",
+        "advisory_id": "GHSA-6g37-4665-5v4w",
+        "url": "https://advantive.my.site.com/support/s/knowledge",
+        "severity": "medium",
+        "published_date": null
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Discovered in-the-wild by Intezer and Solis Security researchers while investigating XE Group intrusions; reported early Feb 2025. No AI tool credited. CISA KEV-listed 2025-03-10 (due 2025-03-31). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "payload_artifacts": [
+        "Unauthenticated SQL injection via the GET timeoutWarning.asp PmSess1 parameter (directly sqlmap-reproducible)",
+        "ASPX web shells planted after credential theft from the VeraCore database"
+      ],
+      "persistence_artifacts": [
+        "Long-dwell ASPX web shells — XE Group maintained access for years across manufacturing/distribution victims"
+      ],
+      "behavioral": [
+        "VeraCore process spawning an unexpected child (cmd.exe/powershell.exe/sh/webshell interpreter) shortly after an inbound request, indicating code execution through the vulnerable endpoint",
+        "Inbound exploitation attempts against VeraCore from KEV-tracked scanning infrastructure shortly after Advantive disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the VeraCore host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: Intezer + Solis Security XE Group intrusion reports (Feb 2025); Tenable WAS detection plugin 114935. Cross-referenced with NVD CVE-2025-25181 and the CISA KEV listing (added 2025-03-10)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 5.8 and CWE(s) CWE-89 retained; ATT&CK + IOCs derived from the SQL-Injection mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2024-50302": {
+    "name": "Linux Kernel Use of Uninitialized Resource Vulnerability",
+    "type": "Information-Disclosure",
+    "cvss_score": 5.5,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-04",
+    "cisa_kev_due_date": "2025-03-25",
+    "poc_available": false,
+    "poc_description": "In-the-wild exploitation was via Cellebrite's proprietary, non-public forensic chain. No public standalone weaponized PoC has been released; the kernel fix commit and Amnesty research brief describe the flaw and chain but provide no working reproducer.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "In-the-wild use discovered and attributed by Amnesty International Security Lab (with Google's Threat Analysis Group). The kernel fix landed Nov 2024 and the CVE was announced by Greg Kroah-Hartman (2024-11-19). No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Used in-the-wild as one link in a Cellebrite Android USB exploit chain to unlock a locked, seized device. Amnesty International Security Lab documented its use by Serbian authorities against a student activist's Samsung Galaxy A32 (seized Dec 2024); the chain enumerated emulated USB peripherals and used this bug to leak uninitialized kernel memory via crafted HID reports to defeat kernel protections. Google shipped the fix in the Android March 2025 security bulletin. Added to CISA KEV March 4, 2025.",
+    "affected": "Linux Kernel — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Affected: Linux kernel 3.12 up to the fix (commit 27ce405039bf)",
+      "Fixed: 4.19.324, 5.4.286, 5.10.230, 5.15.172, 6.1.117, 6.6.61, 6.11.8, 6.12; Android March 2025 patch level"
+    ],
+    "vector": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: zero-initialize the report buffer\n\nSince the report buffer is used by all kinds of drivers in various ways, let's\nzero-initialize it during allocation to make sure that it can't be ever used\nto leak kernel memory via specially-crafted report.",
+    "complexity": "high",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed information disclosure on Linux Kernel; CISA set a 2025-03-25 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited information disclosure on Linux Kernel the timescale must collapse to the CISA due date (2025-03-25) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this information disclosure on Linux Kernel until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited information disclosure on Linux Kernel demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this information disclosure on Linux Kernel was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1068",
+      "T1200"
+    ],
+    "rwep_score": 55,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=20. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.00809,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-50302",
+    "cwe_refs": [
+      "CWE-908"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://lore.kernel.org/linux-cve-announce/2024111908-CVE-2024-50302-f677@gregkh/",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-50302"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-50302",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "medium",
+        "published_date": "2025-03-04"
+      },
+      {
+        "vendor": "Linux",
+        "advisory_id": "CVE-2024-50302",
+        "url": "https://lore.kernel.org/linux-cve-announce/2024111908-CVE-2024-50302-f677@gregkh/",
+        "severity": "medium",
+        "published_date": "2024-11-19"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "In-the-wild use discovered and attributed by Amnesty International Security Lab (with Google's Threat Analysis Group). The kernel fix landed Nov 2024 and the CVE was announced by Greg Kroah-Hartman (2024-11-19). No AI tool credited. CISA KEV-listed 2025-03-04 (due 2025-03-25). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Outbound SMB/HTTP/file-read requests originating from the Kernel service account to attacker-controlled or unexpected destinations, indicating coerced authentication or arbitrary file read",
+        "Inbound exploitation attempts against Kernel from KEV-tracked scanning infrastructure shortly after Linux disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Kernel host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2024-50302, CISA KEV (added 2025-03-04), and the vendor advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 5.5 and CWE(s) CWE-908 retained; ATT&CK + IOCs derived from the Information-Disclosure mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2024-4885": {
+    "name": "Progress WhatsUp Gold Path Traversal Vulnerability",
+    "type": "RCE",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-03",
+    "cisa_kev_due_date": "2025-03-24",
+    "poc_available": true,
+    "poc_description": "Full working exploit published on GitHub by Sina Kheirkhah (@SinSinology, Summoning Team) at github.com/sinsinology/CVE-2024-4885 on Aug 30, 2024, with a technical writeup at summoning.team. Also mirrored on Sploitus.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Discovered by Sina Kheirkhah of Summoning Team with Trend Micro Zero Day Initiative (ZDI); reported to Progress Apr 24, 2024. No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Actively exploited beginning Aug 30, 2024 — within hours of the public PoC release. Trend Micro's MXDR team observed attacks abusing the legitimate WhatsUp Gold process (the iisapppool\\nmconsole context) to download and stage multiple remote-management tools (Atera, Radmin) as an initial-access foothold on internet-exposed instances. Unauthenticated, so mass opportunistic scanning followed. Added to CISA KEV March 3, 2025.",
+    "affected": "Progress WhatsUp Gold — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Affected: WhatsUp Gold before 2023.1.3",
+      "Fixed: 2023.1.3"
+    ],
+    "vector": "In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The \n\nWhatsUp.ExportUtilities.Export.GetFileWithoutZip\n\n\n\n allows execution of commands with iisapppool\\nmconsole privileges.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Progress WhatsUp Gold; CISA set a 2025-03-24 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited rce on Progress WhatsUp Gold the timescale must collapse to the CISA due date (2025-03-24) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this rce on Progress WhatsUp Gold until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited rce on Progress WhatsUp Gold demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this rce on Progress WhatsUp Gold was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 68,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.99288,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-4885",
+    "cwe_refs": [
+      "CWE-22"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-4885"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-4885",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-03-03"
+      },
+      {
+        "vendor": "Progress",
+        "advisory_id": "Progress WhatsUp Gold Security Bulletin June 2024",
+        "url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024",
+        "severity": "critical",
+        "published_date": "2024-06-25"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Discovered by Sina Kheirkhah of Summoning Team with Trend Micro Zero Day Initiative (ZDI); reported to Progress Apr 24, 2024. No AI tool credited. CISA KEV-listed 2025-03-03 (due 2025-03-24). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "payload_artifacts": [
+        "Unauthenticated path traversal via the 'folder' parameter to WhatsUp.ExportUtilities.Export.GetFileWithoutZip",
+        "The WhatsUp Gold app-pool identity (iisapppool\\\\nmconsole) spawning downloaded remote-management installers (Atera, Radmin)"
+      ],
+      "behavioral": [
+        "WhatsUp Gold process spawning an unexpected child (cmd.exe/powershell.exe/sh/webshell interpreter) shortly after an inbound request, indicating code execution through the vulnerable endpoint",
+        "Inbound exploitation attempts against WhatsUp Gold from KEV-tracked scanning infrastructure shortly after Progress disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the WhatsUp Gold host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: Public exploit github.com/sinsinology/CVE-2024-4885 (Summoning Team) + summoning.team writeup; Trend Micro MXDR incident reporting. Cross-referenced with NVD CVE-2024-4885 and the CISA KEV listing (added 2025-03-03)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-22 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2018-8639": {
+    "name": "Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability",
+    "type": "LPE",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-03",
+    "cisa_kev_due_date": "2025-03-24",
+    "poc_available": true,
+    "poc_description": "Public PoC/exploit code is available on GitHub, catalogued in the SecWiki/windows-kernel-exploits collection and other kernel-exploit aggregators. A compiled local-privilege-escalation exploit binary circulates for this CVE.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Not clearly credited in retrieved primary sources; the MSRC advisory does not publicly name a finder. Unconfirmed. No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Local kernel-mode elevation-of-privilege in win32k confirmed exploited in the wild and carried on CISA KEV with a known ransomware-campaign association. Successful exploitation yields arbitrary code execution in kernel mode (SYSTEM), the classic post-compromise step for disabling endpoint defenses, elevating payload privileges, and establishing persistence. Patched by Microsoft in the December 2018 Patch Tuesday; added to CISA KEV March 3, 2025.",
+    "affected": "Microsoft Windows — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Affected: Windows 7, 8.1, RT 8.1, 10 (multiple builds); Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019",
+      "Fixed: December 2018 security/cumulative updates"
+    ],
+    "vector": "An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka \"Win32k Elevation of Privilege Vulnerability.\" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8641.",
+    "complexity": "medium",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed lpe on Microsoft Windows; CISA set a 2025-03-24 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited lpe on Microsoft Windows the timescale must collapse to the CISA due date (2025-03-24) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this lpe on Microsoft Windows until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited lpe on Microsoft Windows demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this lpe on Microsoft Windows was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1068"
+    ],
+    "rwep_score": 79,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=24. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.22349,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2018-8639",
+    "cwe_refs": [
+      "CWE-404"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-8639",
+      "https://nvd.nist.gov/vuln/detail/CVE-2018-8639"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2018-8639",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-03"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2018-8639",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-8639",
+        "severity": "high",
+        "published_date": "2018-12-11"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Not clearly credited in retrieved primary sources; the MSRC advisory does not publicly name a finder. Unconfirmed. No AI tool credited. CISA KEV-listed 2025-03-03 (due 2025-03-24). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "kernel_trace": [
+        "Win32k use-after-free (improper resource release) exercised from a low-integrity process to execute in kernel mode as SYSTEM"
+      ],
+      "payload_artifacts": [
+        "Public local-privilege-escalation exploit binary from the SecWiki windows-kernel-exploits collection"
+      ],
+      "behavioral": [
+        "A low-privileged process on the host gaining SYSTEM/root or bypassing a security control immediately after loading a crafted object/file, indicating local privilege escalation",
+        "Inbound exploitation attempts against Windows from KEV-tracked scanning infrastructure shortly after Microsoft disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Windows host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: github.com/SecWiki/windows-kernel-exploits (public LPE exploit); CISA KEV known-ransomware association. Cross-referenced with NVD CVE-2018-8639 and the CISA KEV listing (added 2025-03-03)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 7.8 and CWE(s) CWE-404 retained; ATT&CK + IOCs derived from the LPE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2022-43769": {
+    "name": "Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability",
+    "type": "RCE",
+    "cvss_score": 8.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-03",
+    "cisa_kev_due_date": "2025-03-24",
+    "poc_available": true,
+    "poc_description": "Weaponized Metasploit module exploit/multi/http/pentaho_business_server_authbypass_and_ssti (Rapid7, May 2023) chains both CVEs to a shell; standalone exploit also on Packet Storm (172296).",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Discovered and disclosed by Harry Withington of Aon's Cyber Solutions ('Pentah0wnage'); Metasploit module by jheysel-r7 (Rapid7). No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-listed (added March 3, 2025); confirmed exploited in the wild. This special-element/template injection is the code-execution half of a two-bug chain with the auth-bypass CVE-2022-43939, together yielding unauthenticated RCE as the Pentaho service user on internet-exposed BA Servers. A public Metasploit module and Packet Storm exploit (from Aon's 'Pentah0wnage' research) sharply lowered the barrier. No specific named threat actor confirmed in primary sources.",
+    "affected": "Hitachi Vantara Pentaho Business Analytics (BA) Server — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Affected: Pentaho BA Server before 9.4.0.1 and 9.3.0.2, including 8.3.x",
+      "Fixed: 9.4.0.1 and 9.3.0.2"
+    ],
+    "vector": "Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Hitachi Vantara Pentaho Business Analytics (BA) Server; CISA set a 2025-03-24 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited rce on Hitachi Vantara Pentaho Business Analytics (BA) Server the timescale must collapse to the CISA due date (2025-03-24) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this rce on Hitachi Vantara Pentaho Business Analytics (BA) Server until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited rce on Hitachi Vantara Pentaho Business Analytics (BA) Server demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this rce on Hitachi Vantara Pentaho Business Analytics (BA) Server was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 65,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 15,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=15. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.9767,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2022-43769",
+    "cwe_refs": [
+      "CWE-74",
+      "CWE-94"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://support.pentaho.com/hc/en-us/articles/14455561548301",
+      "https://nvd.nist.gov/vuln/detail/CVE-2022-43769"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2022-43769",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-03"
+      },
+      {
+        "vendor": "Hitachi Vantara",
+        "advisory_id": "CVE-2022-43769",
+        "url": "https://support.pentaho.com/hc/en-us/articles/14455561548301",
+        "severity": "high",
+        "published_date": null
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Discovered and disclosed by Harry Withington of Aon's Cyber Solutions ('Pentah0wnage'); Metasploit module by jheysel-r7 (Rapid7). No AI tool credited. CISA KEV-listed 2025-03-03 (due 2025-03-24). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "payload_artifacts": [
+        "Server-side special-element/template injection via the 'url' parameter to /api/ldap/config/ldapTreeNodeChildren on the Pentaho BA Server"
+      ],
+      "c2_indicators": [
+        "Metasploit module exploit/multi/http/pentaho_business_server_authbypass_and_ssti staging a shell as the Pentaho service user"
+      ],
+      "behavioral": [
+        "Pentaho Business Analytics (BA) Server process spawning an unexpected child (cmd.exe/powershell.exe/sh/webshell interpreter) shortly after an inbound request, indicating code execution through the vulnerable endpoint",
+        "Inbound exploitation attempts against Pentaho Business Analytics (BA) Server from KEV-tracked scanning infrastructure shortly after Hitachi Vantara disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Pentaho Business Analytics (BA) Server host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: Rapid7 Metasploit module + Packet Storm exploit 172296 (from Aon 'Pentah0wnage' research). Cross-referenced with NVD CVE-2022-43769 and the CISA KEV listing (added 2025-03-03)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-74/CWE-94 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2022-43939": {
+    "name": "Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability",
+    "type": "Authorization-Bypass",
+    "cvss_score": 8.6,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-03",
+    "cisa_kev_due_date": "2025-03-24",
+    "poc_available": true,
+    "poc_description": "Covered by the same weaponized Metasploit module exploit/multi/http/pentaho_business_server_authbypass_and_ssti (Rapid7) and the Packet Storm exploit (172296), which use this bug to bypass auth before triggering the injection.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Discovered and disclosed by Harry Withington of Aon's Cyber Solutions ('Pentah0wnage'); Metasploit module by jheysel-r7 (Rapid7). No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "KEV-listed (added March 3, 2025); confirmed exploited in the wild. This is the authentication-bypass half of the Pentaho chain: a non-canonical-URL authorization bypass that grants unauthenticated access to protected endpoints, then combined with the special-element injection CVE-2022-43769 for pre-auth RCE as the Pentaho service user. The public Metasploit module weaponizes both together. No specific named threat actor confirmed in primary sources.",
+    "affected": "Hitachi Vantara Pentaho Business Analytics (BA) Server — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Affected: Pentaho BA Server before 9.4.0.1 and 9.3.0.2, including 8.3.x",
+      "Fixed: 9.4.0.1 and 9.3.0.2"
+    ],
+    "vector": "Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed authorization bypass on Hitachi Vantara Pentaho Business Analytics (BA) Server; CISA set a 2025-03-24 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited authorization bypass on Hitachi Vantara Pentaho Business Analytics (BA) Server the timescale must collapse to the CISA due date (2025-03-24) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this authorization bypass on Hitachi Vantara Pentaho Business Analytics (BA) Server until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited authorization bypass on Hitachi Vantara Pentaho Business Analytics (BA) Server demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this authorization bypass on Hitachi Vantara Pentaho Business Analytics (BA) Server was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1078"
+    ],
+    "rwep_score": 65,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 15,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=15. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.92266,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2022-43939",
+    "cwe_refs": [
+      "CWE-647"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://support.pentaho.com/hc/en-us/articles/14455394120333",
+      "https://nvd.nist.gov/vuln/detail/CVE-2022-43939"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2022-43939",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-03-03"
+      },
+      {
+        "vendor": "Hitachi Vantara",
+        "advisory_id": "CVE-2022-43939",
+        "url": "https://support.pentaho.com/hc/en-us/articles/14455394120333",
+        "severity": "high",
+        "published_date": null
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Discovered and disclosed by Harry Withington of Aon's Cyber Solutions ('Pentah0wnage'); Metasploit module by jheysel-r7 (Rapid7). No AI tool credited. CISA KEV-listed 2025-03-03 (due 2025-03-24). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "payload_artifacts": [
+        "Non-canonical URL path (permissive suffix match, e.g. a crafted '/require...js' tail) routing around the authorization filter to reach protected Pentaho endpoints unauthenticated, chained with CVE-2022-43769 for pre-auth RCE"
+      ],
+      "behavioral": [
+        "Successful authenticated actions on Pentaho Business Analytics (BA) Server from a session that never completed a legitimate credential/MFA challenge, indicating an authentication or authorization bypass",
+        "Inbound exploitation attempts against Pentaho Business Analytics (BA) Server from KEV-tracked scanning infrastructure shortly after Hitachi Vantara disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Pentaho Business Analytics (BA) Server host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: Rapid7 Metasploit module + Packet Storm exploit 172296 (from Aon 'Pentah0wnage' research). Cross-referenced with NVD CVE-2022-43939 and the CISA KEV listing (added 2025-03-03)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.6 and CWE(s) CWE-647 retained; ATT&CK + IOCs derived from the Authorization-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2023-20118": {
+    "name": "Cisco Small Business RV Series Routers Command Injection Vulnerability",
+    "type": "Command-Injection",
+    "cvss_score": 6.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-03-03",
+    "cisa_kev_due_date": "2025-03-24",
+    "poc_available": true,
+    "poc_description": "CVE aggregators list ~3 public GitHub PoCs for the command-injection primitive; the flaw requires valid administrative credentials (PR:H) but the injection technique is public. No single vendor/Metasploit module confirmed.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Reported to Cisco by Wang Jincheng of the X1cT34m Laboratory, Nanjing University of Posts and Telecommunications. In-the-wild exploitation attributed to PolarEdge botnet operators (Sekoia). No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Exploited by the PolarEdge botnet, an ORB/relay IoT botnet first detailed by Sekoia in Feb 2025. Operators use a shell script named 'q' to drop a TLS-encrypted backdoor onto end-of-life Cisco Small Business RV routers, enrolling them (alongside compromised ASUS, QNAP, and Synology devices) into a network that grew to an estimated ~25,000 devices for relaying, DDoS, and lateral movement. Because the RV series is EoL, Cisco will not patch. Added to CISA KEV March 3, 2025.",
+    "affected": "Cisco Small Business RV Series Routers — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Affected: Cisco Small Business RV016, RV042, RV042G, RV082, RV320, RV325 routers (all firmware; end-of-life)",
+      "Fixed: none — EoL, no software update will be released"
+    ],
+    "vector": "A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device.\r\n\r This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to gain root-level privileges and access unauthorized data. To exploit this vulnerability, an attacker would need to have valid administrative credentials on the affected device.\r\n\r Cisco has not and will not release software updates that address this vulnerability.   However, administrators may disable the affected feature as described in the Workarounds [\"#workarounds\"] section.\r\n\r  {{value}} [\"%7b%7bvalue%7d%7d\"])}]]",
+    "complexity": "medium",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.",
+    "patch_available": false,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "No vendor patch is available (end-of-life); apply compensating controls or discontinue use of the product per CISA guidance."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed command injection on Cisco Small Business RV Series Routers; no vendor patch exists (end-of-life product); the CISA 2025-03-24 due date demands compensating controls or decommissioning, not a patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited command injection on Cisco Small Business RV Series Routers the timescale must collapse to the CISA due date (2025-03-24) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this command injection on Cisco Small Business RV Series Routers until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited command injection on Cisco Small Business RV Series Routers demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this command injection on Cisco Small Business RV Series Routers was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 83,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": 0,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.53827,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-20118",
+    "cwe_refs": [
+      "CWE-77"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5",
+      "https://nvd.nist.gov/vuln/detail/CVE-2023-20118"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2023-20118",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "medium",
+        "published_date": "2025-03-03"
+      },
+      {
+        "vendor": "Cisco",
+        "advisory_id": "cisco-sa-sbr042-multi-vuln-ej76Pke5",
+        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5",
+        "severity": "medium",
+        "published_date": "2023-04-12"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Reported to Cisco by Wang Jincheng of the X1cT34m Laboratory, Nanjing University of Posts and Telecommunications. In-the-wild exploitation attributed to PolarEdge botnet operators (Sekoia). No AI tool credited. CISA KEV-listed 2025-03-03 (due 2025-03-24). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "payload_artifacts": [
+        "Authenticated command injection in the Cisco RV web management interface executing OS commands as root",
+        "Shell script named 'q' dropping a TLS-encrypted 'PolarEdge' backdoor onto end-of-life RV016/042/082/320/325 routers"
+      ],
+      "persistence_artifacts": [
+        "PolarEdge backdoor enrolling the router into an ORB/relay botnet (grew to an estimated ~25,000 devices)"
+      ],
+      "behavioral": [
+        "Small Business RV Series Routers process spawning an unexpected child (cmd.exe/powershell.exe/sh/webshell interpreter) shortly after an inbound request, indicating code execution through the vulnerable endpoint",
+        "Inbound exploitation attempts against Small Business RV Series Routers from KEV-tracked scanning infrastructure shortly after Cisco disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Small Business RV Series Routers host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: Sekoia PolarEdge botnet report (Feb 2025). Cross-referenced with NVD CVE-2023-20118 and the CISA KEV listing (added 2025-03-03)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 6.5 and CWE(s) CWE-77 retained; ATT&CK + IOCs derived from the Command-Injection mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2023-34192": {
+    "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability",
+    "type": "XSS",
+    "cvss_score": 9,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-02-25",
+    "cisa_kev_due_date": "2025-03-18",
+    "poc_available": false,
+    "poc_description": "No public standalone weaponized PoC located. Exploitation was in-the-wild-only (Google TAG); no ExploitDB/Metasploit/GitHub reproducer specific to CVE-2023-34192 was found.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Clement Lecigne, Google Threat Analysis Group (reported to Zimbra as an actively-exploited zero-day). No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "Discovered as an in-the-wild zero-day by Google's Threat Analysis Group during a campaign of targeted espionage against government and diplomatic Zimbra users; TAG researcher Clement Lecigne reported it after observing exploitation. The stored/reflected XSS against the /h/autoSaveDraft endpoint was used to steal email data and hijack authenticated webmail sessions. Actively exploited in July 2023 before the patch; CISA added it to KEV on 2025-02-25. Requires a victim to view attacker-planted draft content, consistent with spearphishing-style targeting.",
+    "affected": "Synacor Zimbra Collaboration Suite (ZCS) — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Zimbra Collaboration Suite (ZCS) 8.8.15 up to and including Patch 40; fixed in 8.8.15 Patch 41 (no service restart required)"
+    ],
+    "vector": "Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.",
+    "complexity": "medium",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed xss on Synacor Zimbra Collaboration Suite (ZCS); CISA set a 2025-03-18 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited xss on Synacor Zimbra Collaboration Suite (ZCS) the timescale must collapse to the CISA due date (2025-03-18) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this xss on Synacor Zimbra Collaboration Suite (ZCS) until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited xss on Synacor Zimbra Collaboration Suite (ZCS) demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this xss on Synacor Zimbra Collaboration Suite (ZCS) was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1189",
+      "T1539"
+    ],
+    "rwep_score": 46,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 16,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=16. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.77266,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-34192",
+    "cwe_refs": [
+      "CWE-79"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories",
+      "https://nvd.nist.gov/vuln/detail/CVE-2023-34192"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2023-34192",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-02-25"
+      },
+      {
+        "vendor": "Synacor",
+        "advisory_id": "ZCS 8.8.15 Patch 41",
+        "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories",
+        "severity": "critical",
+        "published_date": "2023-07-26"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Clement Lecigne, Google Threat Analysis Group (reported to Zimbra as an actively-exploited zero-day). No AI tool credited. CISA KEV-listed 2025-02-25 (due 2025-03-18). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Zimbra Collaboration Suite (ZCS) webmail/app rendering attacker-supplied script in another user's authenticated session, followed by session-token exfiltration to an external host",
+        "Inbound exploitation attempts against Zimbra Collaboration Suite (ZCS) from KEV-tracked scanning infrastructure shortly after Synacor disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Zimbra Collaboration Suite (ZCS) host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2023-34192, CISA KEV (added 2025-02-25), and the vendor advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9 and CWE(s) CWE-79 retained; ATT&CK + IOCs derived from the XSS mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2024-49035": {
+    "name": "Microsoft Partner Center Improper Access Control Vulnerability",
+    "type": "Privilege-Escalation",
+    "cvss_score": 8.7,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-02-25",
+    "cisa_kev_due_date": "2025-03-18",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC. It is a cloud/SaaS service flaw fixed server-side by Microsoft; exploitation details are private and no ExploitDB/Metasploit/GitHub reproducer exists.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Exploitation detected by Microsoft; the specific reporting researcher is not named in publicly accessible sources. No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "An improper-access-control/privilege-escalation flaw in the partner.microsoft.com (Partner Center) web application, which sits on a Power Apps backend used by MSPs and enterprises to manage cloud services and customer tenants. Microsoft confirmed it detected exploitation in the wild but has not published attribution, delivery, or victim specifics. CISA added it to KEV on 2025-02-25 with a 2025-03-18 remediation deadline. Because Partner Center brokers access to downstream customer tenants, successful privilege escalation carries lateral-movement/supply-chain risk.",
+    "affected": "Microsoft Partner Center — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Microsoft Partner Center (partner.microsoft.com online service) prior to the November 2024 server-side fix; remediated automatically in the cloud service"
+    ],
+    "vector": "An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed privilege escalation on Microsoft Partner Center; CISA set a 2025-03-18 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited privilege escalation on Microsoft Partner Center the timescale must collapse to the CISA due date (2025-03-18) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this privilege escalation on Microsoft Partner Center until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited privilege escalation on Microsoft Partner Center demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this privilege escalation on Microsoft Partner Center was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1068",
+      "T1078"
+    ],
+    "rwep_score": 47,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 17,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=17. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.01339,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-49035",
+    "cwe_refs": [
+      "CWE-269"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49035",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-49035"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-49035",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-02-25"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2024-49035",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49035",
+        "severity": "high",
+        "published_date": "2024-11-25"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Exploitation detected by Microsoft; the specific reporting researcher is not named in publicly accessible sources. No AI tool credited. CISA KEV-listed 2025-02-25 (due 2025-03-18). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "A low-privileged process on the host gaining SYSTEM/root or bypassing a security control immediately after loading a crafted object/file, indicating local privilege escalation",
+        "Inbound exploitation attempts against Partner Center from KEV-tracked scanning infrastructure shortly after Microsoft disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Partner Center host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2024-49035, CISA KEV (added 2025-02-25), and the vendor advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.7 and CWE(s) CWE-269 retained; ATT&CK + IOCs derived from the Privilege-Escalation mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2024-20953": {
+    "name": "Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability",
+    "type": "RCE",
+    "cvss_score": 8.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-02-24",
+    "cisa_kev_due_date": "2025-03-17",
+    "poc_available": false,
+    "poc_description": "No public weaponized PoC found. ZDI-24-096 documents the ExportServlet deserialization root cause but ships no exploit; no ExploitDB/Metasploit/GitHub reproducer specific to CVE-2024-20953 was located.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Reported through Trend Micro Zero Day Initiative (ZDI-24-096); ZDI credits the researcher alias 'nexteam'. No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "A Java deserialization RCE in the Oracle Agile PLM ExportServlet, patched in Oracle's January 2024 Critical Patch Update and reported via Trend Micro ZDI. CISA added it to KEV on 2025-02-24 (due 2025-03-17) citing confirmed in-the-wild exploitation, roughly a year after the patch. Because exploitation requires low-privileged authentication, it is most plausibly used as a post-initial-access step for code execution/takeover of the PLM host. No public threat-actor attribution has been published.",
+    "affected": "Oracle Agile Product Lifecycle Management (PLM) — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Oracle Agile PLM 9.3.6 (Export component); fixed by the January 2024 CPU"
+    ],
+    "vector": "Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Oracle Agile Product Lifecycle Management (PLM); CISA set a 2025-03-17 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited rce on Oracle Agile Product Lifecycle Management (PLM) the timescale must collapse to the CISA due date (2025-03-17) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this rce on Oracle Agile Product Lifecycle Management (PLM) until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited rce on Oracle Agile Product Lifecycle Management (PLM) demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this rce on Oracle Agile Product Lifecycle Management (PLM) was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 44,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 14,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=14. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.03405,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-20953",
+    "cwe_refs": [
+      "CWE-502"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.oracle.com/security-alerts/cpujan2024.html",
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-20953"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2024-20953",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-02-24"
+      },
+      {
+        "vendor": "Oracle",
+        "advisory_id": "Oracle CPU January 2024 (ZDI-24-096)",
+        "url": "https://www.oracle.com/security-alerts/cpujan2024.html",
+        "severity": "high",
+        "published_date": "2024-01-16"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Reported through Trend Micro Zero Day Initiative (ZDI-24-096); ZDI credits the researcher alias 'nexteam'. No AI tool credited. CISA KEV-listed 2025-02-24 (due 2025-03-17). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Agile Product Lifecycle Management (PLM) process spawning an unexpected child (cmd.exe/powershell.exe/sh/webshell interpreter) shortly after an inbound request, indicating code execution through the vulnerable endpoint",
+        "Inbound exploitation attempts against Agile Product Lifecycle Management (PLM) from KEV-tracked scanning infrastructure shortly after Oracle disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Agile Product Lifecycle Management (PLM) host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2024-20953, CISA KEV (added 2025-02-24), and the vendor advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2017-3066": {
+    "name": "Adobe ColdFusion Deserialization Vulnerability",
+    "type": "RCE",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-02-24",
+    "cisa_kev_due_date": "2025-03-17",
+    "poc_available": true,
+    "poc_description": "Multiple public weaponized PoCs: ExploitDB #43993 (BlazeDS Java Object Deserialization RCE), the depthsecurity/coldfusion_blazeds_des GitHub exploit, the 'ColdFusionPwn' AMF payload generator (ysoserial-based), and a vulhub reproducible lab.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Reported to Adobe by Markus Wulftange of Code White GmbH. No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "An unauthenticated Java deserialization RCE in the Apache BlazeDS AMF handling used by Adobe ColdFusion, patched by Adobe in April 2017 (APSB17-14). Long a favorite of opportunistic and targeted actors against internet-exposed ColdFusion servers because it is pre-auth and has mature public tooling; CISA added it to KEV on 2025-02-24 (due 2025-03-17) reaffirming ongoing exploitation. Typically leveraged for webshell drops and server takeover of legacy ColdFusion deployments.",
+    "affected": "Adobe ColdFusion — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "ColdFusion 2016 Update 3 and earlier (fixed: Update 4)",
+      "ColdFusion 11 Update 11 and earlier (fixed: Update 12)",
+      "ColdFusion 10 Update 22 and earlier (fixed: Update 23)"
+    ],
+    "vector": "Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Adobe ColdFusion; CISA set a 2025-03-17 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited rce on Adobe ColdFusion the timescale must collapse to the CISA due date (2025-03-17) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this rce on Adobe ColdFusion until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited rce on Adobe ColdFusion demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this rce on Adobe ColdFusion was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 68,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.90597,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2017-3066",
+    "cwe_refs": [
+      "CWE-502"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html",
+      "https://nvd.nist.gov/vuln/detail/CVE-2017-3066"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2017-3066",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "critical",
+        "published_date": "2025-02-24"
+      },
+      {
+        "vendor": "Adobe",
+        "advisory_id": "APSB17-14",
+        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html",
+        "severity": "critical",
+        "published_date": "2017-04-25"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Reported to Adobe by Markus Wulftange of Code White GmbH. No AI tool credited. CISA KEV-listed 2025-02-24 (due 2025-03-17). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "payload_artifacts": [
+        "Crafted AMF/BlazeDS message carrying a malicious serialized Java object (ysoserial gadget chain) to the ColdFusion Flex/BlazeDS endpoint",
+        "Web shell drops on internet-exposed ColdFusion after deserialization RCE"
+      ],
+      "behavioral": [
+        "ColdFusion process spawning an unexpected child (cmd.exe/powershell.exe/sh/webshell interpreter) shortly after an inbound request, indicating code execution through the vulnerable endpoint",
+        "Inbound exploitation attempts against ColdFusion from KEV-tracked scanning infrastructure shortly after Adobe disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the ColdFusion host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: ExploitDB #43993; github.com/depthsecurity/coldfusion_blazeds_des; the 'ColdFusionPwn' AMF payload generator; vulhub reproducible lab. Cross-referenced with NVD CVE-2017-3066 and the CISA KEV listing (added 2025-02-24)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2025-24989": {
+    "name": "Microsoft Power Pages Improper Access Control Vulnerability",
+    "type": "Improper-Access-Control",
+    "cvss_score": 8.2,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-02-21",
+    "cisa_kev_due_date": "2025-03-14",
+    "poc_available": false,
+    "poc_description": "No public standalone PoC. SaaS flaw remediated server-side by Microsoft; no ExploitDB/Metasploit/GitHub reproducer exists and exploitation specifics are private.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Credited by Microsoft to Raj Kumar (Microsoft); exploitation also detected in the wild. No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "An improper-access-control flaw in Microsoft Power Pages (low-code SaaS website platform) that let unauthenticated attackers bypass user-registration controls and gain elevated privileges to reach otherwise-restricted site data. Microsoft disclosed it on 2025-02-19 stating it had been exploited in the wild; the flaw was already mitigated service-side and affected customers were individually notified and given cleanup/review guidance. CISA added it to KEV on 2025-02-21 (due 2025-03-14). No public threat-actor attribution.",
+    "affected": "Microsoft Power Pages — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "Microsoft Power Pages service prior to the February 2025 fix; mitigated in the service, affected customers notified individually"
+    ],
+    "vector": "An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.\nThis vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.",
+    "complexity": "low",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed improper access control on Microsoft Power Pages; CISA set a 2025-03-14 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited improper access control on Microsoft Power Pages the timescale must collapse to the CISA due date (2025-03-14) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this improper access control on Microsoft Power Pages until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited improper access control on Microsoft Power Pages demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this improper access control on Microsoft Power Pages was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1078"
+    ],
+    "rwep_score": 46,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 16,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=16. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.01659,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24989",
+    "cwe_refs": [
+      "CWE-284"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24989",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-24989"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-24989",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "high",
+        "published_date": "2025-02-21"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2025-24989",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24989",
+        "severity": "high",
+        "published_date": "2025-02-19"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Credited by Microsoft to Raj Kumar (Microsoft); exploitation also detected in the wild. No AI tool credited. CISA KEV-listed 2025-02-21 (due 2025-03-14). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "behavioral": [
+        "Successful authenticated actions on Power Pages from a session that never completed a legitimate credential/MFA challenge, indicating an authentication or authorization bypass",
+        "Inbound exploitation attempts against Power Pages from KEV-tracked scanning infrastructure shortly after Microsoft disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the Power Pages host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2025-24989, CISA KEV (added 2025-02-21), and the vendor advisory recorded in vendor_advisories."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.2 and CWE(s) CWE-284 retained; ATT&CK + IOCs derived from the Improper-Access-Control mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+  },
+  "CVE-2025-0111": {
+    "name": "Palo Alto Networks PAN-OS File Read Vulnerability",
+    "type": "Information-Disclosure",
+    "cvss_score": 6.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-02-20",
+    "cisa_kev_due_date": "2025-03-13",
+    "poc_available": true,
+    "poc_description": "Public exploitation tooling exists for the chain: Assetnote published a full technical writeup and PoC for the paired CVE-2025-0108 auth bypass (which supplies the unauthenticated context to reach 0111's file read), and public GitHub PoCs for CVE-2025-0108 enable the 0108+0111 arbitrary-file-read chain. Standalone, the 0111 file read requires authentication.",
+    "ai_discovered": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_notes": "Credited by Palo Alto to Emilio Gonzalez, Maxime Gaudreault, and the Palo Alto Networks Deep Product Security Research Team (internal discovery). No AI tool credited.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
+    "active_exploitation": "confirmed",
+    "active_exploitation_notes": "An authenticated arbitrary file-read on the PAN-OS management web interface (files readable by the 'nobody' user), disclosed/patched by Palo Alto on 2025-02-12 (PAN-273994). Attackers quickly chained it with the CVE-2025-0108 authentication bypass (and, on older builds, CVE-2024-9474) to read config backups, credential/hash and key material without valid credentials on exposed management interfaces; Palo Alto Unit 42/PSIRT observed the chained attacks in the wild and GreyNoise tracked 25+ malicious source IPs from ~Feb 13, 2025. Palo Alto raised the rating to high urgency after exploitation escalated. CISA added it to KEV on 2025-02-20 (due 2025-03-13).",
+    "affected": "Palo Alto Networks PAN-OS — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected_versions": [
+      "PAN-OS 10.1 < 10.1.14-h9",
+      "PAN-OS 10.2 < 10.2.7-h24 (and later h-trains)",
+      "PAN-OS 11.1 < 11.1.2-h18 (and later h-trains)",
+      "PAN-OS 11.2 < 11.2.4-h4 / 11.2.5",
+      "PAN-OS 11.0 is EOL / not listed as fixed"
+    ],
+    "vector": "An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.\n\nYou can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nThis issue does not affect Cloud NGFW or Prisma Access software.",
+    "complexity": "medium",
+    "complexity_notes": "Weaponized and KEV-listed; treat as operationally exploitable. Derived from the NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
+    "vendor_update_paths": [
+      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed information disclosure on Palo Alto Networks PAN-OS; CISA set a 2025-03-13 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
+      "ISO-27001-2022-A.8.8": "A.8.8 leaves \"appropriate timescales\" undefined; for an actively-exploited information disclosure on Palo Alto Networks PAN-OS the timescale must collapse to the CISA due date (2025-03-13) rather than the organization's normal vulnerability-management cadence.",
+      "AU-Essential-8-Patch": "Essential Eight patch maturity is scored on cadence, not on KEV-anchored emergency response; a compliant maturity-level-2 org on its normal cycle remains exposed to this information disclosure on Palo Alto Networks PAN-OS until its next window.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Art. 21 vulnerability-handling is satisfied on paper by a documented procedure; it does not by itself force the KEV-indexed emergency SLA this actively-exploited information disclosure on Palo Alto Networks PAN-OS demands.",
+      "UK-CAF-B4": "CAF B4 (system security) is recorded as met by \"patches applied in a managed cycle\"; the managed cycle itself is the gap here — this information disclosure on Palo Alto Networks PAN-OS was exploited before a normal cycle would have reached it."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1083"
+    ],
+    "rwep_score": 77,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
+    "epss_score": 0.01862,
+    "epss_date": "2026-07-03",
+    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-0111",
+    "cwe_refs": [
+      "CWE-73",
+      "CWE-610"
+    ],
+    "source_verified": "2026-07-03",
+    "verification_sources": [
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://security.paloaltonetworks.com/CVE-2025-0111",
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-0111"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "CISA KEV",
+        "advisory_id": "CVE-2025-0111",
+        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+        "severity": "medium",
+        "published_date": "2025-02-20"
+      },
+      {
+        "vendor": "Palo Alto Networks",
+        "advisory_id": "PAN-273994",
+        "url": "https://security.paloaltonetworks.com/CVE-2025-0111",
+        "severity": "medium",
+        "published_date": "2025-02-12"
+      }
+    ],
+    "last_updated": "2026-07-03",
+    "discovery_attribution_note": "Credited by Palo Alto to Emilio Gonzalez, Maxime Gaudreault, and the Palo Alto Networks Deep Product Security Research Team (internal discovery). No AI tool credited. CISA KEV-listed 2025-02-20 (due 2025-03-13). Curated 2026-07-03 from the NVD record, the CISA KEV catalog, and the vendor advisory; not AI-discovered.",
+    "iocs": {
+      "host_recon": [
+        "Crafted request to the PAN-OS management web interface reading arbitrary files accessible to the 'nobody' user (config backups, credential/hash and key material)"
+      ],
+      "payload_artifacts": [
+        "Chained with the CVE-2025-0108 authentication bypass to reach the arbitrary file read without valid credentials"
+      ],
+      "c2_indicators": [
+        "GreyNoise-tracked malicious source IPs scanning PAN-OS management interfaces from ~2025-02-13"
+      ],
+      "behavioral": [
+        "Outbound SMB/HTTP/file-read requests originating from the PAN-OS service account to attacker-controlled or unexpected destinations, indicating coerced authentication or arbitrary file read",
+        "Inbound exploitation attempts against PAN-OS from KEV-tracked scanning infrastructure shortly after Palo Alto Networks disclosure, correlated with the CVE's published request signature",
+        "New persistence artifacts (web shell, scheduled task, service, or account) appearing on the PAN-OS host with no corresponding change-management record"
+      ],
+      "_ioc_source_note": "Extracted from a line-level review of the published PoC / primary-source campaign report: Assetnote CVE-2025-0108 technical writeup + public GitHub PoC for the 0108 auth bypass enabling the 0108+0111 file-read chain. Cross-referenced with NVD CVE-2025-0111 and the CISA KEV listing (added 2025-02-20)."
+    },
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.",
+    "_draft": false,
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 6.5 and CWE(s) CWE-73/CWE-610 retained; ATT&CK + IOCs derived from the Information-Disclosure mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+  },
   "CVE-2022-23812": {
     "name": "node-ipc geo-targeted file-wiper protestware (RU/BY heart-emoji overwrite; peacenotwar dropper in 11.0.0+)",
     "type": "supply-chain-protestware-wiper",