@blamejs/exceptd-skills 0.21.2 → 0.21.3

package/data/cve-catalog.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "last_updated": "2026-08-22",
+    "last_updated": "2026-09-24",
     "source": "NVD + CISA KEV + vendor advisories — see sources/index.json",
     "required_fields": [
       "type",
@@ -93,6 +93,3544 @@
     },
     "last_threat_review": "2026-05-30"
   },
+  "CVE-2026-93952": {
+    "name": "Arista VeloCloud Orchestrator Improper Input Validation Vulnerability",
+    "cvss_score": 9.5,
+    "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
+    "cwe_refs": [
+      "CWE-20"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-09-22",
+    "cisa_kev_due_date": "2026-09-25",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "high",
+    "vector": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.",
+    "epss_score": 0.00741,
+    "epss_percentile": 0.53212,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-93952",
+    "vendor_advisories": [
+      {
+        "vendor": "Arista",
+        "advisory_id": "24765-security-advisory-0183",
+        "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183",
+        "severity": "critical",
+        "published_date": "2026-09-22"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-93952",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.",
+    "type": "input-validation-to-rce",
+    "blast_radius": 18,
+    "poc_available": false,
+    "poc_description": "No public working exploit code was found. No Exploit-DB entry, Metasploit module, ProjectDiscovery nuclei template or named GitHub repository for CVE-2026-93952 was located, and no exploit repository was read. Arista states the flaw was discovered externally and is actively exploited, but publishes indicators of compromise rather than exploit code.",
+    "iocs": {
+      "behavioral": [
+        "Requests to the VeloCloud Orchestrator web interface with unusual URL-like path components, encoded characters, references to local or internal services, or an unusually high request rate",
+        "Unexpected outbound HTTP or HTTPS activity originating from the VCO host, or connections to addresses that are not part of normal orchestrator operation",
+        "Sensitive configuration changes, privileged maintenance actions, database exports or archive creation on the VCO that do not correspond to a known administrator action"
+      ],
+      "network": [
+        "An x-vc-opt HTTP header appearing in the VCO nginx access logs",
+        "Inbound connections to the VCO web interface from the addresses 142.93.149.77 or 104.248.126.159, or from any source that is not a trusted administrative network",
+        "Outbound connections from the VCO host to hosts that are not managed VeloCloud Edge devices or known destinations"
+      ],
+      "host": [
+        "The files /usr/local/sbin/.vcnode.js or /usr/local/sbin/vc-sysmond on the VCO host (the advisory records the md5 dc78e206eaeadec59fc5801fe4556bd0 for a known malicious file)",
+        "The systemd unit file /etc/systemd/system/vc-sysmon.service on the VCO host",
+        "Unexpected command execution, file creation or database export artifacts, or access to VCO database contents, configuration, device inventory, credentials, certificates or key material outside expected workflows"
+      ],
+      "_ioc_source_note": "The file paths /usr/local/sbin/.vcnode.js and /usr/local/sbin/vc-sysmond, the md5 dc78e206eaeadec59fc5801fe4556bd0, the systemd unit /etc/systemd/system/vc-sysmon.service, the x-vc-opt nginx header and the source addresses 142.93.149.77 and 104.248.126.159 are the vendor's indicators of compromise in Arista Security Advisory 0183 at https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183, which was read as advisory text only; no exploit repository was read because none was found. The log-anomaly, outbound-connection and unexpected-command entries are the advisory's hunting guidance. The two source addresses are the only network indicators the advisory lists, and no wider actor infrastructure or C2 address is asserted, because no source reviewed attributes this CVE to a named campaign or operator."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Arista Security Advisory 0183 states the issue was discovered externally and is known to be actively exploited; no reporter is named, and no source claims AI tooling found or built the exploit.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2026-93952 (CWE-20, CVSS 10.0) + CISA KEV (added 2026-09-22) + Arista Security Advisory 0183. Discovered externally per Arista; no reporter is named.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2026-93952 to KEV on 2026-09-22 (due 2026-09-25) and Arista states the flaw was discovered externally and is actively exploited; the advisory lists indicators of compromise including the files /usr/local/sbin/.vcnode.js and /usr/local/sbin/vc-sysmond, the systemd unit vc-sysmon.service, an x-vc-opt header in nginx logs and connections from 142.93.149.77 and 104.248.126.159, but names no campaign or actor. Forensic triage is flagged in the KEV entry, so under CISA BOD 26-04 agencies bound by the directive must capture evidence and check for compromise before remediation.",
+    "attack_refs": [
+      "T1190",
+      "T1505.003",
+      "T1543.002",
+      "T1071.001"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-10": "SI-10 input validation is written as a check at the trust boundary, but this flaw is improper input validation inside the boundary: a network request the interface accepts as well-formed is routed to privileged internal functionality it should never reach. An SI-10 program that validates the request's length and character class does not test whether an accepted request can drive a privileged action on the VCO host.",
+      "NIS2-Art21-network-security": "NIS2 Article 21(2)(e) requires an essential or important entity to handle vulnerabilities in the network and information systems it operates, including a VCO it runs, and sets no timeframe. For entities within Commission Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches within a reasonable time after they become available and, where a patch is not available, additional measures with the residual risk accepted. An entity running a VCO on the 6.1.x or 7.0.x train is in that no-patch case, because Arista has published fixed releases only for the 5.2.3 and 6.4.2 trains; 6.6.1 does not name the additional measures, and the one Arista publishes, restricting the web interface to trusted administrative networks, leaves the flaw reachable from those networks.",
+      "UK-CAF-B4": "CAF B4.d asks that externally exposed vulnerabilities are mitigated (for example by patching) promptly and that temporary mitigations are in place for unsupported systems and software. Because the outcome accepts a mitigation, an operator of a 6.1.x or 7.0.x VCO can meet it with the only vendor mitigation available, restricting the web interface to trusted administrative networks, while the flaw stays reachable from every host on those networks; B4.d also leaves 'promptly' undefined for a flaw that Arista reported as already exploited when it first published the advisory.",
+      "AU-Essential-8-Patch": "For an online service such as a VCO whose web interface is directly accessible over the internet, the Essential Eight requires patches, updates or other vendor mitigations to be applied at every maturity level within 48 hours of release when the vendor rates the flaw critical or a working exploit exists (ISM-1876), and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1690); a VCO reachable only internally is an other application, patched within one month from Maturity Level Two (ISM-1693). Arista confirms active exploitation, so a working exploit exists and the 48-hour ISM-1876 window runs from Arista's 2026-09-22 advisory, which published the fixed 5.2.3.16 and 6.4.2.8 releases and interim mitigations. For the 6.1.x and 7.0.x trains the only vendor mitigation that can be applied inside that window is restricting the web interface to trusted administrative networks, which leaves the flaw reachable from those networks.",
+      "ISO-27001-2022-A.8.9": "A.8.9 requires security configurations of hardware, software and networks to be documented, implemented, monitored and reviewed, but it does not require a baseline to mark as high risk a combination of settings that the vendor names only later as the exposing condition. This flaw is reachable only where certificate-based authentication from the VeloCloud Edge to the VCO is configured and the VCO web interface is reachable over the network, and a baseline can record both settings as approved without flagging the combination until Arista's advisory names it."
+    },
+    "patch_available": false,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free patch path is documented for VCO on-prem; remediation is the version upgrade, and Arista's advisory does not state whether the upgrade reboots the orchestrator host. Deployments on the 6.1.x and 7.0.x trains have no fixed release yet and can apply only the interim network restrictions, which leave the vulnerable web interface reachable to hosts on the trusted administrative network. Arista has published fixed releases for the 5.2.3 and 6.4.2 trains only, so the entry is scored as having no available patch until the 6.1.x and 7.0.x trains receive one.",
+    "affected": "Arista VeloCloud Orchestrator (VCO) on-prem (formerly VeloCloud Orchestrator by Broadcom). Only instances where certificate-based authentication from the VeloCloud Edge to the VCO is configured, and whose web interface is reachable over the network, are exposed; no VCO tenant or operator credentials are required. A compromise of the orchestrator may give an attacker access to the managed VeloCloud Edge devices. Hosted and Dedicated VCO were affected and are already patched.",
+    "affected_versions": [
+      "VCO 5.2.x through 5.2.3.15 (fixed in 5.2.3.16 and later in the 5.2.3 train)",
+      "VCO 6.1.x through 6.1.3.7 (no fixed release for the 6.1.x train yet; apply the interim network restrictions and contact Arista TAC)",
+      "VCO 6.4.x through 6.4.2.7 (fixed in 6.4.2.8 and later in the 6.4.2 train)",
+      "VCO 7.0.x through 7.0.0.2 (no fixed release for the 7.0.x train yet; apply the interim network restrictions and contact Arista TAC)"
+    ],
+    "vendor_update_paths": [
+      "Because forensic triage is flagged in the KEV entry, first preserve the VCO web access, backend application, system and database logs and relevant file-system timestamps, and check for the advisory's indicators of compromise; if any are found, preserve the state of the VCO and contact Arista TAC before upgrading, rebuilding or reimaging it.",
+      "Upgrade to VCO 5.2.3.16 or later in the 5.2.3 train, or VCO 6.4.2.8 or later in the 6.4.2 train, per Arista Security Advisory 0183.",
+      "For the 6.1.x and 7.0.x trains no fixed release exists yet; contact Arista TAC for upgrade options and apply the interim measures until a fix ships.",
+      "Restrict the VCO web interface to trusted administrative networks, block outbound ports not required for normal operation, and monitor the VCO host for backdoor daemons, webshells and unexpected outbound connections.",
+      "After remediation, rotate credentials, review administrator activity, validate managed VeloCloud Edge device state, and restore or replace affected orchestrator instances from trusted sources where compromise is suspected."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": 0,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 63,
+    "rwep_notes": "RWEP 63. cisa_kev +25, active_exploitation +20, blast_radius +18. No patch discount while the 6.1.x and 7.0.x trains have no fixed release. Σ factors === rwep_score."
+  },
+  "CVE-2021-31207": {
+    "name": "Microsoft Exchange Server Security Feature Bypass Vulnerability",
+    "cvss_score": 6.6,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-434"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": true,
+    "active_exploitation": "confirmed",
+    "complexity": "high",
+    "vector": "A security-feature-bypass in the mailbox-export path of on-premises Microsoft Exchange Server lets a caller who has passed the ProxyShell authentication bypass assign itself the Mailbox Import Export role and write an arbitrary file, delivering a web shell as SYSTEM. It was demonstrated at Pwn2Own 2021 and chains with CVE-2021-34473 and CVE-2021-34523. Exchange Online is not affected.",
+    "epss_score": 0.99782,
+    "epss_percentile": 0.99956,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-31207",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-31207",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31207",
+        "severity": "moderate",
+        "published_date": "2021-05-11"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-31207",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31207"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.",
+    "type": "file-write-security-feature-bypass",
+    "blast_radius": 22,
+    "poc_available": true,
+    "poc_description": "Public exploit: the Metasploit module modules/exploits/windows/http/exchange_proxyshell_rce.rb chains CVE-2021-31207 with CVE-2021-34473 and CVE-2021-34523. The module's description labels CVE-2021-31207 as the authentication bypass and CVE-2021-34473 as the file write, the reverse of the roles the Zero Day Initiative advisories ZDI-21-819 and ZDI-21-821 give. The module was read in full for detection artifacts only; the shell payload is not reproduced here.",
+    "iocs": {
+      "behavioral": [
+        "A New-MailboxExportRequest issued with a -FilePath pointing at a UNC path under the Exchange or IIS web root, rather than a normal .pst destination; the ProxyShell module writes its .aspx web shell through such an export.",
+        "A New-ManagementRoleAssignment granting the Mailbox Import Export role to a user, issued through the remote PowerShell endpoint, which the module uses to self-assign export rights."
+      ],
+      "network": [
+        "Requests whose URI query contains autodiscover.json?@, autodiscover.json%3f@ or Email=autodiscover/autodiscover.json, the request-forgery forms SigmaHQ's ProxyShell pattern rule lists for exploitation attempts with status 401, sent with any HTTP method. The Metasploit ProxyShell module uses the form autodiscover.json?a=<address> instead, which contains neither ?@ nor %3f@, and sends Email=Autodiscover/autodiscover.json in a cookie on every request, so also match the path autodiscover.json, case-insensitively, together with that cookie.",
+        "Requests whose URI query contains /autodiscover.json together with /powershell, /mapi/nspi, /EWS or X-Rps-CAT, sent with any HTTP method; SigmaHQ's rules treat status 200 or 301 on such a request as a successful ProxyShell attack and 401 as an attempt. Remote PowerShell reached this way is how the chain issues the mailbox export.",
+        "These requests arriving at an internet-facing Exchange server from a source that is not a known management client."
+      ],
+      "host": [
+        "A new .aspx web shell under the Exchange FrontEnd\\HttpProxy\\owa\\auth path or C:\\inetpub\\wwwroot\\aspnet_client, matching the module's write-path options.",
+        "Mailbox export artifacts written to a web-accessible directory and later removed, consistent with the module's export-then-cleanup behavior.",
+        "An Exchange Server 2013 CU23, 2016 CU19 or CU20, or 2019 CU8 or CU9 instance below the fixed build for its cumulative update (Exchange 2013 CU23 below 15.0.1497.018, 2016 CU19 below 15.1.2176.014 or CU20 below 15.1.2242.010, 2019 CU8 below 15.2.792.015 or CU9 below 15.2.858.012)."
+      ],
+      "_ioc_source_note": "The mailbox-export write, the Mailbox Import Export role self-assignment, the autodiscover.json?a=<address> request prefix, the Email cookie form of the autodiscover request forgery and the web-shell write paths were read from the full Metasploit module at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb, for detection artifacts only; its payload and shellcode are not reproduced here. The URI-query patterns and their status codes come from SigmaHQ's ProxyShell rules at https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules-emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell.yml and https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules-emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell_successful.yml, which set no condition on the HTTP method. The vulnerability detail (mailbox-export handling, the authentication bypass, Pwn2Own 2021, code execution as SYSTEM) and the researcher credit come from the Zero Day Initiative advisory ZDI-21-819 at https://www.zerodayinitiative.com/advisories/ZDI-21-819/. The active-exploitation status and the May 2021 update come from the CISA ProxyShell alert at https://www.cisa.gov/news-events/alerts/2021/08/21/urgent-protect-against-active-exploitation-proxyshell-vulnerabilities. No single command-and-control address or file hash is listed here, because the sources describe the exploitation technique and the dropped web shell rather than fixed network infrastructure. The third network entry is a general hunting heuristic."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "The Zero Day Initiative advisory and Microsoft's security update guide credit Orange Tsai of the DEVCORE research team, who found it working with Trend Micro's Zero Day Initiative and demonstrated it at Pwn2Own 2021. No source claims any AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-31207 (CWE-434, CVSS 6.6) + CISA KEV (added 2021-11-03, ransomware: Known) + Microsoft security update guide entry CVE-2021-31207 (KB5003435) and Zero Day Initiative advisory ZDI-21-819, finder Orange Tsai of the DEVCORE research team working with Trend Micro's Zero Day Initiative.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2021-11-17 due date and records known ransomware use. Microsoft rated it a Moderate security-feature bypass and fixed it in the May 2021 update; CISA's August 2021 alert warned that ProxyShell (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207) was under active exploitation and urged applying that update, which it states remediates all three. The KEV forensic-triage flag is No, so CISA BOD 26-04 adds no separate requirement.",
+    "attack_refs": [
+      "T1190",
+      "T1505.003",
+      "T1059.001",
+      "T1114.002"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 flaw remediation was available from Microsoft's May 2021 update KB5003435, and unlike ProxyLogon this flaw was patched months before the August 2021 mass exploitation; the shortfall is that SI-2's organization-defined timeframe let the fix sit unapplied through that window on servers whose owners read the Moderate rating as low urgency.",
+      "NIS2-Art21-patch-management": "Article 21(2)(e) sets no timeframe for applying KB5003435 and offers no known-exploited prioritization to distinguish a Moderate-rated security-feature bypass that later became the file-write link of an actively exploited chain from routine maintenance, so the handling process under-served CVE-2021-31207 during the three-month gap.",
+      "UK-CAF-B4": "CAF B4.d asks that announced vulnerabilities are tracked and prioritized and that externally exposed vulnerabilities are mitigated, for example by patching, promptly; the outcome is not tied to the vendor's severity rating. On an internet-facing Exchange server CVE-2021-31207 was externally exposed from Microsoft's 2021-05-11 release of KB5003435, but the outcome does not define 'promptly' against a flaw Microsoft rated Moderate that completes the ProxyShell code-execution chain, so an operator could judge a deferral prompt and still be unpatched when CISA reported active exploitation on 2021-08-21.",
+      "AU-Essential-8-Patch": "Where an Exchange instance is directly accessible over the internet it is an online service, patched at every maturity level within 48 hours of release when the vendor rates the flaw critical or a working exploit exists (ISM-1876) and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1690); an instance reachable only internally is an other application, patched within one month from Maturity Level Two (ISM-1693), with no timeframe at Maturity Level One. KB5003435 shipped on 2021-05-11, so each of these windows closed by 2021-06-11, before the active exploitation CISA reported on 2021-08-21; meeting the applicable window would have prevented the compromise.",
+      "ISO-27001-2022-A.8.8": "A.8.8 vulnerability management would classify KB5003435 by risk, but Microsoft labeled CVE-2021-31207 a defense-in-depth Moderate issue, so a register that inherits vendor severity ranks the flaw low and does not surface it as the post-authentication mailbox-export write that completes the ProxyShell code-execution chain once CVE-2021-34473 has bypassed authentication."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path exists for on-premises Exchange Server; remediation is the May 2021 cumulative-update security patch KB5003435, whose install restarts the Exchange services and requires a host reboot on the affected cumulative updates. No reload-free path for this fix is documented.",
+    "affected": "On-premises Microsoft Exchange Server, the mailbox-export path, reachable after the ProxyShell authentication bypass and chained with CVE-2021-34473 and CVE-2021-34523 for code execution as SYSTEM. Exchange Online is not affected.",
+    "affected_versions": [
+      "Exchange Server 2013 below 15.0.1497.018 (CU23; KB5003435)",
+      "Exchange Server 2016 below 15.1.2176.014 (CU19) or 15.1.2242.010 (CU20) (KB5003435)",
+      "Exchange Server 2019 below 15.2.792.015 (CU8) or 15.2.858.012 (CU9) (KB5003435)"
+    ],
+    "vendor_update_paths": [
+      "Apply Microsoft's May 2021 update KB5003435, which CISA states remediates all three ProxyShell vulnerabilities; fixed builds are Exchange 2013 CU23 15.0.1497.018, Exchange 2016 CU19 15.1.2176.014 or CU20 15.1.2242.010, and Exchange 2019 CU8 15.2.792.015 or CU9 15.2.858.012. Installing restarts the Exchange services and needs a host reboot on the affected cumulative updates.",
+      "Because CVE-2021-31207 is the file-write link of the ProxyShell chain, treat a ProxyShell hit as a chain compromise: remove any web shell an export dropped and review recent mailbox-export requests before returning the server to service."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 77,
+    "rwep_notes": "RWEP 77. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2021-34473": {
+    "name": "Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)",
+    "cvss_score": 9.1,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
+    "cwe_refs": [
+      "CWE-918"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": true,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "A pre-authentication server-side request forgery in the Autodiscover service of on-premises Microsoft Exchange Server accepts a request whose URI is not validated before the backend is reached, so an unauthenticated attacker reaches internal endpoints such as PowerShell and MAPI. Chained with CVE-2021-34523 and CVE-2021-31207 it gives remote code execution as SYSTEM. Exchange Online is not affected.",
+    "epss_score": 0.99999,
+    "epss_percentile": 0.99997,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-34473",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-34473",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473",
+        "severity": "critical",
+        "published_date": "2021-07-13"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-34473",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473",
+        "severity": "critical",
+        "published_date": "2021-07-13"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-34473",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.",
+    "type": "preauth-ssrf-to-rce",
+    "blast_radius": 24,
+    "poc_available": true,
+    "poc_description": "Public exploits: the ProjectDiscovery nuclei template http/cves/2021/CVE-2021-34473.yaml in projectdiscovery/nuclei-templates probes the Autodiscover request forgery, and the Metasploit module modules/exploits/windows/http/exchange_proxyshell_rce.rb chains CVE-2021-34473 with CVE-2021-34523 and CVE-2021-31207. The module's description labels CVE-2021-34473 as the file write and CVE-2021-31207 as the authentication bypass, the reverse of the roles the Zero Day Initiative advisories ZDI-21-821 and ZDI-21-819 give. The template and the module were read in full for detection artifacts only; the shell payload is not reproduced here.",
+    "iocs": {
+      "behavioral": [
+        "An unauthenticated Autodiscover request carrying an attacker-controlled Email parameter with an embedded backend path, the reachability check the public nuclei template sends.",
+        "Follow-on requests through the request forgery to /PowerShell and /mapi that no prior authentication accounts for, consistent with the ProxyShell chain."
+      ],
+      "network": [
+        "Web server log entries whose URI query contains /autodiscover.json together with /powershell, /mapi/nspi, /EWS or X-Rps-CAT, or contains autodiscover.json?@, autodiscover.json%3f@, %3f@foo.com, json?@foo.com or Email=autodiscover/autodiscover.json, sent with any HTTP method; SigmaHQ's ProxyShell rules match these query patterns, with status 401 for attempts and status 200 or 301 on the backend-path form for a successful attack. Match them case-insensitively, because the nuclei template sends an uppercase %3F. The Metasploit ProxyShell module prefixes every request with autodiscover.json?a=<address> followed by the backend path, which contains none of the ?@, %3f@ or Email= literals, so the co-occurrence of /autodiscover.json with a backend path is the pattern that matches its traffic.",
+        "A response containing Microsoft.Exchange.Clients.Owa2.Server.Core.OwaADUserNotFoundException or the string Exchange MAPI/HTTP Connectivity Endpoint to an /autodiscover/autodiscover.json request that embeds an @host and an Email=autodiscover/autodiscover.json parameter; this is the check the ProjectDiscovery nuclei template uses, so it marks a scanner confirming the flaw rather than exploitation.",
+        "Requests to the Autodiscover endpoint from an internet-facing source that reach internal service paths without a preceding authenticated session."
+      ],
+      "host": [
+        "A new .aspx web shell under the Exchange owa\\auth path or C:\\inetpub\\wwwroot\\aspnet_client, dropped by the chained mailbox-export write.",
+        "Mailbox export artifacts and unusual New-MailboxExportRequest activity, when 34473 is chained with CVE-2021-31207.",
+        "An Exchange Server 2013 CU23, 2016 CU19 or CU20, or 2019 CU8 or CU9 instance below the fixed build for its cumulative update (Exchange 2013 CU23 below 15.0.1497.015, 2016 CU19 below 15.1.2176.012 or CU20 below 15.1.2242.008, 2019 CU8 below 15.2.792.013 or CU9 below 15.2.858.010); the fix shipped in the April 2021 update KB5001779 though Microsoft documented the CVE only on 2021-07-13."
+      ],
+      "_ioc_source_note": "The URI-query patterns and their status codes come from SigmaHQ's ProxyShell rules at https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules-emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell.yml and https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules-emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell_successful.yml, which set no condition on the HTTP method or the response body. The Autodiscover probe path (/autodiscover/autodiscover.json with the embedded @host and Email parameter) and the response strings OwaADUserNotFoundException and Exchange MAPI/HTTP Connectivity Endpoint were read from the ProjectDiscovery nuclei template at https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2021/CVE-2021-34473.yaml. The chain, the follow-on /PowerShell and /mapi endpoints and the autodiscover.json?a=<address> prefix on every module request were read from the full Metasploit module at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb, for detection artifacts only; its payload is not reproduced here. The vulnerability detail (Autodiscover request forgery, unauthenticated, code execution as SYSTEM when chained) and the researcher credit come from the Zero Day Initiative advisory ZDI-21-821 at https://www.zerodayinitiative.com/advisories/ZDI-21-821/. Active exploitation and the Iranian state-sponsored use of this flaw for initial access come from the CISA ProxyShell alert at https://www.cisa.gov/news-events/alerts/2021/08/21/urgent-protect-against-active-exploitation-proxyshell-vulnerabilities and the joint advisory AA21-321A at https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-321a. This flaw is attributed to named threat activity (Iranian state-sponsored actors, and ransomware crews using ProxyShell), so the durable artifacts listed are the request shape and the dropped web shell rather than a fixed command-and-control address or file hash, which the consulted sources do not tie to this CVE alone. The third network entry is a general hunting heuristic."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "The Zero Day Initiative advisory and Microsoft's security update guide credit Orange Tsai of the DEVCORE research team, who reported it working with Trend Micro's Zero Day Initiative and demonstrated the ProxyShell chain at Pwn2Own 2021. No source claims any AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-34473 (CWE-918, CVSS 9.1) + CISA KEV (added 2021-11-03, ransomware: Known) + Microsoft security update guide entry CVE-2021-34473 (KB5001779) and Zero Day Initiative advisory ZDI-21-821, finder Orange Tsai of the DEVCORE research team working with Trend Micro's Zero Day Initiative.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2021-11-17 due date and records known ransomware use. CISA's August 2021 alert warned that ProxyShell (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207) was under active exploitation and urged applying the May 2021 update. In the joint advisory AA21-321A, CISA, FBI, ACSC and NCSC reported Iranian state-sponsored actors leveraging CVE-2021-34473 since at least October 2021 for initial access ahead of data exfiltration, BitLocker-based encryption and ransomware. The KEV forensic-triage flag is No, so CISA BOD 26-04 adds no separate requirement.",
+    "attack_refs": [
+      "T1190",
+      "T1505.003",
+      "T1059.001",
+      "T1210"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires flaws to be identified, reported and corrected, with security-relevant updates installed within organization-defined time periods. KB5001779, released on 2021-04-13 for other Critical Exchange CVEs and required on federal servers by CISA's ED 21-02 supplemental direction before 2021-04-16, already corrected CVE-2021-34473, so a program that installed it on time was protected; but Microsoft documented this CVE only on 2021-07-13, so until then a flaw record keyed by CVE could not show the pre-authentication Autodiscover flaw on a server that had deferred or been excepted from the April update.",
+      "NIS2-Art21-patch-management": "Article 21(2)(e) requires vulnerability handling and disclosure and sets no timeframe. For CVE-2021-34473 the vendor's disclosure trailed its fix: the April 2021 update corrected this pre-authentication Autodiscover request forgery, but Microsoft omitted the CVE from that release and documented it on 2021-07-13, so an entity whose handling process works from published CVEs could not prioritize it by its own identifier until 39 days before CISA reported active ProxyShell exploitation on 2021-08-21.",
+      "UK-CAF-B4": "CAF B4.d asks that announced vulnerabilities are tracked and prioritized and that externally exposed vulnerabilities are mitigated promptly. The April 2021 update that fixed CVE-2021-34473 was announced for other Critical CVEs, and an operator that applied it promptly was protected, but this CVE was not announced until 2021-07-13, so a decision to defer the April update on an internet-facing server was weighed without the unauthenticated entry point of the ProxyShell chain in view.",
+      "AU-ISM-1546": "ISM-1546 is met by configuring authentication in front of a system, but CVE-2021-34473 is a pre-authentication request forgery in the Exchange Autodiscover service: the request reaches internal endpoints without passing the authentication mechanism at all, so a control evidenced by the presence of authentication does not reach a flaw in the product's own request validation that admits an unauthenticated caller.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires information about technical vulnerabilities to be obtained, the organization's exposure to be evaluated and appropriate measures to be taken. Microsoft omitted CVE-2021-34473 from its April 2021 release and documented it on 2021-07-13, stating that customers who had installed the April update needed no further action; a register that obtains its information from Microsoft's CVE list carried no entry for this pre-authentication flaw for three months, so its exposure evaluation for servers still below the April 2021 builds left it out."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free path for this fix is documented. The fix shipped in the April 2021 update KB5001779, and the May 2021 update KB5003435 supersedes it and closes the full ProxyShell chain. Microsoft's Security Update Guide lists a host restart as required for the fixed builds of both updates.",
+    "affected": "On-premises Microsoft Exchange Server, the Autodiscover service. The pre-authentication request forgery reaches internal endpoints, and chained with CVE-2021-34523 and CVE-2021-31207 it gives code execution as SYSTEM. Exchange Online is not affected.",
+    "affected_versions": [
+      "Exchange Server 2013 below 15.0.1497.015 (CU23; KB5001779, documented 2021-07-13)",
+      "Exchange Server 2016 below 15.1.2176.012 (CU19) or 15.1.2242.008 (CU20) (KB5001779)",
+      "Exchange Server 2019 below 15.2.792.013 (CU8) or 15.2.858.010 (CU9) (KB5001779)"
+    ],
+    "vendor_update_paths": [
+      "The fix shipped in the April 2021 update KB5001779, with fixed builds Exchange 2013 CU23 15.0.1497.015, Exchange 2016 CU19 15.1.2176.012 or CU20 15.1.2242.008, and Exchange 2019 CU8 15.2.792.013 or CU9 15.2.858.010, but Microsoft did not document CVE-2021-34473 until 2021-07-13; track installed builds, not the advisory date, to confirm coverage.",
+      "The May 2021 update KB5003435, which supersedes KB5001779 and which CISA states remediates all three ProxyShell vulnerabilities, closes the full chain; its fixed builds are Exchange 2013 CU23 15.0.1497.018, Exchange 2016 CU19 15.1.2176.014 or CU20 15.1.2242.010, and Exchange 2019 CU8 15.2.792.015 or CU9 15.2.858.012. Microsoft lists a host restart as required for these builds.",
+      "Because state-sponsored actors used this flaw for initial access, follow a nation-state playbook on a confirmed ProxyShell compromise: remove web shells, hunt for the follow-on tools reported in AA21-321A, and rotate credentials before returning the server to service."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 79,
+    "rwep_notes": "RWEP 79. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2020-1380": {
+    "name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-1380)",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-787"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "A use-after-free in Internet Explorer's modern JScript engine (jscript9.dll) caused by two JIT mismodelings: calling Array.prototype.push with the arguments object modifies argument values on the stack that the JIT does not model, and the JIT then treats a value as a primitive when storing it into a Float32Array, so a valueOf callback runs and can detach the backing buffer. A crafted page opened in Internet Explorer 11 gains code execution as the current user; the in-the-wild chain then used CVE-2020-0986 to elevate privilege. The ADV200001 jscript.dll workaround does not apply, because jscript9.dll is a different engine.",
+    "epss_score": 0.24188,
+    "epss_percentile": 0.97752,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-1380",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2020-1380",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1380",
+        "severity": "critical",
+        "published_date": "2020-08-11"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-1380",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1380"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.",
+    "type": "jscript9-jit-use-after-free-rce",
+    "blast_radius": 26,
+    "poc_available": false,
+    "poc_description": "No working exploit code is hosted at a nameable location. Kaspersky and Trend Micro published write-ups with a crash-level trigger for the jscript9.dll use-after-free, but no full exploit, and the GitHub, Exploit-DB and nuclei-template indexes carry no entry for CVE-2020-1380.",
+    "iocs": {
+      "behavioral": [
+        "Script that pushes onto the arguments object with Array.prototype.push and then triggers a valueOf callback that detaches a Float32Array buffer through a Web Worker postMessage, the jscript9.dll JIT trigger in the public write-ups",
+        "Calls to CollectGarbage that defragment the heap to reclaim a freed LargeHeapBlock, per Kaspersky's Operation PowerFall analysis",
+        "Internet Explorer writing ok.exe to a temporary folder and executing it, the step Kaspersky describes for the Internet Explorer shellcode",
+        "ok.exe writing CreateDC.exe to disk, then splwow64.exe running PoPc.dll, which launches an encoded PowerShell command that downloads a file and saves it to the temporary folder as upgrader.exe"
+      ],
+      "network": [
+        "A drive-by page delivering the jscript9.dll exploit to Internet Explorer 11, as in Operation PowerFall against a South Korean target",
+        "Outbound download from www[.]static-cdn1[.]com/update.zip saved as upgrader.exe, the Operation PowerFall payload host"
+      ],
+      "host": [
+        "Internet Explorer 11 below the August 11, 2020 update level, for example Windows 10 2004 without KB4566782",
+        "Files matching the Operation PowerFall sample hashes in Kaspersky's IoC list, for example SHA-256 7765F836D2D049127A25376165B1AC43CD109D8B9D8C5396B8DA91ADC61ECCB1",
+        "jscript9.dll exploited despite a jscript.dll access restriction, since the restriction does not cover the modern engine"
+      ],
+      "_ioc_source_note": "The jscript9.dll JIT trigger (Array.prototype.push on the arguments object, the Float32Array detach in a valueOf callback via a Web Worker, and the CollectGarbage heap defragmentation) comes from Project Zero's root-cause analysis at https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2020/CVE-2020-1380.html and Kaspersky's Operation PowerFall analysis at https://securelist.com/ie-and-windows-zero-day-operation-powerfall/97976/. The ok.exe drop by the Internet Explorer shellcode, the CreateDC.exe and PoPc.dll files of the CVE-2020-0986 exploit, the PowerShell launch from splwow64.exe and the www[.]static-cdn1[.]com/update.zip download are described in that Kaspersky post, and the sample hashes come from its IoC list, which does not say which file each hash belongs to. The fixed builds come from Microsoft's August 2020 security update document at https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2020-Aug. The note that the jscript.dll restriction does not cover jscript9.dll is drawn from the same Kaspersky post. The drive-by delivery is a general hunting heuristic."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Not AI-discovered. Microsoft and Project Zero credit Boris Larin of Kaspersky, who found the exploit in the wild in Operation PowerFall. Project Zero's root-cause analysis speculates that the attackers may have found the bug by fuzzing, for example with a generative fuzzer. No source claims AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2020-1380 (CWE-787 out-of-bounds write, CVSS 7.8) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2020-1380. Kaspersky's Boris Larin reported the in-the-wild use in Operation PowerFall.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to KEV on 2021-11-03 with a 2022-05-03 due date and records ransomware use as Unknown; the KEV record's forensic-triage flag is No. It was exploited in the wild in Operation PowerFall in May 2020 against a South Korean company, as part of a chain with the elevation-of-privilege flaw CVE-2020-0986; Kaspersky suspects DarkHotel.",
+    "attack_refs": [
+      "T1189",
+      "T1203",
+      "T1059.007",
+      "T1068"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 flaw remediation drives installing the August 11, 2020 update, but this flaw was exploited in the wild in May 2020 as a zero-day, so for that pre-patch window SI-2 had no fix to apply; the flaw is in jscript9.dll, so the jscript.dll workaround SI-2 programs had adopted for earlier JScript bugs gave no protection.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe. For entities within the scope of Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available and additional measures where no patch is available, without naming them. This flaw was exploited from May 2020 and Microsoft published no advisory until the August 11, 2020 fix, so an entity had no information on which to take additional measures before release, and the jscript.dll restriction kept from earlier JScript bugs does not cover the jscript9.dll engine this flaw is in.",
+      "UK-CAF-B4": "CAF principle B4 expects deployed-system vulnerabilities to be managed, but it does not distinguish this jscript9.dll flaw from earlier jscript.dll ones; an operator relying on the jscript.dll access-restriction workaround as its B4 compensating control was not protected, and the principle does not surface that the interim measure does not apply here.",
+      "AU-Essential-8-Patch": "For Internet Explorer 11, a web browser, the Essential Eight window is two weeks at Maturity Levels One and Two (ISM-1691); at Maturity Level Three it is 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1692). Microsoft rated this flaw Critical on Windows client versions and it was already exploited, so the 48-hour window applied at Maturity Level Three, all measured from the August 11, 2020 release; the May 2020 zero-day period was open at every maturity level, and no reversible workaround existed for the jscript9.dll engine to bridge it.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities is obtained, the organization's exposure is evaluated and appropriate measures are taken. Exposure to this flaw is through jscript9.dll, the default engine since Internet Explorer 9, so a register that carried the jscript.dll restriction adopted for earlier JScript bugs as the measure for Internet Explorer recorded protection this flaw never had."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free path exists for this flaw; the fix is a Windows security update or monthly rollup that requires a host restart. There is no configuration workaround, because the flaw is in the default jscript9.dll engine rather than the legacy jscript.dll that the ADV200001 workaround restricts. Internet Explorer follows the lifecycle of the Windows release it is installed on: Windows 7 SP1 and Windows Server 2008 R2 SP1 reached the end of extended support on January 14, 2020, after which Microsoft delivered updates to them only under Extended Security Updates, and the Internet Explorer 11 desktop application ended support on Windows 10 semi-annual channel releases on June 15, 2022.",
+    "affected": "Internet Explorer's modern JScript engine (jscript9.dll), which is the default engine from Internet Explorer 9 onward. Because the flaw is in jscript9.dll rather than the legacy jscript.dll, the ADV200001 workaround that restricts jscript.dll does not protect against it. Successful exploitation runs code as the current user, and the in-the-wild chain paired it with an elevation-of-privilege flaw.",
+    "affected_versions": [
+      "Internet Explorer 11 on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 (versions 1507, 1607, 1709, 1803, 1809, 1903, 1909 and 2004) and Windows Server 2008 R2 SP1, 2012, 2012 R2, 2016 and 2019, before the August 11, 2020 updates. Microsoft's August 2020 security update document lists every affected product and package (https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2020-Aug)",
+      "Windows 10 and Windows Server 2016 and 2019 are fixed by the August 11, 2020 security update for each release: KB4571692 (1507), KB4571694 (1607 and Server 2016), KB4571741 (1709), KB4571709 (1803), KB4565349 (1809 and Server 2019), KB4565351 (1903 and 1909) and KB4566782 (2004)",
+      "Windows 8.1, Windows RT 8.1 and Windows Server 2012 and 2012 R2 are fixed by the IE Cumulative KB4571687 (not offered for RT 8.1) or the Monthly Rollup KB4571703 (8.1, RT 8.1 and Server 2012 R2) or KB4571736 (Server 2012)",
+      "Windows 7 SP1 and Windows Server 2008 R2 SP1 are fixed by the IE Cumulative KB4571687 or the Monthly Rollup KB4571729, which Microsoft delivers only under Extended Security Updates because their extended support ended on January 14, 2020"
+    ],
+    "vendor_update_paths": [
+      "Apply the August 11, 2020 security update for the installed Windows release: KB4571692 (Windows 10 1507), KB4571694 (1607 and Windows Server 2016), KB4571741 (1709), KB4571709 (1803), KB4565349 (1809 and Windows Server 2019), KB4565351 (1903 and 1909) or KB4566782 (2004); on Windows 8.1, RT 8.1 and Windows Server 2012 and 2012 R2, the IE Cumulative KB4571687 or the Monthly Rollup KB4571703 or KB4571736. Each update requires a restart.",
+      "On Windows 7 SP1 and Windows Server 2008 R2 SP1, whose extended support ended on January 14, 2020, the IE Cumulative KB4571687 or the Monthly Rollup KB4571729 is delivered only under Extended Security Updates; without it, move to a supported operating system or remove Internet Explorer.",
+      "The in-the-wild chain also used CVE-2020-0986, an elevation-of-privilege flaw in Windows that Microsoft fixed on June 9, 2020. The IE Cumulative KB4571687 updates only Internet Explorer, so on Windows 8.1 and Windows Server 2012 and 2012 R2 closing the chain also needs the June 2020 operating-system update for CVE-2020-0986: the Monthly Rollup KB4561666 or the Security Only update KB4561673 on 8.1 and Server 2012 R2, or KB4561612 or KB4561674 on Server 2012.",
+      "The jscript.dll restriction workaround does not apply, because the flaw is in jscript9.dll; there is no configuration workaround for this one, so the update is the only fix.",
+      "Retire or disable Internet Explorer where it is not required."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 61,
+    "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2021-27085": {
+    "name": "Microsoft Internet Explorer Remote Code Execution Vulnerability",
+    "cvss_score": 8.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L",
+    "cwe_refs": [],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "An unspecified flaw in Internet Explorer reached through the browser's handling of a crafted web page. Microsoft rates it remote code execution in the context of the current user and marks it exploited in the wild; the vendor published no technical detail and assigned no CWE. An attacker who convinces a target to open a crafted page in Internet Explorer 11 gains code execution with the current user's rights.",
+    "epss_score": 0.05448,
+    "epss_percentile": 0.92381,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-27085",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-27085",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27085",
+        "severity": "important",
+        "published_date": "2021-03-09"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-27085",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27085",
+        "severity": "important",
+        "published_date": "2021-03-09"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-27085",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27085",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27085"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.",
+    "type": "browser-unspecified-rce",
+    "blast_radius": 24,
+    "poc_available": false,
+    "poc_description": "No working exploit code is hosted at a nameable location. Microsoft marks the flaw exploited in the wild but published no technical detail, and the GitHub, Exploit-DB and nuclei-template indexes carry no entry for CVE-2021-27085.",
+    "iocs": {
+      "behavioral": [
+        "Internet Explorer 11 rendering an untrusted page and then spawning a child process on a host that does not otherwise use the browser"
+      ],
+      "network": [
+        "A crafted web page delivered to a target and opened in Internet Explorer 11, the vector Microsoft describes for this remote code execution flaw"
+      ],
+      "host": [
+        "Internet Explorer 11 below the March 9, 2021 update level, for example Windows 10 2004 or 20H2 without KB5000802 or 1809 without KB5000822"
+      ],
+      "_ioc_source_note": "No detection-grade indicator source was reachable for this specific flaw: Microsoft published no technical detail, CWE or indicators, and there is no public exploit, Exploit-DB entry or nuclei template for it. The affected-version boundary and the exploited-in-the-wild status come from Microsoft's March 2021 security update document at https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2021-Mar and the NVD and CISA KEV records. The browser-rendering, child-process and crafted-page items are general hunting heuristics rather than artifacts read from a source. No actor infrastructure, file hash or C2 address is listed, because although FireEye is credited with reporting the flaw, no source attributes it to a named campaign or publishes indicators."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Not AI-discovered. FireEye reported the vulnerability to Microsoft; no source names AI tooling in its discovery.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-27085 (NVD-CWE-noinfo, CVSS 8.8) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2021-27085. The entry carries no CWE because no source assigns one: NVD records NVD-CWE-noinfo, the CISA KEV record lists no CWE, and the CVE record's CISA ADP container reads CWE-noinfo Not enough information. FireEye's Chi-Yu You and Dhanesh Kizhakkinan are credited with the report.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to KEV on 2021-11-03 with a 2021-11-17 due date and records ransomware use as Unknown; the KEV record's forensic-triage flag is No. Microsoft released the fix on March 9, 2021 and, in a revision dated March 12, 2021, changed its exploited flag to Yes and added an acknowledgment of FireEye's Chi-Yu You and Dhanesh Kizhakkinan; no public technical write-up or named campaign is available.",
+    "attack_refs": [
+      "T1189",
+      "T1203",
+      "T1204.001"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires installing security-relevant updates within an organization-defined period of their release. Microsoft released this fix on March 9, 2021 rated Important, then changed its exploited flag to Yes on March 12, 2021 in an informational revision with no new update, so a program that set the SI-2 period from the release-day rating and exploit status kept a timeline chosen before the flaw was known to be exploited; SI-2 measures the period from the update's release, so the March 12 revision does not start a new one.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe. For entities within the scope of Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available and additional measures where no patch is available, without naming them. Microsoft reported exploitation of this flaw on March 12, 2021, after the March 9 patch was available and with no workaround published, so the requirement that decides this CVE is the reasonable-time clause, which the regulation does not define and does not tie to a vendor's later change of exploited status.",
+      "UK-CAF-B4": "CAF principle B4 expects externally exposed vulnerabilities to be mitigated promptly, for example by patching. Microsoft published no technical detail and no workaround for this flaw, so any mitigation other than the March 9, 2021 update has to come from the operator, for example disabling Internet Explorer 11, and 'promptly' is not defined against Microsoft's March 12, 2021 change to its exploited flag.",
+      "AU-Essential-8-Patch": "For Internet Explorer 11, a web browser, the Essential Eight window is two weeks at Maturity Levels One and Two (ISM-1691); at Maturity Level Three it is 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1692) and two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1901). Microsoft rated this flaw Important, so only the exploitation it reported meets the 48-hour condition, and it reported that on March 12, 2021, three days after the March 9 release from which the window is measured; an organization at Maturity Level Three that scheduled the update by the release-day rating was already past the 48 hours when the condition became known.",
+      "ISO-27001-2022-A.8.8": "A.8.8 sets remediation timescales by risk classification, but with no CWE and no public detail an A.8.8 program has only the vendor's exploited-in-the-wild flag to classify by; treating that as an ordinary browser update understates a flaw already used against targets."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free path exists for this flaw; the fix is a Windows 10 or Windows Server 2019 security update that requires a host restart. Microsoft published no configuration workaround, so the update is the only remediation. The Internet Explorer 11 desktop application ended support on Windows 10 semi-annual channel releases on June 15, 2022; on Windows Server 2019, Internet Explorer follows the lifecycle of the operating system.",
+    "affected": "Internet Explorer 11 on Windows 10 versions 1803, 1809, 1909, 2004 and 20H2 and on Windows Server 2019, reached through the browser's handling of a crafted web page. Microsoft rates it remote code execution in the context of the current user and lists no other Windows release or Internet Explorer version as affected.",
+    "affected_versions": [
+      "Internet Explorer 11 on Windows 10 versions 1803, 1809, 1909, 2004 and 20H2 and on Windows Server 2019, before the March 9, 2021 updates; Microsoft lists no other Windows release or Internet Explorer version as affected (https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2021-Mar)",
+      "Fixed by KB5000809 (1803), KB5000822 (1809 and Windows Server 2019), KB5000808 (1909) and KB5000802 (2004 and 20H2)"
+    ],
+    "vendor_update_paths": [
+      "Apply the March 9, 2021 Windows security update for the installed release: KB5000809 on Windows 10 1803, KB5000822 on 1809 and Windows Server 2019, KB5000808 on 1909, and KB5000802 on 2004 and 20H2. Each update requires a restart.",
+      "Microsoft published no configuration workaround; the update is the only fix.",
+      "Disable or remove Internet Explorer 11 where it is not required; its desktop application ended support on Windows 10 semi-annual channel releases on June 15, 2022, and on Windows Server 2019 it follows the operating system's lifecycle."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 59,
+    "rwep_notes": "RWEP 59. cisa_kev +25, active_exploitation +20, blast_radius +24, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2019-0541": {
+    "name": "Microsoft MSHTML Remote Code Execution Vulnerability",
+    "cvss_score": 8.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-77"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka \"MSHTML Engine Remote Code Execution Vulnerability.\" This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.",
+    "epss_score": 0.53202,
+    "epss_percentile": 0.98933,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-0541",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2019-0541",
+        "url": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2019-Jan",
+        "severity": "important",
+        "published_date": "2019-01-08"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2019-0541",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.",
+    "type": "mshtml-input-validation-rce",
+    "blast_radius": 24,
+    "poc_available": true,
+    "poc_description": "Public exploit code exists at Exploit-DB 46536, a proof of concept by Eduardo Braun Prado for the MSHTML engine 'Edit' remote code execution flaw, dated 2019-03-13 and filed under windows/local. Its description and the two files in its archive were read for detection artifacts only. No nuclei template or exploit-module description was reachable for this CVE.",
+    "iocs": {
+      "behavioral": [
+        "A process started by the handler registered for the ProgId named in an HTML file's meta tag (htafile in the public proof of concept), right after a user chooses Edit on that file in Internet Explorer or through the Office Edit HTML application msohtmed.exe. The file's author picks the ProgId, so the parent of the new process can be that handler rather than Internet Explorer or an Office binary.",
+        "A crafted HTML editing operation producing code execution in the context of the current user, consistent with the HTML editing attack scenario the vendor describes."
+      ],
+      "network": [
+        "An outbound connection from an Office or Internet Explorer host to an untrusted address shortly after a file from an external source is edited."
+      ],
+      "host": [
+        "Internet Explorer 9, 10 or 11, or an Office, Word Viewer, Excel Viewer or Office 365 ProPlus build, below the January 2019 update level that carries the MSHTML fix.",
+        "An .htm, .html or .xhtml file containing a meta tag named ProgId, opened from a local folder or a network share on a host running an affected product. The public proof of concept sets the tag's content to htafile and adds an hta:application element, and the ProgId value can vary."
+      ],
+      "_ioc_source_note": "The attack scenario (a user editing a specially crafted file whose input the MSHTML engine improperly validates) comes from the vendor description in the Microsoft Security Update Guide data for CVE-2019-0541 at https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2019-Jan and from the NVD record. The Exploit-DB 46536 description at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/windows/local/46536.txt and the PoC_Edit_Me.htm and xpl.txt files in its archive at https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46536.zip were read for detection artifacts only. The meta tag named ProgId with content htafile, the hta:application element, the Edit HTML application msohtmed.exe and the local and network-share delivery routes come from those files; the linked video and OneDrive download were not fetched. The outbound-connection entry is a general hunting heuristic, not an artifact from those files. No actor infrastructure, file hash or command-and-control address is listed, because no source consulted attributes this CVE to a named campaign."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "No source claims AI involvement. Microsoft credits Eduardo Braun Prado working with iDefense Labs with reporting the MSHTML engine flaw.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2019-0541 (CWE-77, CVSS 8.8) + CISA KEV (added 2021-11-03) + Microsoft advisory for CVE-2019-0541 (January 2019 update, MSHTML Engine Remote Code Execution Vulnerability). Microsoft's acknowledgement at https://api.msrc.microsoft.com/sug/v2.0/en-US/acknowledgement?%24filter=cveNumber%20eq%20%27CVE-2019-0541%27 credits Eduardo Braun Prado working with iDefense Labs, an outside researcher, so the finder is a human researcher.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a due date of 2022-05-03 and records known ransomware use as Unknown. When Microsoft published the fix in the January 2019 updates it rated the flaw not publicly disclosed and not exploited, with exploitation assessed as more likely; the KEV listing is CISA's later evidence of in-the-wild use. A public proof of concept (Exploit-DB 46536, Eduardo Braun Prado) followed on 2019-03-13. No named campaign is attributed in the sources reviewed. The KEV entry does not flag forensic triage.",
+    "attack_refs": [
+      "T1203",
+      "T1204.002",
+      "T1566.001"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires flaws to be identified, reported and corrected, with security-relevant updates installed within organization-defined time periods. Microsoft lists Internet Explorer 9, 10 and 11 and several Office and viewer products as affected by this MSHTML flaw, each fixed by a separate January 2019 update, so an SI-2 program that tracks remediation per product can close the CVE for one product while another listed product on the same host stays unpatched, and the flaw was later KEV-listed as exploited.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Article 21(2)(e) requires vulnerability handling and disclosure and sets no timeframe or trigger for re-prioritization. Microsoft did not rate this flaw exploited at release, but a public proof of concept appeared on March 13, 2019 and CISA later added it to the known-exploited catalog; the article gives operators no trigger to re-prioritize a client-side flaw in Internet Explorer and Office once that signal arrives.",
+      "UK-CAF-B4": "CAF principle B4.d asks that announced vulnerabilities for all software packages are tracked, prioritized and mitigated promptly, for example by patching, and that the organization regularly tests to understand its vulnerabilities; at the Partially achieved level it accepts temporary mitigations for an extended period for vulnerabilities that are not externally exposed. CVE-2019-0541 needs a user to edit a crafted file in Internet Explorer or Office, so it is not an externally exposed vulnerability, and B4.d does not define 'promptly' for it, although a public exploit followed two months after the January 2019 release and CISA later listed the flaw as exploited.",
+      "AU-Essential-8-Patch": "Internet Explorer is a web browser and Microsoft Office is an office productivity suite under the Essential Eight. They are patched within two weeks at Maturity Levels One and Two (ISM-1691); at Maturity Level Three they are patched within 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1692) and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1901). At the January 8, 2019 release Microsoft rated this flaw Important (Low for Internet Explorer on Windows Server) and reported it neither publicly disclosed nor exploited, so the two-week window applied at every maturity level and closed on January 22, 2019, before the first public exploit, Exploit-DB 46536, was published on March 13, 2019. No source reviewed documents exploitation before that exploit, so meeting the window would have patched these products before any documented exploitation.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities is obtained, the organization's exposure is evaluated and appropriate measures are taken. Microsoft lists Internet Explorer, several Office releases and the Word and Excel Viewers as affected by CVE-2019-0541, each fixed by its own January 2019 update, so a register that records the CVE as closed once one product's update is installed cannot confirm that every listed product on a host received its fix."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No vendor live-patch path exists: Microsoft marks every Internet Explorer and Windows update for this CVE as requiring a restart, the Office and viewer updates as possibly requiring one, and the Click-to-Run updates for Office 2019 and Office 365 ProPlus as not requiring one. Several affected lines are past end of support according to Microsoft's lifecycle pages, including Office 2010, Internet Explorer 9 and Internet Explorer 10, and applying the January 2019 update does not restore support for them.",
+    "affected": "Microsoft lists Internet Explorer 9, 10 and 11, Office 2010, 2013, 2016 and 2019, Office 365 ProPlus, Excel Viewer 2007 and Word Viewer as affected by this MSHTML engine flaw, each fixed by its own January 2019 update. The engine improperly validates input; Microsoft describes an HTML editing scenario in which a user edits a specially crafted file.",
+    "affected_versions": [
+      "Internet Explorer 11 on Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1 and Windows Server 2012 R2; Internet Explorer 10 on Windows Server 2012 only; Internet Explorer 9 on Windows Server 2008 SP2 only. These are fixed by the January 2019 Internet Explorer cumulative update KB4480965 or the monthly rollup for the release (KB4480970 for Windows 7 and Server 2008 R2, KB4480963 for Windows 8.1, RT 8.1 and Server 2012 R2, KB4480975 for Server 2012, KB4480968 for Server 2008 SP2); Windows RT 8.1 is fixed through the monthly rollup only.",
+      "Internet Explorer 11 on Windows 10 and Windows Server 2016 and 2019, fixed by the January 2019 cumulative update for the release: KB4480962 (version 1507), KB4480961 (1607 and Server 2016), KB4480973 (1703), KB4480978 (1709), KB4480966 (1803) and KB4480116 (1809 and Server 2019).",
+      "Office 2010 SP2 (KB2553332), Office 2013 SP1 and Office 2013 RT SP1 (KB3172522), Office 2016 (KB4022162), Word Viewer (KB4462112) and Excel Viewer 2007 SP3 (KB2596760); Office 2019 and Office 365 ProPlus are fixed through Click-to-Run updates. The Microsoft Security Update Guide entry for CVE-2019-0541 lists every product and edition."
+    ],
+    "vendor_update_paths": [
+      "Apply the January 8, 2019 Internet Explorer fix for the Windows release: the Internet Explorer cumulative update KB4480965 or the monthly rollup (KB4480970, KB4480963, KB4480975 or KB4480968) on Windows 7, 8.1 and RT 8.1 and Windows Server 2008, 2008 R2, 2012 and 2012 R2, or the Windows 10 and Windows Server 2016 and 2019 cumulative update (KB4480962, KB4480961, KB4480973, KB4480978, KB4480966 or KB4480116); a host restart is required.",
+      "Apply the January 2019 Office updates: KB2553332 for Office 2010 SP2, KB3172522 for Office 2013 SP1 and Office 2013 RT SP1, KB4022162 for Office 2016, KB4462112 for Word Viewer and KB2596760 for Excel Viewer 2007 SP3, and the Click-to-Run update for Office 2019 and Office 365 ProPlus. The MSI-based Office and viewer updates may require a restart.",
+      "Confirm every listed product on a host has its own January 2019 update, since Microsoft fixes Internet Explorer, each Office release and each viewer through separate updates."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 79,
+    "rwep_notes": "RWEP 79. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2017-11774": {
+    "name": "Microsoft Office Outlook Security Feature Bypass Vulnerability",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-119"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka \"Microsoft Outlook Security Feature Bypass Vulnerability.\"",
+    "epss_score": 0.59627,
+    "epss_percentile": 0.99086,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2017-11774",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2017-11774",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774",
+        "severity": "important",
+        "published_date": "2017-10-10"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2017-11774",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.",
+    "type": "outlook-home-page-code-execution",
+    "blast_radius": 14,
+    "poc_available": true,
+    "poc_description": "A working exploit is built into RULER, the public tool published at github.com/sensepost/ruler, whose homepage module sets the Outlook folder home page (the PR_FOLDER_WEBVIEWINFO property) to an attacker-hosted HTML page that runs script through the OutlookViewCtl ActiveX control. SensePost's post gives the exact command (ruler homepage add --url ...) and the HTML payload structure. Exploitation requires valid mailbox credentials first, which RULER also brute-forces.",
+    "iocs": {
+      "behavioral": [
+        "Outlook (outlook.exe) spawning a child process such as a script host, PowerShell or cmd shell when a folder is refreshed or Outlook restarts, which FireEye documents as the observable sign of this technique",
+        "A folder home page being set or changed through a MAPI SetProperties request on PR_FOLDER_WEBVIEWINFO, and a hidden folder created in the Inbox to force a refresh, as RULER does",
+        "Reconnaissance via WMIC and a PowerShell script dropped under %LOCALAPPDATA% shortly after Outlook loads a folder home page, as seen in the APT33 activity"
+      ],
+      "network": [
+        "Outlook retrieving a folder home page from any HTTP or HTTPS URL that is not on an approved list when a folder is opened, whether the URL is internal or external, since the home page can be any internal or external web location and is rendered through ieframe.dll",
+        "Post-exploitation beaconing from the workstation to an attacker command-and-control server, for example the POSHC2 and POWERTON endpoints FireEye recorded (such as 51.254.71.223 and 185.161.209.172) during the APT33 campaign",
+        "Exchange MAPI/HTTP requests carrying RULER's defaults: the User-Agent ruler, an NTLM authentication naming the workstation RULER, or the fixed X-ClientApplication value Outlook/15.0.4815.1002 from a client that is not that Outlook build. The User-Agent and workstation name are command-line options (--useragent and --hostname), so their absence does not clear a session"
+      ],
+      "host": [
+        "The PR_FOLDER_WEBVIEWINFO property (MAPI proptag 0x36DF0102) on a mailbox folder pointing to an unexpected URL, detectable with the NotRuler tool's homepage check",
+        "The registry value EnableRoamingFolderHomepages set to 1 under the Outlook Security key, or per-folder WebView URL entries, which re-enable the folder home page feature the October 2017 update disabled",
+        "Microsoft Outlook 2010 SP2 without 4011196, Outlook 2013 SP1 or RT SP1 without 4011178, or Outlook 2016 without 4011162 (the October 2017 updates)"
+      ],
+      "_ioc_source_note": "The home-page mechanism (PR_FOLDER_WEBVIEWINFO, the OutlookViewCtl control, the hidden-folder refresh trigger, the ruler homepage command, that the home page URL can be an internal or external location, and NotRuler detection) is read from SensePost's advisory at https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/ and the tool description at https://github.com/sensepost/ruler. RULER's default User-Agent (ruler), its default NTLM workstation name (RULER), its fixed X-ClientApplication value Outlook/15.0.4815.1002, its SetProperties write of proptag 0x36DF0102 on the Inbox and its hidden trigger folder (named xyz) were read from the RULER source at commit 1fe118cf168be711c3288032c880a53201f9b94d, for detection artifacts only. The Outlook-spawns-a-child observable, the WMIC and %LOCALAPPDATA% PowerShell reconnaissance, the POSHC2 and POWERTON command-and-control addresses (51.254.71.223, 185.161.209.172), the APT33 attribution and the FE_Exploit_HTML_CVE201711774 detection name are read from FireEye's report at https://cloud.google.com/blog/topics/threat-intelligence/overruled-containing-a-potentially-destructive-adversary. The EnableRoamingFolderHomepages and WebView registry indicators are read from Microsoft's article at https://support.microsoft.com/en-us/support/known-issues/outlook-home-page-feature-is-missing-in-folder-properties, and the per-version October 2017 update numbers from Microsoft's October 2017 security update data at https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2017-Oct. The command-and-control addresses are attributed by FireEye to the APT33-linked activity it describes and are not presented as covering every use of this technique."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Microsoft's advisory credits Etienne Stalmans of SensePost, an outside security company, and SensePost published the technique as a new RULER vector. No source describes AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2017-11774 (CWE-119, CVSS 7.8) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2017-11774.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to its KEV catalog on 2021-11-03 with a 2022-05-03 due date and records ransomware use as Unknown; the KEV forensicTriage flag is No. Microsoft's advisory marked the flaw not exploited at release on 2017-10-10 and describes a file-sharing scenario in which a user opens and interacts with a crafted document file. FireEye attributes in-the-wild use to APT33, an Iranian-linked actor, which used RULER's homepage module to set Outlook home pages for code execution and persistence and to deploy POSHC2 and POWERTON, and notes U.S. Cyber Command's July 2019 publication of CVE-2017-11774 indicators. The home page technique requires valid mailbox credentials, so that path follows credential theft or password spraying rather than a single crafted message.",
+    "attack_refs": [
+      "T1137.004",
+      "T1059.001",
+      "T1078"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 flaw remediation drives the October 2017 Outlook updates (4011196 for Outlook 2010 SP2, 4011178 for Outlook 2013 SP1 and RT SP1, 4011162 for Outlook 2016), which disable the folder home page feature. Because the fix is a feature removal that an operator can undo with the EnableRoamingFolderHomepages registry value, SI-2's patched-or-not model does not capture a host that took the update and then re-enabled the vulnerable feature, and its organization-defined period is not tuned to a technique already used by a state-linked actor.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe; for entities within Commission Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches within a reasonable time after they become available. For this Outlook flaw the October 2017 updates disable folder home pages in the client, but a home page URL already written to a mailbox folder's PR_FOLDER_WEBVIEWINFO property stays on the mailbox and loads again on any client that lacks the update or has EnableRoamingFolderHomepages set to 1, until the property is cleared; neither provision asks an entity to look for and clear that value after patching.",
+      "UK-CAF-B2": "CAF principle B2 (identity and access control) is the right control, because this technique requires valid mailbox credentials before the home page can be set. A B2 posture without multi-factor authentication on Outlook and Exchange access, and without detection of the password spraying FireEye documents, leaves the precondition met, and B2's account focus does not reach the mailbox-resident home page persistence that outlives a credential reset.",
+      "AU-Essential-8-Patch": "Essential Eight patch management places Outlook in the email client class, patched within two weeks at Maturity Levels One and Two (ISM-1691) and, at Maturity Level Three, within 48 hours when the vendor rates a flaw critical or a working exploit exists (ISM-1692) and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1901). RULER made a working exploit public, so the condition is met, yet the window only measures deployment of the October 2017 updates (4011196, 4011178 and 4011162) and does not account for a host that re-enables the feature by registry afterward, which patch metrics record as compliant.",
+      "ISO-27001-2022-A.8.16": "A.8.16 monitoring activities should detect the behavior this technique produces, namely Outlook spawning script or shell child processes when a folder refreshes. Where monitoring watches only email content and authentication events and does not baseline Outlook's process tree or MAPI property changes on mailbox folders, the home page persistence and its code execution run without an alert, which is the misinterpretation FireEye warns defenders about."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free patch for this flaw is documented. The October 2017 updates (4011196 for Outlook 2010 SP2, 4011178 for Outlook 2013 SP1 and RT SP1, 4011162 for Outlook 2016) disable the folder home page feature; Microsoft marks the restart requirement as Maybe rather than required, so no host reboot is inherent, but Outlook must be closed and relaunched for the change to take effect. Because the fix disables a feature that can be re-enabled with the EnableRoamingFolderHomepages registry value, applying the update alone does not close the flaw where that value is later set, and any home page already planted on a mailbox folder must be removed separately. Microsoft's lifecycle pages show that Outlook 2010 left extended support in October 2020, Outlook 2013 on April 11, 2023 and Outlook 2016 on October 14, 2025, so patched installs are still unsupported and must be replaced.",
+    "affected": "Microsoft Outlook, whose folder home page feature loads an attacker-set HTML URL and runs script with the user's privileges once the attacker has valid mailbox credentials, the path RULER and the APT33 activity use. Microsoft's advisory also describes a file-sharing scenario in which the user opens and interacts with a crafted document file.",
+    "affected_versions": [
+      "Microsoft Outlook 2010 SP2 (4011196), Outlook 2013 SP1 and Outlook 2013 RT SP1 (4011178), and Outlook 2016 (4011162), fixed by the October 2017 updates, which disable the folder home page feature"
+    ],
+    "vendor_update_paths": [
+      "Apply the October 2017 Outlook update for the installed version (4011196 for Outlook 2010 SP2, 4011178 for Outlook 2013 SP1 and RT SP1, 4011162 for Outlook 2016), which removes the folder home page feature, and close and relaunch Outlook so the change takes effect.",
+      "After patching, confirm the EnableRoamingFolderHomepages registry value is not re-enabled and audit mailbox folders for an unexpected PR_FOLDER_WEBVIEWINFO home page URL, removing any that were planted before the update.",
+      "Enforce multi-factor authentication on Outlook and Exchange access and reset exposed credentials, since the technique requires valid mailbox credentials to set the home page.",
+      "Replace Outlook 2010, 2013 and 2016, which are past the end of extended support, with a supported release (ISM-1704)."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 14,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 64,
+    "rwep_notes": "RWEP 64. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +14, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2021-27059": {
+    "name": "Microsoft Office Remote Code Execution Vulnerability (CVE-2021-27059)",
+    "cvss_score": 7.6,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
+    "cwe_refs": [],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "high",
+    "vector": "Microsoft has not published the flaw class, the affected component or the delivery method for CVE-2021-27059. Its update guide gives the title Microsoft Office Remote Code Execution Vulnerability, a CVSS 3.1 vector of AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H with a base score of 7.6, an Important severity rating and one FAQ stating that the Preview Pane is not an attack vector. The vector records a network attack vector, high attack complexity, high privileges required, required user interaction and a change of scope, with high impact on confidentiality, integrity and availability. For Office 2016 the fix is the MSI update KB4493225, which installs mso.dll 16.0.5134.1000 in both the 32-bit and 64-bit editions and also addresses CVE-2021-24108.",
+    "epss_score": 0.06076,
+    "epss_percentile": 0.93085,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-27059",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-27059",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27059",
+        "severity": "important",
+        "published_date": "2021-03-09"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-27059",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27059",
+        "severity": "important",
+        "published_date": "2021-03-09"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-27059",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27059",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27059"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Office contains an unspecified vulnerability that allows for remote code execution.",
+    "type": "office-client-remote-code-execution",
+    "blast_radius": 18,
+    "poc_available": false,
+    "poc_description": "No public exploit code was found. No NVD reference for this CVE is tagged Exploit, the Exploit-DB file index (files_exploits.csv) carries no entry that lists CVE-2021-27059, and web searches for the CVE id returned vulnerability-database pages only, with no Metasploit module, nuclei template or exploit repository. Microsoft's CVSS temporal vector records exploit code maturity as Unproven (E:U), while the same record marks the flaw as exploited, so the only public material is the vendor's statement that exploitation was detected. No root-cause analysis was found, and no exploit repository was read.",
+    "iocs": {
+      "behavioral": [
+        "An Office application (for example WINWORD.EXE, EXCEL.EXE or POWERPNT.EXE) on a host below the fixed build starting cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe or rundll32.exe shortly after a user opens a file received from outside the organization. This is a general hunting heuristic for Office exploitation; Microsoft has not published which Office application or file type this flaw involves.",
+        "An Office application process writing an executable, DLL or script into a user-writable directory such as %TEMP% or %APPDATA%, followed by a new process starting from that path. This is a general hunting heuristic rather than an artifact documented for this CVE.",
+        "An Office application on a host below the fixed build crashing repeatedly after opening files from outside the organization (Windows Application log Event ID 1000 naming the Office executable), which can accompany failed exploitation attempts. This is a general hunting heuristic."
+      ],
+      "network": [
+        "An Office application process opening an outbound HTTP or HTTPS connection to a host that is neither a Microsoft service nor an internal server immediately after a document opens, followed by a file download. This is a general hunting heuristic; no network artifact for this CVE has been published."
+      ],
+      "host": [
+        "Office 2016 installed as an MSI edition (32-bit or 64-bit) with mso.dll below 16.0.5134.1000, the version that KB4493225 installs. Click-to-Run installations of Office 2016 are outside that update.",
+        "Office 2013 Service Pack 1 installed as an MSI edition (32-bit or 64-bit) below build 15.0.5327.1000, or Office 2013 RT Service Pack 1 without KB4493228. Click-to-Run installations of Office 2013 are outside that update.",
+        "Office 2010 Service Pack 2 installed as an MSI edition (32-bit or 64-bit) below build 14.0.7266.5000, which means KB4504703 is not installed. Click-to-Run installations of Office 2010 are outside that update.",
+        "Any remaining installation of Office 2010, Office 2013 or Office 2016. Microsoft lists their end of support dates as October 13, 2020, April 11, 2023 and October 14, 2025."
+      ],
+      "_ioc_source_note": "The host group comes from Microsoft's affected-product record at https://api.msrc.microsoft.com/sug/v2.0/en-US/affectedProduct?%24filter=cveNumber%20eq%20%27CVE-2021-27059%27, which gives KB4493225, KB4493228 and KB4504703 with the fixed builds 16.0.5134.1000, 15.0.5327.1000 and 14.0.7266.5000; from the KB4493225 page at https://support.microsoft.com/en-us/servicing/office/hotfix/description-of-the-security-update-for-office-2016-march-9-2021-kb4493225, which lists mso.dll 16.0.5134.1000 for x86 and x64 and states that the update applies to the MSI-based edition and not to Click-to-Run editions; from the KB4493228 page at https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-office-2013-march-9-2021-kb4493228-1840e415-f0b4-004b-e879-463f3d756627 and the KB4504703 page at https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-office-2010-march-9-2021-kb4504703-85cc872c-c9bc-25d8-9278-c04b9550fb9b, which state the same MSI-only scope for Office 2013 and Office 2010; and from the end of support table at https://learn.microsoft.com/en-us/microsoft-365-apps/end-of-support/plan-upgrade-older-versions-office. Every behavioral and network item is a general hunting heuristic for Office exploitation rather than an artifact read from a source. Microsoft has not published the component, the file type or any exploitation details, and no detection content specific to this CVE (a nuclei template, a Sigma rule or a vendor detection rule) was found in the sources consulted. No exploit repository was read. No actor infrastructure, file hash or C2 address is listed, because no source consulted attributes this CVE to a named campaign or operator."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Microsoft's acknowledgement for CVE-2021-27059 credits Chi-Yu You and Dhanesh Kizhakkinan of FireEye Inc. as the finders, and Microsoft added that credit on 2021-03-12 in the same revision that set the Exploited flag to Yes. No source describes how they found the flaw or any use of AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-27059 (no CWE assigned, CVSS 7.6) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2021-27059 (Microsoft Office Remote Code Execution Vulnerability). Microsoft's acknowledgement names Chi-Yu You and Dhanesh Kizhakkinan of FireEye Inc. as the finders.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2021-27059 to the KEV catalog on 2021-11-03 with a due date of 2021-11-17 and records known ransomware campaign use as Unknown; the KEV entry does not flag the CVE for forensic triage. Microsoft released the fix on 2021-03-09. Revision 1.1 of its update guide entry, dated 2021-03-12, added the FireEye acknowledgement and changed the Exploited flag to Yes, with Exploitation Detected recorded for both the latest and older software releases. Microsoft describes that revision as an informational update only and has published no description of the exploitation, the delivery method or the targets. No source consulted names a campaign, actor or incident report for this CVE.",
+    "attack_refs": [
+      "T1203",
+      "T1204.002"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires flaws to be identified, reported and corrected, and security-relevant updates to be installed within time periods the organization defines. Where an organization sets those periods by vendor severity or CVSS base score, CVE-2021-27059 falls below the critical tier: Microsoft rates it Important rather than Critical, and its CVSS 3.1 base score of 7.6 is held below the critical range by high attack complexity and high privileges required, with a temporal exploit maturity of Unproven (E:U) in the same record that marks the flaw exploited. SI-2 leaves the period to the organization and does not require an exploited status to move an update ahead of its severity tier.",
+      "NIS2-Art21-patch-management": "Article 21(2)(e) of NIS2 requires vulnerability handling and sets no timeframe. For entities within the scope of Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires patch procedures, coherent with vulnerability management and risk management, that ensure security patches are applied within a reasonable time after they become available, and point 6.10.2 requires entities to monitor vulnerability information through channels that include information provided by suppliers and to address without undue delay the vulnerabilities they identify as critical to their operations. Neither point sets a fixed timeframe, and the undue-delay duty depends on the entity's own judgment of criticality. The fix for CVE-2021-27059 became available on 2021-03-09 with an Important rating and a CVSS base score of 7.6, and Microsoft recorded the exploitation only in revision 1.1 on 2021-03-12, which it labeled an informational update only. The Annex leaves it to the entity whether that later exploited status makes the update critical to its operations and moves it ahead of its routine patch cycle.",
+      "UK-CAF-B4": "CAF principle B4.d (vulnerability management) asks that announced vulnerabilities in the software supporting an essential function are tracked and prioritized and that externally exposed vulnerabilities are mitigated, for example by patching, promptly. It rates unsupported software that is not suitably mitigated, or not being replaced, as Not achieved. B4.d gives no time limit for prompt mitigation of CVE-2021-27059, a flaw that Microsoft rated Important at release on 2021-03-09 and marked exploited on 2021-03-12. Every affected release (Office 2010, Office 2013 and Office 2016) is now past Microsoft's end of support, the latest being Office 2016 on October 14, 2025, and the Partially achieved outcome accepts temporary mitigations for unsupported software while migration to supported technology is pursued, without a date by which that migration must be complete.",
+      "AU-Essential-8-Patch": "The Essential Eight requires office suites to be patched within two weeks of release at Maturity Levels One and Two (ISM-1691). At Maturity Level Three it requires 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1692), and two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1901). Microsoft released the fixes for CVE-2021-27059 on 2021-03-09 rated Important and changed its Exploited flag to Yes on 2021-03-12, after a 48-hour window from release had closed on 2021-03-11. An organization at Maturity Level Three that classified the update on release-day information therefore placed it in the two-week window ending 2021-03-23, the same deadline as Levels One and Two, which left 11 days between Microsoft's exploitation notice and the deadline. ISM-1704 requires unsupported office suites to be replaced or removed at every maturity level, and it now applies to every affected release: Office 2010 since October 13, 2020, Office 2013 since April 11, 2023 and Office 2016 since October 14, 2025.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires information about technical vulnerabilities of information systems in use to be obtained, the organization's exposure to be evaluated and appropriate measures to be taken. Exposure to CVE-2021-27059 depends on how Office was installed: Microsoft's affected-product list names Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1 and Office 2016, with no Office 2019, Click-to-Run or Microsoft 365 Apps entry, and the updates KB4493225, KB4493228 and KB4504703 apply to the MSI-based editions of Office 2016, Office 2013 and Office 2010 and not to their Click-to-Run editions. An asset register that records an Office release without its install technology and build cannot tell a host that needs one of those updates from one that Microsoft does not list as affected."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path exists for this fix. Remediation is an MSI security update (KB4493225, KB4493228 or KB4504703) installed through Microsoft Update, the Microsoft Update Catalog or the Microsoft Download Center. Microsoft gives the restart requirement as Maybe for the Office 2010, Office 2013 RT and Office 2016 packages and gives none for Office 2013 SP1; no source states that a host reboot is always required. Office applications must be closed and reopened to load the updated files. Every affected release is past Microsoft's end of support: Office 2010 on October 13, 2020, Office 2013 on April 11, 2023 and Office 2016 on October 14, 2025. Microsoft still published KB4504703 for Office 2010 SP2 in March 2021, after that product's end of support date.",
+    "affected": "Microsoft Office 2010 Service Pack 2, Office 2013 Service Pack 1 and Office 2016 (32-bit and 64-bit) in their MSI-based editions, and Office 2013 RT Service Pack 1. Microsoft rates the impact as remote code execution, and its CVSS vector records a change of scope with high confidentiality, integrity and availability impact, so a successful attack runs code on the Windows or Windows RT host where a user works in the affected Office release. Microsoft lists no Office 2019, Click-to-Run or Microsoft 365 Apps product.",
+    "affected_versions": [
+      "Microsoft Office 2016, MSI-based edition, 32-bit and 64-bit: builds before 16.0.5134.1000 are affected (16.0.5134.1000, delivered by KB4493225 with mso.dll 16.0.5134.1000, is fixed). Office 2016 Click-to-Run editions are outside KB4493225 and are not listed by Microsoft.",
+      "Microsoft Office 2013 Service Pack 1, MSI-based edition, 32-bit and 64-bit: builds before 15.0.5327.1000 are affected (15.0.5327.1000, delivered by KB4493228, is fixed). Office 2013 Click-to-Run editions are outside KB4493228 and are not listed by Microsoft.",
+      "Microsoft Office 2013 RT Service Pack 1: affected until KB4493228 is installed; Microsoft lists no fixed build number for this edition.",
+      "Microsoft Office 2010 Service Pack 2, MSI-based edition, 32-bit and 64-bit: builds before 14.0.7266.5000 are affected (14.0.7266.5000, delivered by KB4504703, is fixed). Office 2010 Click-to-Run editions are outside KB4504703 and are not listed by Microsoft."
+    ],
+    "vendor_update_paths": [
+      "Office 2016 (MSI-based edition, 32-bit and 64-bit): install security update KB4493225, which brings the build to 16.0.5134.1000 (mso.dll 16.0.5134.1000), replaces KB4484466 and also addresses CVE-2021-24108. Microsoft distributes it through Microsoft Update, the Microsoft Update Catalog and the Microsoft Download Center. It does not apply to Office 2016 Click-to-Run editions.",
+      "Office 2013 Service Pack 1 (MSI-based edition, 32-bit and 64-bit): install KB4493228, fixed build 15.0.5327.1000, which replaces KB4484469. It does not apply to Office 2013 Click-to-Run editions. Office 2013 RT Service Pack 1 takes the same KB4493228; Microsoft lists no build number or Download Center link for that edition.",
+      "Office 2010 Service Pack 2 (MSI-based edition, 32-bit and 64-bit): install KB4504703, fixed build 14.0.7266.5000, which replaces KB4486698. It does not apply to Office 2010 Click-to-Run editions.",
+      "After installing, close and reopen every Office application so that it loads the updated files. Microsoft gives the restart requirement as Maybe for the Office 2010, Office 2013 RT and Office 2016 packages.",
+      "Replace Office 2010, Office 2013 and Office 2016 with a supported release. Microsoft lists their end of support dates as October 13, 2020, April 11, 2023 and October 14, 2025, and its upgrade planning guidance covers moving from these versions to Microsoft 365 Apps."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 48,
+    "rwep_notes": "RWEP 48. cisa_kev +25, active_exploitation +20, blast_radius +18, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2021-36948": {
+    "name": "Microsoft Windows Update Medic Service Privilege Escalation Vulnerability",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "An attacker who can already run code on an affected host as a low-privileged local user exploits a flaw in the Windows Update Medic Service to gain elevated privileges, with no user interaction and high impact to confidentiality, integrity and availability (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft published the fix on 2021-08-10 in its August 2021 security updates and marked the flaw as exploited at release. Its advisory gives no description beyond the title, so the root cause and the privilege level reached are not public.",
+    "epss_score": 0.2327,
+    "epss_percentile": 0.97677,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-36948",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-36948",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36948",
+        "severity": "important",
+        "published_date": "2021-08-10"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-36948",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36948",
+        "severity": "important",
+        "published_date": "2021-08-10"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-36948",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36948",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36948"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.",
+    "type": "windows-service-local-privilege-escalation",
+    "blast_radius": 22,
+    "poc_available": false,
+    "poc_description": "No public exploit code was found. NVD lists three references for this CVE (two Microsoft advisory links and the CISA KEV entry), and none is tagged Exploit. The Exploit-DB index at https://gitlab.com/exploit-database/exploitdb/-/raw/main/files_exploits.csv has no entry carrying CVE-2021-36948, and the Metasploit module metadata at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/db/modules_metadata_base.json has no module that references it. Google Project Zero's 2021 in-the-wild sheet records no analysis and no root-cause write-up for it. Microsoft's temporal CVSS vector records functional exploit code maturity (E:F) and its advisory marks the flaw as exploited, which is a vendor statement that exploitation occurred rather than code hosted at a named location. No exploit repository was read.",
+    "iocs": {
+      "behavioral": [
+        "A process running at System integrity level whose parent process runs under an ordinary user account rather than SYSTEM, LOCAL SERVICE, NETWORK SERVICE, a DWM- account or a machine account, recorded in Sysmon Event ID 1 process-creation events. This is the logic of Splunk's published analytic for privilege escalation to SYSTEM from a user-controlled process, and it is not specific to this CVE.",
+        "Activity that requires administrative rights, such as creating a service, changing a security tool or reading a credential store, performed by code that started under an ordinary local user on a host running an affected build, with no administrator logon or consent prompt recorded between the two."
+      ],
+      "network": [],
+      "host": [
+        "A running OS build below the fixed build for its version: 10.0.17763.2114 for Windows 10 Version 1809, Windows 10 Enterprise LTSC 2019 and Windows Server 2019; 10.0.18363.1734 for Windows 10 Version 1909; 10.0.19041.1165 for Windows 10 Version 2004 and Windows Server, version 2004; 10.0.19042.1165 for Windows 10 Version 20H2 and Windows Server, version 20H2; 10.0.19043.1165 for Windows 10 Version 21H1.",
+        "KB5005030, KB5005031 or KB5005033 reported as installed on a host whose running build is still below the fixed build for its version, which means the restart Microsoft requires for the update has not happened.",
+        "A host still running Windows 10 Version 1809 in a non-LTSC edition, Windows 10 Version 1909, 2004, 20H2 or 21H1, or Windows Server, version 2004 or 20H2. Microsoft's Windows 10 release information page marks versions 1909, 2004, 20H2 and 21H1 as end of updates, and Microsoft's lifecycle pages show that servicing has ended for the non-LTSC editions of version 1809 and for Windows Server, version 2004 and 20H2."
+      ],
+      "_ioc_source_note": "The fixed builds, the KB numbers and the restart requirement come from Microsoft's August 2021 security update data at https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2021-Aug, and the build-to-KB rows and the end-of-updates status of Windows 10 Versions 1909, 2004, 20H2 and 21H1 come from https://learn.microsoft.com/en-us/windows/release-health/release-information. The end of servicing for the non-LTSC editions of Windows 10 Version 1809 comes from https://learn.microsoft.com/en-us/lifecycle/products/windows-10-home-and-pro and https://learn.microsoft.com/en-us/lifecycle/products/windows-10-enterprise-and-education, and for Windows Server, version 2004 and 20H2 from https://learn.microsoft.com/en-us/lifecycle/products/windows-server-semiannual-channel. The first behavioral item restates the logic of the Splunk analytic at https://research.splunk.com/endpoint/5a5351cd-ba7e-499e-ad82-2ce160ffa637/, which detects privilege escalation to SYSTEM in general rather than this flaw. The second behavioral item is a general hunting heuristic rather than an artifact read from a source. Microsoft published no technical description of the flaw and no public analysis was found, so no CVE-specific process, file, registry or event artifact is listed. The network group is empty because the flaw is local (CVSS AV:L). No actor infrastructure, file hash or C2 address is listed, because no source attributes this CVE to a named campaign. No exploit repository was read, because none was found."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Microsoft's advisory acknowledges two of its own teams, the Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Security Response Center (MSRC), and Google Project Zero's 2021 in-the-wild sheet lists the same two teams as the reporters. Microsoft marked the flaw as exploited when it published the fix, and no source mentions AI tooling.",
+    "ai_discovery_source": "vendor_research",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-36948 (NVD-CWE-noinfo, CVSS 7.8) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2021-36948 (Windows Update Medic Service Elevation of Privilege Vulnerability, August 2021 security updates).",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "Microsoft's advisory, published with the fix on 2021-08-10, records 'Publicly Disclosed:No;Exploited:Yes' with 'Exploitation Detected' for both the latest and older software releases, so the flaw was exploited before any fix existed. Microsoft credits its own Threat Intelligence Center (MSTIC) and Security Response Center (MSRC). Google Project Zero's 2021 in-the-wild zero-day sheet lists the flaw with MSTIC and MSRC as reporters and records no analysis or root-cause write-up. CISA added it to KEV on 2021-11-03 with a due date of 2021-11-17, records known ransomware use as Unknown, and does not flag it for forensic triage. No source consulted names the actor, campaign, targets or delivery chain.",
+    "attack_refs": [
+      "T1068"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires flaws to be identified and security-relevant updates to be installed within an organization-defined period of their release. Microsoft rated CVE-2021-36948 Important with a CVSS base score of 7.8 but marked it 'Exploitation Detected' in the same advisory that shipped the fix on 2021-08-10, so an SI-2 period keyed to vendor severity or base score places an already-exploited flaw in a routine tier. Microsoft also lists a restart as required for KB5005030, KB5005031 and KB5005033, so SI-2 evidence that the update was deployed does not show that a host is running build 10.0.17763.2114, 10.0.18363.1734, 10.0.19041.1165, 10.0.19042.1165 or 10.0.19043.1165.",
+      "NIST-800-53-SI-4": "SI-4 requires systems to be monitored to detect attacks and indicators of potential attacks. Microsoft's advisory for CVE-2021-36948 contains no description, event, file or registry artifact, and no public analysis was found, so SI-4 monitoring on Windows 10 and Windows Server 2019 hosts can only look for the generic result of a local escalation, such as a System-integrity process started by a user-owned parent. It cannot attribute an alert to this flaw, and it cannot clear a host that ran an affected build during the exploitation Microsoft detected before 2021-08-10.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe. For entities within the scope of Commission Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available, and requires additional measures, with residual risk accepted, where a patch is not available; Annex point 6.10.2(c) requires vulnerabilities that the entity identifies as critical to its operations to be addressed without undue delay. For CVE-2021-36948 the patch and Microsoft's exploitation notice arrived together on 2021-08-10 with no workaround. Before that date the flaw was exploited but undisclosed, so an entity had no basis for the additional measures. After it, the faster tier in point 6.10.2(c) depends on the entity's own judgment of what is critical to its operations, and the Annex does not tie that judgment to a vendor's report of exploitation, so an entity that ranks updates by Microsoft's Important rating need not treat this exploited flaw as critical.",
+      "UK-CAF-B4": "CAF principle B4 (system security) includes B4.d, whose Achieved level expects announced vulnerabilities to be tracked, prioritized and mitigated (for example by patching) promptly, and B4.d sets no timeframe for 'promptly'. Microsoft published no workaround or mitigation for CVE-2021-36948, so until an affected Windows 10, Windows Server 2019, or Windows Server, version 2004 or 20H2 host that supports an essential function runs a fixed build or a supported release, any temporary mitigation, such as restricting who can run code locally, is the operator's own design, and B4.d does not say what makes such a mitigation adequate for a local flaw Microsoft marked as exploited.",
+      "AU-Essential-8-Patch": "The Essential Eight patch operating systems strategy covers these hosts. Windows 10 workstations and non-internet-facing Windows Server hosts must be patched within one month at Maturity Levels One and Two (ISM-1695); at Maturity Level Three, within 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1696) and within one month when the vendor rates it non-critical and no working exploit exists (ISM-1902). An internet-facing Windows Server host must be patched, at every maturity level, within 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1877) and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1694). Microsoft rated this flaw Important, not critical, but marked it as exploited when it released the fix on 2021-08-10, so the working-exploit half of the condition was met from release and the 48-hour windows ran from that date. The shortfall has two parts: at Maturity Levels One and Two a Windows 10 workstation can stay unpatched for a month after exploitation was already known and remain compliant, and every window starts at the vendor's release, so the exploitation Microsoft detected before 2021-08-10 fell outside any window. Hosts still running a non-LTSC edition of Windows 10 Version 1809, Windows 10 Version 1909, 2004, 20H2 or 21H1, or Windows Server, version 2004 or 20H2 run operating system versions Microsoft no longer updates, which must be replaced at every maturity level (ISM-1501).",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires information about technical vulnerabilities to be obtained, the organization's exposure to be evaluated and appropriate measures to be taken. For CVE-2021-36948 Microsoft published only the title, the CVSS vector, the fixed builds and the exploitation flag, with no description, workaround or mitigation, so the exposure evaluation reduces to comparing each host's running build with 10.0.17763.2114, 10.0.18363.1734, 10.0.19041.1165, 10.0.19042.1165 or 10.0.19043.1165. A.8.8 leaves the timescale to the organization, and a scheme that ranks updates by the Important rating rather than by the exploitation flag schedules this one as routine."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free path is documented for this fix. Microsoft lists a restart as required for each of KB5005030, KB5005031 and KB5005033 and publishes no workaround or mitigation for this CVE. Microsoft's Windows 10 release information page states that Windows 10 reached end of support on October 14, 2025 and marks versions 1909, 2004, 20H2 and 21H1 as end of updates, and Microsoft's Windows Server Semi-Annual Channel lifecycle page shows that servicing has ended for Windows Server, version 2004 and 20H2. Hosts on Windows 10 Version 1909 Enterprise, Education or IoT Enterprise, on Windows 10 Versions 2004, 20H2 or 21H1, or on Windows Server, version 2004 or 20H2 can receive the August 2021 fix but no fixes for later flaws. Hosts on a non-LTSC edition of Windows 10 Version 1809 or on Windows 10 Version 1909 Home, Pro, Pro Education or Pro for Workstations have no fix from Microsoft: KB5005030 and KB5005031 do not apply to those editions, and Microsoft's lifecycle pages show that their servicing ended before 2021-08-10. The release information page lists Windows 10 Enterprise LTSC 2019 (version 1809, build 17763) with extended support to 2029-01-09 and a latest build of 17763.9247 dated 2026-09-14.",
+    "affected": "Windows Update Medic Service in Windows 10 Versions 1809, 1909, 2004, 20H2 and 21H1 (32-bit, x64 and ARM64), including Windows 10 Enterprise LTSC 2019 on the 1809 build line; Windows Server 2019 including Server Core installations; and Windows Server, version 2004 and version 20H2 Server Core installations. A local user who can already run code on the host gains elevated privileges, with high impact to confidentiality, integrity and availability. Microsoft has not published the root cause or the privilege level reached.",
+    "affected_versions": [
+      "Windows 10 Version 1809 (32-bit, x64, ARM64) in the editions KB5005030 applies to (Windows 10 Enterprise LTSC 2019, Windows 10 IoT Enterprise LTSC 2019 and Windows 10 IoT Core LTSC), and Windows Server 2019 including Server Core: builds before 10.0.17763.2114 are affected; 10.0.17763.2114 (KB5005030, restart required) is fixed.",
+      "Windows 10 Version 1909 (32-bit, x64, ARM64) in the editions KB5005031 applies to (Enterprise, Education and IoT Enterprise): builds before 10.0.18363.1734 are affected; 10.0.18363.1734 (KB5005031, restart required) is fixed.",
+      "Windows 10 Version 1809 in its non-LTSC editions (those under Microsoft's Windows 10 Home and Pro and Windows 10 Enterprise and Education lifecycle policies) and Windows 10 Version 1909 Home, Pro, Pro Education and Pro for Workstations: Microsoft's advisory lists both versions as affected, but KB5005030 and KB5005031 do not apply to these editions, whose servicing had ended before 2021-08-10 according to Microsoft's lifecycle pages, so Microsoft published no fix for them. The remediation is an upgrade to a supported release.",
+      "Windows 10 Version 2004 (32-bit, x64, ARM64) and Windows Server, version 2004 (Server Core installation): builds before 10.0.19041.1165 are affected; 10.0.19041.1165 (KB5005033, restart required) is fixed.",
+      "Windows 10 Version 20H2 (32-bit, x64, ARM64) and Windows Server, version 20H2 (Server Core installation): builds before 10.0.19042.1165 are affected; 10.0.19042.1165 (KB5005033, restart required) is fixed.",
+      "Windows 10 Version 21H1 (32-bit, x64, ARM64): builds before 10.0.19043.1165 are affected; 10.0.19043.1165 (KB5005033, restart required) is fixed.",
+      "Microsoft's advisory lists no other products; see the Microsoft Security Update Guide entry for CVE-2021-36948 for the full product list."
+    ],
+    "vendor_update_paths": [
+      "Install the August 2021 security update for the host's version, or any later monthly update for that version: KB5005030 (build 10.0.17763.2114) for Windows 10 Enterprise LTSC 2019, Windows 10 IoT Enterprise LTSC 2019, Windows 10 IoT Core LTSC and Windows Server 2019 including Server Core; KB5005031 (build 10.0.18363.1734) for Windows 10 Version 1909 Enterprise, Education and IoT Enterprise; KB5005033 (builds 10.0.19041.1165, 10.0.19042.1165 and 10.0.19043.1165) for Windows 10 Versions 2004, 20H2 and 21H1 and for Windows Server, version 2004 and version 20H2 Server Core installations.",
+      "Microsoft published no fix for the non-LTSC editions of Windows 10 Version 1809 or for Windows 10 Version 1909 Home, Pro, Pro Education and Pro for Workstations, whose servicing had ended before 2021-08-10. Upgrade those hosts to a supported release.",
+      "Restart each host after installing the update. Microsoft lists a restart as required for all three updates, and the host runs the fixed build only after it restarts, so confirm the running build on the host itself rather than relying on the deployment report.",
+      "Microsoft publishes no workaround or mitigation for this CVE. Until the update is installed and the host restarted, or until a host on an edition with no fix is upgraded, restrict who can run code locally on affected hosts; this is an operator measure, not a vendor mitigation.",
+      "After closing this CVE, upgrade hosts on Windows 10 Version 1909 Enterprise, Education or IoT Enterprise, Windows 10 Version 2004, 20H2 or 21H1, or Windows Server, version 2004 or 20H2 to a supported release, because Microsoft no longer updates those versions and they receive no fixes for later flaws."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 57,
+    "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2021-31199": {
+    "name": "Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability (CVE-2021-31199)",
+    "cvss_score": 5.2,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+    "cwe_refs": [
+      "CWE-269"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "A local, low-privileged user triggers a flaw in the Windows Enhanced Cryptographic Provider (Windows Cryptographic Services) to elevate privilege; Microsoft records it as related to Adobe's CVE-2021-28550, and the Zero Day Initiative places it as the privilege-escalation stage of that document-reader exploit chain.",
+    "epss_score": 0.02954,
+    "epss_percentile": 0.86596,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-31199",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-31199",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31199",
+        "severity": "important",
+        "published_date": "2021-06-08"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-31199",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31199"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.",
+    "type": "crypto-provider-privilege-escalation",
+    "blast_radius": 27,
+    "poc_available": false,
+    "poc_description": "No public exploit code was found. There is no Exploit-DB entry, no Metasploit module, no ProjectDiscovery nuclei template and no named public GitHub repository for CVE-2021-31199; a GitHub repository search returned zero results. The public material is limited to vendor and third-party advisories that describe this flaw as the local privilege-escalation half of an exploit chain paired with the Adobe Acrobat and Reader use-after-free CVE-2021-28550, with no reproducer hosted.",
+    "iocs": {
+      "behavioral": [
+        "A process running as a low-privileged local user, or a document reader such as Acrobat or Reader, obtaining a token or writing to a location that belongs to a higher-integrity context shortly after opening an untrusted file, which is consistent with pairing this local escalation with the CVE-2021-28550 document exploit",
+        "Signs of the paired Adobe Acrobat and Reader exploitation of CVE-2021-28550 on the same host, which the Zero Day Initiative describes as the delivery stage of the exploit chain this escalation completes"
+      ],
+      "network": [],
+      "host": [
+        "A Windows build below the June 8, 2021 fixed level for the running version, for example Windows 10 Version 1809 or Windows Server 2019 below 10.0.17763.1999, or Windows 7 SP1 and Windows Server 2008 R2 SP1 below 6.1.7601.25632",
+        "The running Windows build is below its version's June 8, 2021 fixed level and neither the June 2021 cumulative or monthly-rollup security update nor any later cumulative update is installed; compare the OS build against the fixed build rather than looking for one KB, so a host that took a later update superseding the June one is not flagged",
+        "On Windows 7, Windows Server 2008 and Windows Server 2008 R2, the absence of an Extended Security Updates entitlement, since the June 2021 fix for those versions ships only through that program"
+      ],
+      "_ioc_source_note": "No detection-grade artifact source (nuclei template, CERT advisory indicator list or exploit repository) exists for this local privilege escalation, because no public exploit was found; the entries above are general hunting heuristics rather than artifacts read from an exploit. The chain relationship to Adobe CVE-2021-28550 comes from the Zero Day Initiative June 2021 update review at https://www.zerodayinitiative.com/blog/2021/6/8/the-june-2021-security-update-review, and the exploited-in-the-wild status and fixed build numbers come from Microsoft's June 2021 security update document at https://api.msrc.microsoft.com/cvrf/v2.0/cvrf/2021-Jun, which records Exploited:Yes. No actor infrastructure, file hash or command-and-control address is listed, because no source attributes this CVE to a named campaign or operator."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "No source states that AI tooling found this flaw. Microsoft's June 2021 security update document carries no acknowledgment for it, and Google Project Zero's 2021 in-the-wild tracker shows '???' for the reporter, the analysis URL and the root-cause analysis of CVE-2021-31199.",
+    "ai_discovery_source": "unknown",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-31199 (NVD-CWE-noinfo; CWE-269 supplied from the vocabulary as the entry's own classification, CVSS 5.2) + CISA KEV (added 2021-11-03) + Microsoft June 2021 security update document (https://api.msrc.microsoft.com/cvrf/v2.0/cvrf/2021-Jun). No source names a party that found or reported the flaw; Microsoft's document carries no acknowledgment and the Zero Day Initiative review credits no researcher, so the finder is recorded as unknown rather than assumed to be the vendor.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2021-11-17 due date and records known ransomware use as Unknown. Microsoft's June 2021 security update document marks the flaw Exploited:Yes on both the latest and older software releases and Publicly Disclosed:No. The Zero Day Initiative's June 2021 review states it seems these two vulnerabilities were the privilege-escalation part of the exploits that used the actively attacked Adobe Reader flaw CVE-2021-28550. No source names a specific actor or campaign for CVE-2021-31199. The KEV entry does not flag forensic triage.",
+    "attack_refs": [
+      "T1068"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 flaw remediation relies on an organizationally-defined time period, but this flaw was exploited in the wild as a zero-day before Microsoft shipped the June 8, 2021 fix, so no remediation window was running during the exposure and SI-2 could not have driven a patch that did not yet exist. Once the fix shipped, SI-2's cycle-based cadence still lags the incident-speed response a KEV-listed, exploited local escalation demands.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Article 21(2)(e) requires vulnerability handling and disclosure but sets no timeframe, so it gives an operator no accelerated clock once a Windows elevation of privilege is confirmed exploited and chained with a document-reader remote code execution. For operators within the scope of Commission Implementing Regulation (EU) 2024/2690, point 6.6.1 requires security patches to be applied within a reasonable time after they become available, which for this flaw began only when the June 8, 2021 update shipped, after exploitation had started.",
+      "UK-CAF-B4": "CAF B4.d asks that announced vulnerabilities are tracked and prioritized and that externally exposed vulnerabilities are mitigated, for example by patching, promptly; at Achieved it asks for prompt mitigation of all announced vulnerabilities. CVE-2021-31199 is a local escalation that is not itself externally exposed, so at Partially achieved B4.d accepts a temporary mitigation for it for an extended period, but Microsoft published no workaround or mitigation for this flaw, and the June 8, 2021 update was the only measure that closed it. Applying Adobe's earlier fix for the paired CVE-2021-28550 closed the observed delivery path but not the escalation. B4.d does not define 'promptly' for a flaw that Microsoft marked as already exploited on the day it disclosed it.",
+      "AU-Essential-8-Patch": "Windows operating systems fall under the Essential Eight patch controls. Those of workstations and non-internet-facing servers are patched within one month at Maturity Levels One and Two (ISM-1695), and at Maturity Level Three within 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1696) and within one month when the vendor rates it non-critical and no working exploit exists (ISM-1902). The operating systems of internet-facing Windows Server instances are patched within 48 hours at every maturity level when the vendor rates the flaw critical or a working exploit exists (ISM-1877) and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1694). Microsoft rated this flaw important but marked it exploited, and it is KEV-listed, so a working exploit exists and the 48-hour windows apply; the shortfall is that exploitation preceded the June 8, 2021 update, so no window ran during the earliest attacks, and below Maturity Level Three a workstation operating system still has a month once the fix exists.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities of systems in use is obtained, the organization's exposure is evaluated, and appropriate measures are taken. The first public information about CVE-2021-31199 was Microsoft's June 8, 2021 release, which published the flaw and its fix together and already marked it exploited, so the control had nothing to act on before exploitation began. The same release rated the flaw Important rather than Critical, so an organization whose evaluation sets remediation timescales by vendor severity places this exploited escalation in a slower tier."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free path is documented for this fix. The June 8, 2021 Windows cumulative and monthly-rollup security updates require a host reboot, and on Windows 7, Windows Server 2008 and Windows Server 2008 R2 the fix ships only through the Extended Security Updates program.",
+    "affected": "Microsoft Windows, the Enhanced Cryptographic Provider component (Windows Cryptographic Services). A local, low-privileged user can elevate privilege. Sources describe the flaw as the privilege-escalation half of an exploit chain paired with the Adobe Acrobat and Reader flaw CVE-2021-28550. This is a distinct vulnerability from its sibling CVE-2021-31201, which Microsoft fixed in the same June 2021 updates.",
+    "affected_versions": [
+      "Windows 10 Version 1809 and Windows Server 2019 before 10.0.17763.1999 (fixed by KB5003646)",
+      "Windows 10 Version 1909 before 10.0.18363.1621 (KB5003635)",
+      "Windows 10 Versions 2004, 20H2 and 21H1 and Windows Server versions 2004 and 20H2 before 10.0.19041.1052 / 10.0.19042.1052 / 10.0.19043.1052 (KB5003637)",
+      "Windows 10 Version 1607 and Windows Server 2016 before 10.0.14393.4467 (KB5003638)",
+      "Windows 10 Version 1507 before 10.0.10240.18967 (KB5003687)",
+      "Windows 8.1, Windows RT 8.1 and Windows Server 2012 R2 before the June 8, 2021 fix, applied as monthly rollup KB5003671 (build 6.3.9600.20045) or security-only KB5003681 (build 6.3.9600.20044)",
+      "Windows Server 2012 before 6.2.9200.23372, applied as monthly rollup KB5003697 or security-only KB5003696",
+      "Windows 7 SP1 and Windows Server 2008 R2 SP1 before 6.1.7601.25632, applied as monthly rollup KB5003667 or security-only KB5003694 (supplied only through the Extended Security Updates program)",
+      "Windows Server 2008 SP2 before 6.0.6003.21137, applied as monthly rollup KB5003661 or security-only KB5003695 (Extended Security Updates program only). See Microsoft's June 2021 security update guide for the full product list."
+    ],
+    "vendor_update_paths": [
+      "Install the June 8, 2021 cumulative or monthly-rollup security update for the running Windows version (for example KB5003646 for Windows 10 Version 1809 and Windows Server 2019, KB5003637 for Windows 10 Versions 2004 through 21H1, KB5003671 or security-only KB5003681 for Windows 8.1 and Windows Server 2012 R2, KB5003667 for Windows 7 SP1 and Windows Server 2008 R2 SP1). Each update requires a host reboot. Microsoft's June 2021 update guide states that customers running affected Windows versions should install the June security updates to be fully protected from these vulnerabilities.",
+      "On Windows 7, Windows Server 2008 and Windows Server 2008 R2 the fix is available only under the Extended Security Updates program, so confirm the ESU entitlement is in place before deploying.",
+      "Also apply the Adobe Acrobat and Reader update from Adobe security bulletin APSB21-29, which fixes the related flaw CVE-2021-28550: the Zero Day Initiative describes these Enhanced Cryptographic Provider flaws as the privilege-escalation stage of exploits that used that Adobe flaw, so applying APSB21-29 removes the document-reader entry point the observed chain relied on."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 27,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 62,
+    "rwep_notes": "RWEP 62. cisa_kev +25, active_exploitation +20, blast_radius +27, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2021-31201": {
+    "name": "Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability (CVE-2021-31201)",
+    "cvss_score": 5.2,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+    "cwe_refs": [
+      "CWE-269"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "A local, low-privileged user triggers a flaw in the Windows Enhanced Cryptographic Provider (Windows Cryptographic Services) to elevate privilege; NVD records it as distinct from its sibling CVE-2021-31199, and Microsoft relates both to Adobe's CVE-2021-28550, which the Zero Day Initiative places as the document-reader stage of the same exploit chain.",
+    "epss_score": 0.02617,
+    "epss_percentile": 0.84785,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-31201",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-31201",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31201",
+        "severity": "important",
+        "published_date": "2021-06-08"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-31201",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31201"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.",
+    "type": "crypto-provider-privilege-escalation",
+    "blast_radius": 27,
+    "poc_available": false,
+    "poc_description": "No public exploit code was found. There is no Exploit-DB entry, no Metasploit module, no ProjectDiscovery nuclei template and no named public GitHub repository for CVE-2021-31201; a GitHub repository search returned zero results. Public material is limited to vendor and third-party advisories that place this flaw, alongside its sibling CVE-2021-31199, as the local privilege-escalation stage of an exploit chain paired with the Adobe Acrobat and Reader use-after-free flaw CVE-2021-28550, with no reproducer hosted.",
+    "iocs": {
+      "behavioral": [
+        "A low-privileged local process gaining a higher-integrity token in close sequence with a document reader opening an untrusted file, matching the way this escalation is paired with the CVE-2021-28550 document exploit",
+        "The paired Adobe Acrobat and Reader exploitation of CVE-2021-28550 seen on the same host, which the Zero Day Initiative describes as the delivery stage of the chain this escalation completes"
+      ],
+      "network": [],
+      "host": [
+        "A Windows build below the June 8, 2021 fixed level, for example Windows 10 Version 1809 or Windows Server 2019 below 10.0.17763.1999, Windows Server 2012 below 6.2.9200.23372, or Windows Server 2008 SP2 below 6.0.6003.21137",
+        "The running Windows build is below its version's June 8, 2021 fixed level and neither the June 2021 cumulative or monthly-rollup security update nor any later cumulative update is installed; compare the OS build against the fixed build rather than looking for one KB, so a host that installed a later superseding update is not flagged",
+        "On the out-of-support versions (Windows 7, Windows Server 2008 and Windows Server 2008 R2), no Extended Security Updates entitlement present, since the June 2021 fix reaches those versions only through that program"
+      ],
+      "_ioc_source_note": "No detection-grade artifact source (nuclei template, CERT advisory indicator list or exploit repository) exists for this local privilege escalation, because no public exploit was found; every entry above is a general hunting heuristic rather than an artifact read from an exploit. The chain relationship to Adobe CVE-2021-28550 comes from the Zero Day Initiative June 2021 update review at https://www.zerodayinitiative.com/blog/2021/6/8/the-june-2021-security-update-review, and the Exploited:Yes status and fixed builds come from Microsoft's June 2021 security update document at https://api.msrc.microsoft.com/cvrf/v2.0/cvrf/2021-Jun. No actor infrastructure, file hash or command-and-control address is listed, because no source attributes this CVE to a named campaign or operator."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "No source states that AI tooling found this flaw. Microsoft's June 2021 security update document carries no acknowledgment for it, and Google Project Zero's 2021 in-the-wild tracker shows '???' for the reporter, the analysis URL and the root-cause analysis of CVE-2021-31201.",
+    "ai_discovery_source": "unknown",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-31201 (NVD-CWE-noinfo; CWE-269 supplied from the vocabulary as the entry's own classification, CVSS 5.2) + CISA KEV (added 2021-11-03) + Microsoft June 2021 security update document (https://api.msrc.microsoft.com/cvrf/v2.0/cvrf/2021-Jun). No source names a finder; Microsoft's document carries no acknowledgment and the Zero Day Initiative review credits no researcher, so the finder is recorded as unknown rather than assumed to be the vendor. NVD notes this CVE is distinct from its sibling CVE-2021-31199.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2021-11-17 due date and records known ransomware use as Unknown. Microsoft's June 2021 security update document marks the flaw Exploited:Yes on both the latest and older software releases and Publicly Disclosed:No. The Zero Day Initiative's June 2021 review states it seems this flaw and its sibling CVE-2021-31199 were the privilege-escalation part of the exploits that used the actively attacked Adobe Reader flaw CVE-2021-28550. No source names a specific actor or campaign for CVE-2021-31201. The KEV entry does not flag forensic triage.",
+    "attack_refs": [
+      "T1068"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 flaw remediation runs on an organizationally-defined time period measured from an available fix, but this cryptographic-provider escalation was exploited before the June 8, 2021 update existed, so no SI-2 window covered the earliest exposure. After the fix, SI-2's periodic cadence still trails the response a flaw that Microsoft marked exploited at release and that is chained with a document-reader remote code execution requires, and SI-2 does not tie its clock to the paired Adobe fix that closes the delivery path.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and disclosure without setting a timeframe, so it defines no accelerated clock for a KEV-listed local escalation exploited before its fix and used as the privilege-escalation stage of a document-reader chain. For operators within the scope of Commission Implementing Regulation (EU) 2024/2690, point 6.6.1(a) requires security patches to be applied within a reasonable time after they become available, which for this flaw runs from June 8, 2021, and point 6.6.1(d) requires additional measures, with residual risks accepted, in cases where a patch is not available. Microsoft disclosed and fixed the flaw on the same day and marked it not publicly disclosed beforehand, although it had already been exploited, so an in-scope entity had no notice before June 8, 2021 on which to take the 6.6.1(d) measures.",
+      "UK-CAF-B4": "CAF B4.d asks that externally exposed vulnerabilities are mitigated, for example by patching, promptly, and at Partially achieved it accepts that some vulnerabilities that are not externally exposed have temporary mitigations for an extended period. Here the externally exposed element was the paired Adobe document-reader flaw CVE-2021-28550, whose fix shipped before the June 8, 2021 Windows update, so an operator that applied it promptly broke the chain's entry point. The Windows escalation is not externally exposed, so the Partially achieved outcome allows it an extended period under a temporary mitigation, but Microsoft published no workaround or mitigation for CVE-2021-31201; an organization relying on that allowance leaves the escalation exploitable from any other code-execution foothold until the June 8, 2021 update is installed and the host restarted.",
+      "AU-Essential-8-Patch": "The flaw is in a Windows operating-system component, so the Essential Eight operating-system windows apply. An internet-facing Windows Server operating system is patched within 48 hours at every maturity level when the vendor rates the flaw critical or a working exploit exists (ISM-1877) and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1694). A workstation or non-internet-facing server operating system is patched within one month at Maturity Levels One and Two (ISM-1695), and at Maturity Level Three within 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1696) and within one month when the vendor rates it non-critical and no working exploit exists (ISM-1902). The KEV listing and Microsoft's exploited assessment mean a working exploit exists, so the 48-hour windows govern, but every window started only when the June 8, 2021 update shipped, after exploitation had already occurred, so meeting them could not have prevented the earliest compromise.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities of systems in use is obtained, the organization's exposure is evaluated, and appropriate measures are taken. Microsoft rated CVE-2021-31201 Important, not Critical, while marking it Exploited:Yes at the June 8, 2021 release, and linked it to the Adobe Reader flaw CVE-2021-28550, which had been listed as under active attack the month before. An organization that sets remediation timescales from each vendor's severity rating in isolation places this exploited escalation in a slower tier, without connecting it to the Adobe Reader exposure evaluated a month earlier."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free path is documented for this fix. The June 8, 2021 Windows cumulative and monthly-rollup security updates require a host reboot, and on Windows 7, Windows Server 2008 and Windows Server 2008 R2 the fix ships only through the Extended Security Updates program.",
+    "affected": "Microsoft Windows, the Enhanced Cryptographic Provider component (Windows Cryptographic Services). A local, low-privileged user can elevate privilege. Sources place the flaw, with its sibling CVE-2021-31199, as the privilege-escalation stage of an exploit chain paired with the Adobe Acrobat and Reader flaw CVE-2021-28550. NVD records this as a distinct vulnerability from CVE-2021-31199.",
+    "affected_versions": [
+      "Windows 10 Version 1809 and Windows Server 2019 before 10.0.17763.1999 (fixed by KB5003646)",
+      "Windows 10 Version 1909 before 10.0.18363.1621 (KB5003635)",
+      "Windows 10 Versions 2004, 20H2 and 21H1 and Windows Server versions 2004 and 20H2 before 10.0.19041.1052 / 10.0.19042.1052 / 10.0.19043.1052 (KB5003637)",
+      "Windows 10 Version 1607 and Windows Server 2016 before 10.0.14393.4467 (KB5003638)",
+      "Windows 10 Version 1507 before 10.0.10240.18967 (KB5003687)",
+      "Windows 8.1, Windows RT 8.1 and Windows Server 2012 R2 before the June 8, 2021 fix, applied as monthly rollup KB5003671 (build 6.3.9600.20045) or security-only KB5003681 (build 6.3.9600.20044)",
+      "Windows Server 2012 before 6.2.9200.23372, applied as monthly rollup KB5003697 or security-only KB5003696",
+      "Windows 7 SP1 and Windows Server 2008 R2 SP1 before 6.1.7601.25632, applied as monthly rollup KB5003667 or security-only KB5003694 (Extended Security Updates program only)",
+      "Windows Server 2008 SP2 before 6.0.6003.21137, applied as monthly rollup KB5003661 or security-only KB5003695 (Extended Security Updates program only). See Microsoft's June 2021 security update guide for the full product list."
+    ],
+    "vendor_update_paths": [
+      "Install the June 8, 2021 cumulative or monthly-rollup security update for the running Windows version (for example KB5003646 for Windows 10 Version 1809 and Windows Server 2019, KB5003637 for Windows 10 Versions 2004 through 21H1, KB5003697 or security-only KB5003696 for Windows Server 2012, KB5003661 or security-only KB5003695 for Windows Server 2008 SP2). Each update requires a host reboot. Microsoft's June 2021 update guide states that customers running affected Windows versions should install the June security updates to be fully protected from these vulnerabilities.",
+      "On the out-of-support Windows 7, Windows Server 2008 and Windows Server 2008 R2 platforms, confirm the Extended Security Updates entitlement is in place, since the June 2021 fix reaches those versions only through that program.",
+      "Also apply the Adobe Acrobat and Reader update from Adobe security bulletin APSB21-29 for CVE-2021-28550: the Zero Day Initiative describes these Enhanced Cryptographic Provider flaws as the privilege-escalation stage of exploits that used that Adobe flaw, so applying APSB21-29 closes the document-reader entry point the observed chain used, ahead of the June 8, 2021 Windows update that closes the escalation."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 27,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 62,
+    "rwep_notes": "RWEP 62. cisa_kev +25, active_exploitation +20, blast_radius +27, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2018-8653": {
+    "name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2018-8653)",
+    "cvss_score": 7.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-787"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "high",
+    "vector": "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka \"Scripting Engine Memory Corruption Vulnerability.\" This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8643.",
+    "epss_score": 0.29606,
+    "epss_percentile": 0.98109,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2018-8653",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2018-8653",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8653",
+        "severity": "critical",
+        "published_date": "2018-12-19"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2018-8653",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8653"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.",
+    "type": "scripting-engine-use-after-free-rce",
+    "blast_radius": 22,
+    "poc_available": false,
+    "poc_description": "No working exploit is hosted at a nameable location. Microsoft and Google's Threat Analysis Group confirm in-the-wild exploitation, and write-ups were published by McAfee and by Tetrane, but those describe the flaw rather than host code. Google Project Zero's 0days-in-the-wild collection has no root-cause page or exploit page for this CVE (the expected page returns 404), and no Exploit-DB entry, Metasploit module, nuclei template, or named public repository hosting working exploit code was reachable.",
+    "iocs": {
+      "behavioral": [
+        "Internet Explorer loading a page that forces IE8 rendering and selects the legacy jscript.dll engine, for example through an X-UA-Compatible IE=8 directive, the configuration the exploit needs",
+        "Script blocks that name JScript.Compact as their engine, the engine string the Threat Analysis Group reports this actor's jscript.dll exploits, CVE-2018-8653 among them, used together with IE8 rendering",
+        "A script that uses the Microsoft-specific Enumerator object, which the Threat Analysis Group reports most of this actor's Internet Explorer exploits abused, or that attempts to trigger CollectGarbage or selects JScript as its engine outside a local intranet, detection methods Google Project Zero lists for this bug class",
+        "Internet Explorer, or the svchost.exe process hosting the Web Proxy Auto-Discovery (WPAD) service, spawning child processes after an untrusted page is viewed, indicating code execution in the browser or after the sandbox escape",
+        "Heuristic: the svchost.exe process hosting the WPAD service running proxy-script content or starting processes shortly after an Internet Explorer session; the Threat Analysis Group and Google Project Zero report that this actor's jscript.dll exploits escaped the Internet Explorer sandbox by running the same vulnerability a second time inside svchost through the WPAD service, so code that runs after the escape appears under that svchost.exe rather than as an Internet Explorer child process"
+      ],
+      "network": [
+        "A crafted web page, reached through a watering-hole site or a link sent by email, that serves JScript selecting the legacy engine"
+      ],
+      "host": [
+        "Internet Explorer 9, 10 or 11 with the December 2018 cumulative update KB4483187 (or the matching Windows 10 security update) not installed",
+        "The jscript.dll legacy scripting engine present and reachable, rather than only the default jscript9.dll which is not affected"
+      ],
+      "_ioc_source_note": "The IE8-rendering condition, the JScript.Compact engine string and the Enumerator heuristic come from Google's Threat Analysis Group post at https://blog.google/threat-analysis-group/identifying-vulnerabilities-and-protecting-you-phishing/, which says the actor's jscript.dll exploits, CVE-2018-8653 among them, enabled IE8 rendering and used JScript.Compact as their engine, that most of its Internet Explorer exploits abused the Enumerator object, and that the exploits escaped the Internet Explorer EPM sandbox by replaying the same vulnerability inside svchost through the Web Proxy Auto-Discovery (WPAD) service. The CollectGarbage and 'JScript outside a local intranet' heuristics come from the 0-day detection methods in Google Project Zero's root-cause analysis for the same bug class at https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2019/CVE-2019-1367.html, which also says the CVE-2019-1367 exploit ran a second time in the WPAD service to escape the browser sandbox and that CVE-2018-8653, CVE-2019-1367, CVE-2019-1429 and CVE-2020-0674 used the same exploitation method. The legacy jscript.dll condition, the fixed builds and the web-page delivery come from Microsoft's December 2018 advisory record at https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-Dec. The X-UA-Compatible directive, the child-process entry and the WPAD svchost.exe entry are hunting heuristics rather than artifacts read from a source; the WPAD entry is built on the Threat Analysis Group and Project Zero statements above. No file hash or command-and-control address is listed, because the sources reviewed attribute this CVE to a single threat actor without publishing infrastructure indicators for it."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Reported by Clement Lecigne of Google's Threat Analysis Group, which found it exploited in the wild by a single threat actor that capitalized on five zero-day vulnerabilities, with targets mostly in or connected to North Korea. No AI tooling is claimed.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2018-8653 (CWE-787, CVSS 7.5) + CISA KEV (added 2021-11-03) + Microsoft Security Update Guide advisory CVE-2018-8653.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2022-05-03 due date and records knownRansomwareCampaignUse as Unknown. Microsoft's December 2018 advisory recorded exploitation as detected on both current and older releases, and shipped the fix out of band on December 19, 2018. Google's Threat Analysis Group attributes it, with CVE-2019-1367 and CVE-2019-1429, to a single actor that capitalized on five zero-days, mostly targeting people in or connected to North Korea. The KEV forensic-triage flag is No.",
+    "attack_refs": [
+      "T1203",
+      "T1189",
+      "T1059.007",
+      "T1566.002"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 flaw remediation assumes organization-defined time periods measured from an advisory are a meaningful window. This was exploited as a zero-day before the December 19, 2018 out-of-band fix existed, so no advisory-anchored SI-2 timeframe could cover the pre-patch period, and an out-of-band release outside the monthly cycle needs an off-schedule patch trigger the control does not specify.",
+      "NIS2-Art21-patch-management": "Article 21(2)(e) requires vulnerability handling and sets no timeframe. For entities within Implementing Regulation (EU) 2024/2690, point 6.6.1 requires security patches within a reasonable time after they become available and additional measures where a patch is not available, without naming them. For this CVE the only additional measure Microsoft published, restricting access to jscript.dll, came in the same December 19, 2018 advisory as the update and might reduce functionality for components that rely on jscript.dll, so during the zero-day exploitation the Threat Analysis Group observed an entity had neither a patch nor a vendor-named measure to apply.",
+      "UK-CAF-B4": "CAF principle B4 expects vulnerabilities in deployed systems to be mitigated promptly, for example by patching. Microsoft released this fix out of band on December 19, 2018, after the flaw was already exploited, and published its only workaround, restricting access to jscript.dll, in the same advisory with a warning that it might reduce functionality for components or features that rely on jscript.dll. B4 does not define 'promptly' against an out-of-band release, and the workaround gave no protection earlier than the fix itself.",
+      "AU-Essential-8-Patch": "For Internet Explorer, a web browser, the Essential Eight window is two weeks at Maturity Levels One and Two (ISM-1691); at Maturity Level Three it is 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1692) and two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1901). Microsoft reported exploitation at release, so a working exploit existed and the 48-hour window applied at Maturity Level Three. All of these windows run from the December 19, 2018 out-of-band release, so meeting them would not have covered the earlier period during which the Threat Analysis Group observed the zero-day in use, when no fix or workaround existed. Internet Explorer follows the lifecycle of the Windows release it is installed on, so ISM-1704 requires its removal wherever it is unsupported, including Internet Explorer 10 and the Internet Explorer 11 desktop application on Windows 10 semi-annual channel releases.",
+      "ISO-27001-2022-A.8.8": "A.8.8 technical vulnerability management requires exposure to known vulnerabilities to be evaluated and addressed, and leaves 'appropriate timescales' undefined. For this CVE Microsoft's advisory states that an updated Wsusscn2.cab offline scan file would not be available until the January 2019 security release, so a register driven by offline scans against that file would not have shown the December 19, 2018 update as missing until January 2019, while the flaw was being exploited."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free path; the December 2018 cumulative update installs the fixed jscript.dll and requires a restart. Microsoft's interim workaround, restricting access to jscript.dll, is a configuration change rather than a live patch and must be reverted before the update is installed. Internet Explorer follows the lifecycle policy of the Windows release it is installed on: Internet Explorer 10 has been unsupported since February 12, 2020, the Internet Explorer 11 desktop application ended support on Windows 10 semi-annual channel releases on June 15, 2022, and Internet Explorer 11 remains supported on Windows Server 2016 and 2019.",
+    "affected": "Internet Explorer 9, 10 and 11 on the Windows releases Microsoft listed in December 2018 (Windows 7 SP1, 8.1, RT 8.1, Server 2008, 2008 R2, 2012, 2012 R2, 2016 and 2019, and Windows 10). The flaw is a use-after-free in the way the legacy jscript.dll scripting engine handles objects in memory, allowing remote code execution in the context of the current user through a crafted web page. Only content that uses the legacy jscript.dll engine is affected; the default jscript9.dll is not.",
+    "affected_versions": [
+      "Internet Explorer 9, 10 and 11 using the legacy jscript.dll engine",
+      "Fixed by the December 19, 2018 out-of-band cumulative update KB4483187 (Windows 7 SP1, 8.1, RT 8.1, Server 2008/2008 R2/2012/2012 R2) and the matching Windows 10 security updates KB4483228, KB4483229, KB4483232, KB4483234, KB4483235 and KB4483230; a restart is required"
+    ],
+    "vendor_update_paths": [
+      "Apply the December 19, 2018 out-of-band update: cumulative update KB4483187 on Windows 7 SP1, 8.1, RT 8.1 and Server 2008 through 2012 R2, or the matching Windows 10 security update (KB4483228, KB4483229, KB4483232, KB4483234, KB4483235 or KB4483230). A restart is required.",
+      "As an interim measure until the update is installed, restrict access to jscript.dll with takeown and cacls, and revert the change before installing the update; the default jscript9.dll engine is not affected.",
+      "On Windows Server, keep Internet Explorer Enhanced Security Configuration enabled, which reduces exposure for sites not in the Trusted zone."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 57,
+    "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2019-1429": {
+    "name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-1429)",
+    "cvss_score": 7.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-416",
+      "CWE-787"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "high",
+    "vector": "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1428.",
+    "epss_score": 0.7729,
+    "epss_percentile": 0.99534,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-1429",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2019-1429",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1429",
+        "severity": "critical",
+        "published_date": "2019-11-12"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2019-1429",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1429"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.",
+    "type": "scripting-engine-use-after-free-rce",
+    "blast_radius": 22,
+    "poc_available": true,
+    "poc_description": "Exploit-DB entry EDB-ID 47707 (exploits/windows/dos/47707.txt), a Google Security Research proof of concept dated 2019-11-22 for the JScript arguments use-after-free during the toJSON callback, hosts JScript that triggers the crash; the file is mirrored at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/windows/dos/47707.txt. The upstream report is Google Project Zero issue 1947. This is a crash proof of concept for the bug rather than a full code-execution chain. Its descriptive header, proof-of-concept markup and WinDbg crash log were read, and the script body was searched only for the API names it calls.",
+    "iocs": {
+      "behavioral": [
+        "Internet Explorer loading a page that forces IE8 rendering and selects the legacy jscript.dll engine, for example through an X-UA-Compatible IE=8 directive",
+        "A script that assigns a member of the arguments object during a toJSON callback and then frees and re-accesses it, the specific use-after-free this flaw exercises",
+        "A script that assigns a variable to the arguments object during an Array.sort callback and then frees and re-accesses it, the incompletely fixed CVE-2019-1367 path that the November 2019 fix for this CVE completed",
+        "A script that calls CollectGarbage or uses the Microsoft-specific Enumerator object, and Internet Explorer, or the svchost.exe process hosting the Web Proxy Auto-Discovery (WPAD) service, spawning child processes after an untrusted page is viewed",
+        "Heuristic: the svchost.exe process hosting the WPAD service running proxy-script content or starting processes after an Internet Explorer session; Project Zero reports that this CVE's exploit used the same method as the CVE-2019-1367 exploit, which ran a second time in the WPAD service to escape the browser sandbox, and the Threat Analysis Group reports the same escape for this actor's Internet Explorer exploits"
+      ],
+      "network": [
+        "A crafted web page delivered by a watering-hole attack or spearphishing link that serves JScript on the legacy engine",
+        "An Office document or application hosting the Internet Explorer rendering engine, or an ActiveX control marked safe for initialization, that pulls remote script content"
+      ],
+      "host": [
+        "Internet Explorer 9, 10 or 11 without the November 12, 2019 update KB4525106 (or the matching Windows 10 security update)",
+        "The jscript.dll legacy scripting engine present and reachable, rather than only the default jscript9.dll which is not affected"
+      ],
+      "_ioc_source_note": "The toJSON-callback use-after-free comes from the descriptive header paragraph of Exploit-DB entry EDB-ID 47707, read from its GitLab mirror at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/windows/dos/47707.txt. The entry's proof-of-concept markup and WinDbg crash log were also read, and they show the X-UA-Compatible IE=8 meta tag, the Jscript.Encode script language, the toJSON callback passed to JSON.stringify, the CollectGarbage call inside that callback and the access violation at jscript!PrepareInvoke beneath jscript!JsJSONStringify; the script body was searched only for the API names it calls. The Array.sort-callback path, the completion of the CVE-2019-1367 patch in November 2019, the variant relationship and the CollectGarbage and Enumerator detection methods come from Google Project Zero's root-cause analysis at https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2019/CVE-2019-1367.html, which also says the CVE-2019-1367 exploit ran a second time in the WPAD service to escape the browser sandbox and that CVE-2019-1429 used the same exploitation method. The fixed builds, the reporters, and the web, Office, ActiveX and compromised-site delivery come from Microsoft's November 2019 advisory record at https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2019-Nov, which does not mention IE8 or jscript.dll. The IE8-rendering and legacy-engine condition comes from that proof-of-concept markup, the Project Zero detection methods for this bug class and the Threat Analysis Group's description of the same actor's jscript.dll exploits at https://blog.google/threat-analysis-group/identifying-vulnerabilities-and-protecting-you-phishing/, which also says this actor's Internet Explorer exploits escaped the EPM sandbox by replaying the vulnerability inside svchost through the Web Proxy Auto-Discovery (WPAD) service. The child-process entry is a general hunting heuristic, and the WPAD svchost.exe entry is a hunting heuristic built on the Project Zero and Threat Analysis Group statements. No file hash or command-and-control address is listed, because the sources reviewed name no infrastructure tied to this CVE."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Credited by Microsoft to Resecurity Inc., an anonymous researcher working with iDefense Labs, Ivan Fratric of Google Project Zero, and Clement Lecigne of Google's Threat Analysis Group. Project Zero identifies it as the variant of CVE-2019-1367 found by variant analysis. No AI tooling is claimed.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2019-1429 (CWE-416, CVSS 7.5) + CISA KEV (added 2021-11-03) + Microsoft Security Update Guide advisory CVE-2019-1429.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2022-05-03 due date and records knownRansomwareCampaignUse as Unknown. Microsoft's November 2019 advisory recorded exploitation as detected on both current and older releases. Google's Threat Analysis Group groups it with CVE-2018-8653 and CVE-2019-1367 under a single threat actor, and Project Zero identifies it as the variant of CVE-2019-1367 found by variant analysis and reports that the same November 2019 fix completed the incomplete CVE-2019-1367 patch, which TAG had found in October 2019. The KEV forensic-triage flag is No.",
+    "attack_refs": [
+      "T1203",
+      "T1189",
+      "T1059.007",
+      "T1566.001"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 flaw remediation assumes advisory-anchored time periods are a meaningful window. This was exploited as a zero-day before the November 12, 2019 fix and is itself the variant of CVE-2019-1367 produced by variant analysis, so an SI-2 program that closed the earlier flaw without watching for siblings in the same primitive had no window covering this one until its own advisory.",
+      "NIS2-Art21-vulnerability-handling": "Article 21(2)(e) requires vulnerability handling and disclosure and sets no timeframe. Microsoft's November 12, 2019 record for this CVE describes a scripting engine memory corruption flaw and does not mention CVE-2019-1367, although Project Zero reports that the same update completed the incomplete CVE-2019-1367 fix, so an entity handling vulnerabilities from vendor advisories had no vendor signal to re-check a CVE-2019-1367 remediation it had already closed.",
+      "UK-CAF-B4": "CAF principle B4 expects vulnerabilities in deployed systems to be mitigated promptly, for example by patching. Microsoft reported this flaw as already exploited when it published the November 12, 2019 update and published no workaround under this CVE. The jscript.dll restriction in Microsoft's September 23, 2019 CVE-2019-1367 advisory blocks the engine this flaw is in, but that advisory says to revert the restriction before installing the CVE-2019-1367 update, so an operator that followed Microsoft's instructions met B4 for CVE-2019-1367 while this flaw stayed reachable until November 12, 2019.",
+      "AU-Essential-8-Patch": "For Internet Explorer, a web browser, the Essential Eight window is two weeks at Maturity Levels One and Two (ISM-1691); at Maturity Level Three it is 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1692) and two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1901). Microsoft reported exploitation at release, so the 48-hour window applied at Maturity Level Three. Microsoft published no fix or workaround under this CVE before November 12, 2019, so every window runs from that release. The jscript.dll restriction Microsoft published on September 23, 2019 for CVE-2019-1367 blocks the engine this flaw is in, but Microsoft said to revert it before installing the CVE-2019-1367 update, so an organization that met the Essential Eight window for CVE-2019-1367 by following those instructions was exposed to this flaw until November 12, 2019. Internet Explorer follows the lifecycle of the Windows release it runs on, and ISM-1704 requires removing it where that release, or the Internet Explorer 11 desktop application on a Windows 10 semi-annual channel release, is out of support.",
+      "ISO-27001-2022-A.8.8": "A.8.8 technical vulnerability management leaves timescales undefined and treats each CVE as an independent item. Because this is a sibling of CVE-2019-1367 in the same JScript garbage-collector primitive, a register that closed the predecessor gains no signal to expect and prioritize the variant until its own advisory appears."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free path; the November 12, 2019 cumulative, security or Monthly Rollup update installs the fix and requires a restart. Microsoft published no workaround for this CVE. Internet Explorer follows the lifecycle policy of the Windows release it is installed on; the Internet Explorer 11 desktop application ended support on Windows 10 semi-annual channel releases on June 15, 2022, and Internet Explorer 10 has been unsupported since February 12, 2020.",
+    "affected": "Internet Explorer 9, 10 and 11 using the legacy jscript.dll engine. The flaw is a use-after-free where members of the arguments object are not tracked by the garbage collector during the toJSON callback, allowing remote code execution in the context of the current user through a crafted web page, an Office document or application hosting the Internet Explorer engine, or an ActiveX control marked safe for initialization. It is the variant of CVE-2019-1367 in the same bug class, and Project Zero reports that the November 2019 fix issued under this CVE also completed the incomplete CVE-2019-1367 patch for the Array.sort-callback use-after-free, which TAG found incomplete in October 2019; the default jscript9.dll engine is not affected.",
+    "affected_versions": [
+      "Internet Explorer 9, 10 and 11 using the legacy jscript.dll engine",
+      "Fixed by the November 12, 2019 update: IE Cumulative KB4525106 (Windows 7 SP1 through Server 2012 R2) and the matching Windows 10 security updates (KB4525232, KB4525236, KB4525241, KB4525237, KB4523205, KB4524570) plus Monthly Rollups; a restart is required"
+    ],
+    "vendor_update_paths": [
+      "Apply the November 12, 2019 update: IE Cumulative KB4525106 on Windows 7 SP1, 8.1 and Server 2008 through 2012 R2, the matching Windows 10 security update (KB4525232 for RTM, KB4525236 for 1607 and Server 2016, KB4525241 for 1709, KB4525237 for 1803, KB4523205 for 1809 and Server 2019, KB4524570 for 1903), or the Monthly Rollup (KB4525234 for Server 2008, KB4525235 for Windows 7 SP1 and Server 2008 R2, KB4525243 for 8.1, RT 8.1 and Server 2012 R2, KB4525246 for Server 2012). A restart is required.",
+      "Microsoft's advisory for this CVE lists no workaround or mitigating factor. Until the November 12, 2019 update is installed, the jscript.dll restriction from Microsoft's September 23, 2019 CVE-2019-1367 advisory (takeown and cacls denying everyone access to jscript.dll) blocks the engine this flaw is in. That advisory says to revert the restriction before installing the CVE-2019-1367 update, so the restriction protected a host against this flaw only where the operator kept it, or re-applied it after that update, until November 12, 2019."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 77,
+    "rwep_notes": "RWEP 77. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2021-38649": {
+    "name": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability (CVE-2021-38649)",
+    "cvss_score": 7,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-269"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "high",
+    "vector": "Open Management Infrastructure Elevation of Privilege Vulnerability",
+    "epss_score": 0.02887,
+    "epss_percentile": 0.86297,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-38649",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-38649",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38649",
+        "severity": "important",
+        "published_date": "2021-09-14"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-38649",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649",
+        "severity": "important",
+        "published_date": "2021-09-14"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-38649",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38649",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.",
+    "type": "local-privilege-escalation",
+    "blast_radius": 18,
+    "poc_available": false,
+    "poc_description": "No public working exploit was found for this privilege escalation. Searches of Exploit-DB, GitHub, the ProjectDiscovery nuclei templates and the Metasploit framework show the public OMIGOD exploit code targets the unauthenticated remote-code-execution sibling CVE-2021-38647, not CVE-2021-38649. Wiz's write-up lists CVE-2021-38649 among the four OMI flaws it reported but gives technical detail only for CVE-2021-38647, CVE-2021-38648 and CVE-2021-38645, and hosts no exploit for CVE-2021-38649.",
+    "iocs": {
+      "behavioral": [
+        "Shell commands run from the working directory /var/opt/microsoft/scx/tmp in auditd execve logs. Microsoft's guidance gives this for attackers who use the OMI flaws to run commands remotely through the SCXcore ExecuteShellCommand provider; for this local flaw it is a heuristic carried over from that guidance, not a documented footprint.",
+        "Invoke_ExecuteShellCommand entries in /var/opt/microsoft/scx/log/scx.log after scxadmin verbose logging is enabled, a heuristic carried over from the same remote-execution guidance.",
+        "A low-privileged local account gaining root on a host running OMI without a corresponding sudo or login event (a general hunting heuristic)."
+      ],
+      "network": [
+        "The OMI management ports TCP 5985, 5986 and 1270 listening and reachable from an untrusted source address, which is the exposure the remote-code-execution sibling needs; the privilege escalation itself is reached locally"
+      ],
+      "host": [
+        "An OMI package below version 1.6.8-1, or an OMS Agent for Linux below v1.13.40-0, present on a Linux host and checked with the platform package query",
+        "A Linux Diagnostics extension at v4.0.0 through v4.0.5 or at v3.0.131 or earlier, or a DSC Linux agent on the 2.71 branch below 2.71.1.25, on the 2.70 branch below 2.70.0.30, or at version 3.0.0.1 or 2.0.0.0"
+      ],
+      "_ioc_source_note": "The SCX ExecuteShellCommand guidance, the /var/opt/microsoft/scx/tmp working directory, the scx.log Invoke_ExecuteShellCommand string, the vulnerable and fixed version numbers and the OMI ports come from Microsoft's Additional Guidance blog at https://web.archive.org/web/20211230015313/https://msrc-blog.microsoft.com/2021/09/16/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/. Microsoft wrote the SCX guidance for commands run remotely through the OMI flaws, so the two SCX items are heuristics carried over to this local flaw. The unmatched-privilege entry is a general hunting heuristic, not read from a source. No detection-grade exploit repository for this privilege escalation was reachable. No actor infrastructure, file hash or command-and-control address is listed, because no source reviewed attributes this specific CVE to a named campaign."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "No source claims AI involvement. The flaw was found by human researchers Nir Ohfeld and Shir Tamari of Wiz.io, who reported the OMI vulnerabilities to Microsoft in June 2021.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-38649 (no NVD CWE; CWE-269 supplied, CVSS 7.0) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2021-38649. Found and reported to MSRC by Nir Ohfeld and Shir Tamari of Wiz.io, an external firm, so ai_discovery_source is human_researcher. Source: https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2021-38649 to its Known Exploited Vulnerabilities catalog on 2021-11-03 with a due date of 2021-11-17 and records ransomware use as Unknown; the KEV listing is the evidence of in-the-wild use. No public report reviewed here dates the exploitation of CVE-2021-38649 or attributes it to a named actor or campaign. The KEV entry's forensic-triage flag is No.",
+    "attack_refs": [
+      "T1068",
+      "T1059.004"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 flaw remediation drives patching on organization-defined timeframes. The fix is the OMI 1.6.8-1 package, but where OMI was installed silently by an Azure VM extension the remediation program may not list it as software to patch, so the KEV due date of 2021-11-17 can pass on hosts whose inventory never recorded the agent.",
+      "NIST-800-53-AC-6": "AC-6 least privilege limits accounts and processes to the privileges their functions need. Wiz reports that the OMI agent runs as root and that Azure services install it silently, and this flaw lets a low-privileged local account on a host with OMI below 1.6.8-1 elevate privileges (NVD: AV:L/PR:L), so least-privilege assignment of the host's own accounts does not bound what any local account can reach while the vulnerable agent is installed.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling but sets no timeframe. Microsoft pushed the OMI 1.6.8-1 fix to Azure-managed VM extensions transparently, yet standalone OMI, System Center Operations Manager and self-managed extensions require a manual update, and the directive gives essential and important entities no defined clock for applying it against a KEV-listed agent that runs as root on their Linux fleet.",
+      "UK-CAF-B4": "CAF B4.d expects announced vulnerabilities in all software packages to be tracked and prioritized, with externally exposed ones mitigated promptly, for example by patching, and at Partially achieved it accepts temporary mitigations for an extended period on vulnerabilities that are not externally exposed. This flaw is local (NVD AV:L), and the measure Microsoft's guidance offers besides updating, restricting the OMI ports TCP 5985, 5986 and 1270, is described as defense in depth against the remote-code-execution flaw, so an assessment at that level can accept a port restriction for an extended period while OMI below 1.6.8-1 still allows the local elevation.",
+      "AU-Essential-8-Patch": "The Essential Eight patches applications within windows the ISM sets by asset class, counted from the vendor's release. Microsoft states the fix was published on GitHub on August 11, 2021 (the packaged OMI v1.6.8-1 release is dated September 8, 2021) and rated the flaw Important. Where an instance's OMI ports are directly reachable from the internet, OMI is an online service, patched at every maturity level within 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1876) and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1690); no source shows a working exploit before CISA listed the flaw on November 3, 2021, so until then the two-week window is the one an organization could have applied. Where OMI is reachable only internally it is an other application, patched within one month from Maturity Level Two (ISM-1693), with no timeframe at Maturity Level One. No source dates the exploitation, so whether these windows closed before it began is unknown. The shortfall for this CVE is that the asset class follows the exposure of the OMI ports while the flaw is local: an instance with its ports closed to the internet has no patch timeframe at Maturity Level One, although any local account on it can use the flaw.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities of systems in use is obtained, the organization's exposure is evaluated, and appropriate measures are taken. Wiz reports that Azure services deploy OMI silently and that the Azure portal does not mention it, so a register built from the services an organization knowingly deployed or from the Azure portal omits the agent, while a package-level inventory of each Linux host lists it. A.8.8 does not say how software that a cloud provider installs is identified, so exposure below 1.6.8-1 is evaluated only where that host-level inventory feeds the register."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "The fix is an update of the OMI agent to 1.6.8-1 or of the extension build that carries it. Microsoft's Security Update Guide marks the restart requirement for every affected product as Maybe, and Microsoft's guidance says only that the automatic Azure extension updates were applied without a reboot. Microsoft documents no reload-free path for a self-installed OMI; this is not a live patch of running code.",
+    "affected": "Microsoft Open Management Infrastructure (OMI), the Linux and UNIX management agent that many Azure VM management extensions and services install, including Log Analytics, Azure Automation, Azure Diagnostics, Azure Security Center, Azure Sentinel, the Container Monitoring Solution, Azure HDInsight, System Center Operations Manager, Azure Stack Hub and the standalone OMI package. A local, low-privileged user elevates privileges on the host; Microsoft describes the flaw only as an elevation of privilege. Wiz reports the agent runs as root, so the compromise reaches the whole host.",
+    "affected_versions": [
+      "Open Management Infrastructure below 1.6.8-1, whether standalone, used by System Center Operations Manager or on-premises DSC, or on Azure HDInsight clusters (fixed in OMI 1.6.8-1)",
+      "OMS Agent for Linux GA v1.13.39 and earlier, used by the Log Analytics agent, Azure Automation, Azure Automation Update Management, Azure Security Center and Azure Sentinel (fixed in v1.13.40-0)",
+      "Linux Diagnostics extension (LAD) v4.0.0 through v4.0.5 and v3.0.131 and earlier (fixed in LAD v4.0.15 and v3.0.135 per Microsoft's guidance blog; the Security Update Guide gives the 4.0 fix as v4.0.13)",
+      "DSC Linux agent on the 2.71 branch below 2.71.1.25 (fixed in 2.71.1.25), on the 2.70 branch below 2.70.0.30 (fixed in 2.70.0.30), and at versions 3.0.0.1 and 2.0.0.0 (Microsoft's fixed versions are 2.71.1.25, 2.70.0.30 and 3.0.0.3)",
+      "Container Monitoring Solution Docker images with a SHA ID other than sha256:12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707 (fixed in that image)",
+      "Azure Stack Hub: Azure Monitor, Update and Configuration Management extension 1.8, 1.8.11, 1.12, 1.12.17, 1.13.27 and 1.13.33 (fixed in 1.14.02 per Microsoft's guidance blog; the Security Update Guide lists 1.14.01), and Microsoft Azure Diagnostic Extension for Linux Virtual Machines 3.0.111 and 3.0.121 (fixed in 3.1.135)"
+    ],
+    "vendor_update_paths": [
+      "Update OMI to 1.6.8-1, per Microsoft's September 2021 advisory for CVE-2021-38649; on Azure-managed VM extensions Microsoft pushed the update transparently, while standalone OMI, System Center Operations Manager and self-managed extensions require a manual package update to 1.6.8-1.",
+      "Update the affected VM extension to its fixed build: OMS Agent for Linux v1.13.40-0, Linux Diagnostics extension v4.0.15 or v3.0.135 (the Security Update Guide gives v4.0.13 for the 4.0 line), or a DSC Linux agent to 2.71.1.25 on the 2.71 branch, 2.70.0.30 on the 2.70 branch, or 3.0.0.3 from 3.0.0.1; an agent at 2.0.0.0 is updated to one of these fixed versions.",
+      "Replace a Container Monitoring Solution image with the fixed image sha256:12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707; on Azure Stack Hub install Azure Monitor, Update and Configuration Management 1.14.02 and Microsoft Azure Diagnostic Extension for Linux Virtual Machines 3.1.135 from the Azure Stack Hub marketplace; on Azure HDInsight, where a customer's configuration blocked Microsoft's automatic update to OMI 1.6.8-1, run Microsoft's update script on every cluster node.",
+      "Restrict the OMI management ports TCP 5985, 5986 and 1270 to trusted hosts with a network security group or host firewall; Microsoft offers this as defense in depth against the remote-code-execution sibling CVE-2021-38647, and it does not stop this local elevation of privilege."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 48,
+    "rwep_notes": "RWEP 48. cisa_kev +25, active_exploitation +20, blast_radius +18, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2019-0604": {
+    "name": "Microsoft SharePoint Remote Code Execution Vulnerability",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-20"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": true,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.",
+    "epss_score": 0.99913,
+    "epss_percentile": 0.99968,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-0604",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2019-0604",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604",
+        "severity": "critical",
+        "published_date": "2019-02-12"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2019-0604",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.",
+    "type": "deserialization-rce",
+    "blast_radius": 20,
+    "poc_available": true,
+    "poc_description": "The public exploit Exploit-DB 48053 (the 'desharialize' tool, published 2020-01-21) posts a serialized payload to a SharePoint Picker.aspx URL given as an argument; only its option help and request-building lines were read for request artifacts, not to run it. The Zero Day Initiative write-up documents the picker path and the incomplete first patch.",
+    "iocs": {
+      "behavioral": [
+        "An HTTP POST to any request path ending in Picker.aspx whose PickerDialogType query parameter names a Microsoft.SharePoint type and whose body carries the ctl00$PlaceHolderDialogBodySection$ctl05$hiddenSpanData field, which Emerging Threats rule sid 2027345 matches, followed by code running as the SharePoint application pool or farm account",
+        "New .aspx files appearing under the SharePoint layouts directory; in the April 2019 activity Unit 42 documented, webshells sat at /_layouts/15/error2.aspx and /_layouts/15/errr.aspx, and further webshells were named stylecs.aspx, stylecss.aspx and test.aspx. These filenames come from one campaign, and Unit 42 notes multiple actors may have installed them.",
+        "The SharePoint worker process w3wp.exe spawning cmd.exe or PowerShell, or running credential-dumping tools (a general hunting heuristic)"
+      ],
+      "network": [
+        "A request to a path ending in Picker.aspx with the PickerDialogType URL parameter set to a Microsoft.SharePoint type, matched without a fixed directory prefix because the site path varies",
+        "Requests to a China Chopper webshell carrying the parameter e358efa489f58062f10dd7316b65649e (the MD5 of the letter t) in the URL query string, as Unit 42 documented for stylecs.aspx and stylecss.aspx, or carrying the plain parameter t in the URL query string, as in the China Chopper code from the Saudi Arabian National Cyber Security Center's alert that Unit 42 describes; matching t in the request body as well is a general China Chopper hunting heuristic"
+      ],
+      "host": [
+        "A SharePoint Server 2010 SP2, Foundation 2010 SP2, Server 2013 SP1, Foundation 2013 SP1, Enterprise Server 2016 or Server 2019 farm missing any update Microsoft lists for its edition in the April 25, 2019 revision of the advisory",
+        "New or unexpected .aspx files under the TEMPLATE\\LAYOUTS directory owned by the SharePoint service account"
+      ],
+      "_ioc_source_note": "The Picker.aspx request, the PickerDialogType parameter naming a Microsoft.SharePoint type and the hiddenSpanData body field come from Emerging Threats rule sid 2027345 at https://rules.emergingthreats.net/open/suricata-5.0/rules/emerging-web_specific_apps.rules, which matches Picker.aspx without a directory prefix, and from the Zero Day Initiative write-up at https://www.zerodayinitiative.com/blog/2019/3/13/cve-2019-0604-details-of-a-microsoft-sharepoint-rce-vulnerability. The public exploit Exploit-DB 48053 at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/windows/remote/48053.py takes the Picker.aspx URL as an argument; only its option help and request-building lines were read. The webshell paths and names, the China Chopper URL parameter e358efa489f58062f10dd7316b65649e and the t URL parameter read by the webshell code in the Saudi national alert come from Unit 42's report at https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/, and those filenames belong to one campaign. The w3wp.exe-spawning-shell entry and matching the t parameter in a request body are general hunting heuristics. No file hash is reproduced here; Unit 42 lists webshell hashes at that URL for the named campaign."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "No source claims AI involvement. The flaw was found by Markus Wulftange and reported through Trend Micro's Zero Day Initiative.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2019-0604 (CWE-20, CVSS 9.8) + CISA KEV (added 2021-11-03, ransomware: Known) + Microsoft advisory CVE-2019-0604. Reported to Trend Micro's Zero Day Initiative by Markus Wulftange, an external researcher, so ai_discovery_source is human_researcher. Source: https://www.zerodayinitiative.com/blog/2019/3/13/cve-2019-0604-details-of-a-microsoft-sharepoint-rce-vulnerability",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2019-0604 to its Known Exploited Vulnerabilities catalog on 2021-11-03 with a due date of 2022-05-03 and records known ransomware campaign use. Unit 42 observed Emissary Panda (APT27) webshells on three SharePoint servers of two government organizations in the Middle East between April 1 and April 16, 2019, and believes the actor exploited CVE-2019-0604 to install them; the actor used the webshells to dump credentials and pivot, and Unit 42 links the activity to alerts from the Saudi Arabian and Canadian national cyber security agencies. The KEV entry's forensic-triage flag is No.",
+    "attack_refs": [
+      "T1190",
+      "T1505.003",
+      "T1003.001"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires that flaws are identified, reported and corrected, and that security-relevant updates are installed within an organization-defined time period of their release. On the SharePoint Server editions the February 12, 2019 update fixed only the encoder in Microsoft.SharePoint.dll and left the one in Microsoft.SharePoint.Portal.dll reachable through the picker, so a program that recorded the flaw as corrected after that update still ran an exploitable Server farm until it installed the March 12, 2019 update, and until the April 25, 2019 revision Microsoft's list for SharePoint Server 2010 SP2 did not include the February 12, 2019 update KB4461630 that the edition also needs. SI-2 does not require a flaw recorded as corrected to be re-checked when the vendor re-releases or revises its fix. On the Foundation editions the February 12, 2019 updates are the complete fix.",
+      "NIS2-Art21-vulnerability-handling": "NIS2 Article 21(2)(e) requires vulnerability handling and disclosure and sets no timeframe; for entities within the scope of Implementing Regulation (EU) 2024/2690, point 6.6.1 requires security patches to be applied within a reasonable time after they become available. Neither text requires an entity to re-open a closed finding when the vendor re-releases a fix, as Microsoft did for the SharePoint Server editions on March 12, 2019, or revises the list of required updates, as it did on April 25, 2019 by adding KB4461630 for SharePoint Server 2010 SP2, so an entity that installed the February 12, 2019 update on a SharePoint Server farm and closed the finding is not directed back to it.",
+      "NIS2-Art21-incident-handling": "NIS2 Article 21(2)(b) requires incident handling. Unit 42 believes Emissary Panda used this flaw to plant webshells on government SharePoint servers and observed it dumping credentials there, but the incident-handling process is not tied to a nation-state initial-access trigger, so a webshell dropped through the picker endpoint may be handled as a routine web incident rather than escalated to the response a state-actor intrusion warrants.",
+      "UK-CAF-C1": "CAF Principle C1 expects monitoring that detects events indicating an incident on the essential function. In the April 2019 activity Unit 42 documented, webshells were placed at /_layouts/15/error2.aspx and /_layouts/15/errr.aspx, further webshells were named stylecs.aspx, stylecss.aspx and test.aspx, and code ran as the farm account; those names belong to one campaign, and Unit 42 notes several actors may have installed them, so monitoring keyed to those filenames or to user activity, rather than to any new .aspx file under the SharePoint layouts directory, will not surface a webshell planted through this flaw.",
+      "AU-Essential-8-Patch": "The Essential Eight patches applications within windows the ISM sets by asset class, counted from the release of each patch. An internet-facing SharePoint server is an online service, patched within 48 hours of release at every maturity level when the vendor rates the flaw critical or a working exploit exists (ISM-1876), which applies here because Microsoft rated this flaw Critical; the two-week window (ISM-1690) applies when the vendor rates a flaw non-critical and no working exploit exists. The February 12, 2019 updates KB4461630 and KB4462143 and the March 12, 2019 updates KB4462184, KB4462202, KB4462211 and KB4462199 were all released before the April 1 to April 16, 2019 webshell activity Unit 42 documented, so a farm that applied each within 48 hours of its release had the complete set installed weeks before that activity, and meeting the window would have closed this flaw before it; the April 25, 2019 revision changed only which updates Microsoft listed against this CVE. An intranet-only farm is an other application, patched within one month from Maturity Level Two (ISM-1693), with no timeframe at Maturity Level One.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities of systems in use is obtained, the organization's exposure is evaluated, and appropriate measures are taken. For this flaw the measure differs by edition in Microsoft's April 25, 2019 revision: the March 12, 2019 update on SharePoint Enterprise Server 2016 and Server 2019, the March 12, 2019 update plus the February 12, 2019 update on SharePoint Server 2010 SP2 and Server 2013 SP1, and the February 12, 2019 update alone on SharePoint Foundation 2010 SP2 and Foundation 2013 SP1. A.8.8 does not require the organization to re-evaluate its exposure when the vendor revises which updates close a CVE, so a register that closed the item after the February update can miss the March update on the Server editions."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path; the SharePoint security update replaces the affected assemblies and takes effect after the SharePoint Products Configuration Wizard runs and the IIS application pools and SharePoint timer service restart. A host reboot is not always required (Microsoft marks the restart requirement as Maybe), but the SharePoint services do restart, and the complete fix is the update set in Microsoft's April 25, 2019 revision, which on the SharePoint Server editions includes the March 12, 2019 update, rather than the February update alone. Extended support has ended for SharePoint Server 2010 (April 2021), SharePoint Server 2013 (April 2023) and SharePoint Server 2016 and 2019 (July 2026), so replacing those farms with a supported release is the remaining remediation.",
+    "affected": "Microsoft SharePoint. An attacker who posts a crafted serialized payload to the picker endpoint at /_layouts/15/Picker.aspx reaches an XmlSerializer with an attacker-controlled type and runs code as the SharePoint application pool and farm account. Affected: SharePoint Server 2010 SP2, SharePoint Foundation 2010 SP2, SharePoint Server 2013 SP1, SharePoint Foundation 2013 SP1, SharePoint Enterprise Server 2016 and SharePoint Server 2019. Extended support has ended for SharePoint Server 2010, 2013, 2016 and 2019.",
+    "affected_versions": [
+      "SharePoint Server 2010 SP2 (fixed by KB4462184 plus KB4461630; both are required)",
+      "SharePoint Foundation 2010 SP2 (fixed by KB4461630)",
+      "SharePoint Server 2013 SP1 (fixed by KB4462202 plus KB4462143; both are required)",
+      "SharePoint Foundation 2013 SP1 (fixed by KB4462143)",
+      "SharePoint Enterprise Server 2016 (fixed by KB4462211)",
+      "SharePoint Server 2019 (fixed by KB4462199)",
+      "On SharePoint Server 2010 SP2, Server 2013 SP1, Enterprise Server 2016 and Server 2019 the February 12, 2019 update alone does not close the CVE: the Zero Day Initiative reports that the original patch left the encoder in Microsoft.SharePoint.Portal.dll exploitable, and Microsoft released the March 12, 2019 updates KB4462184, KB4462202, KB4462211 and KB4462199 to address it comprehensively. The February 12, 2019 updates KB4461630 and KB4462143 remain required: they are the complete fix on SharePoint Foundation 2010 SP2 and Foundation 2013 SP1, and on Server 2010 SP2 and Server 2013 SP1 they are installed alongside the March update. On April 25, 2019 Microsoft added SharePoint Server 2013 SP1 and Foundation 2010 SP2 as affected and KB4461630 to the list for Server 2010 SP2; the update set in that April revision is what closes the CVE"
+    ],
+    "vendor_update_paths": [
+      "Install every security update Microsoft lists for the edition in the April 25, 2019 revision of its advisory for CVE-2019-0604: KB4462199 (SharePoint Server 2019), KB4462211 (SharePoint Enterprise Server 2016), KB4462202 plus KB4462143 (SharePoint Server 2013 SP1), KB4462143 (SharePoint Foundation 2013 SP1), KB4462184 plus KB4461630 (SharePoint Server 2010 SP2) and KB4461630 (SharePoint Foundation 2010 SP2); Microsoft states a system is fully protected only with all updates listed for it.",
+      "Treat that April 25, 2019 update set as what closes this CVE. It includes the February 12, 2019 updates KB4461630 and KB4462143, which are the complete fix on SharePoint Foundation 2010 SP2 and Foundation 2013 SP1 and are installed alongside the March 12, 2019 update on SharePoint Server 2010 SP2 and Server 2013 SP1. A SharePoint Server 2010, 2013, 2016 or 2019 farm with its February 12, 2019 update but without its March 12, 2019 update remains exploitable through the picker endpoint.",
+      "Run the SharePoint Products Configuration Wizard after the update, which restarts the SharePoint timer service and the IIS application pools."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 70,
+    "rwep_notes": "RWEP 70. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +20, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2019-0797": {
+    "name": "Microsoft Win32k Privilege Escalation Vulnerability (CVE-2019-0797)",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-362",
+      "CWE-416"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0808.",
+    "epss_score": 0.0189,
+    "epss_percentile": 0.78667,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-0797",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2019-0797",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0797",
+        "severity": "important",
+        "published_date": "2019-03-12"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2019-0797",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0797"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.",
+    "type": "win32k-race-condition-privilege-escalation",
+    "blast_radius": 18,
+    "poc_available": false,
+    "poc_description": "No public working exploit was found. Searches of Exploit-DB, GitHub and the ProjectDiscovery nuclei templates returned no hosted exploit for CVE-2019-0797, and it is not present as a Metasploit module. Kaspersky's Securelist write-up by Vasily Berdnikov and Boris Larin is a root-cause and detection analysis of the in-the-wild sample rather than hosted exploit code, and the exploit Kaspersky found in the wild is not public.",
+    "iocs": {
+      "behavioral": [
+        "A local process invoking the undocumented Win32k syscalls NtDCompositionDiscardFrame and NtDCompositionDestroyConnection concurrently, the race Kaspersky identified as the use-after-free trigger (a hunting heuristic that needs kernel system-call telemetry)",
+        "A user-mode process gaining kernel or SYSTEM privileges with no corresponding service event (a general hunting heuristic)"
+      ],
+      "network": [
+        "No network indicator: this is a local privilege escalation run from code already on the host, so there is no request path or port to match"
+      ],
+      "host": [
+        "A Windows 8.1, RT 8.1, Windows 10 (1507, 1607, 1703, 1709, 1803 or 1809), Server 2012 or 2012 R2, Server 1709 or 1803, Server 2016 or Server 2019 host without the March 12, 2019 update",
+        "The in-the-wild exploit targeted 64-bit Windows 8 through Windows 10 build 15063 and stopped execution if its module file name contained the substring chrome.exe, because, per Kaspersky, the flaw cannot be exploited within a sandbox"
+      ],
+      "_ioc_source_note": "The NtDCompositionDiscardFrame and NtDCompositionDestroyConnection race, the Windows 8 to Windows 10 build 15063 target range, the chrome.exe module-name check and Kaspersky's statement that the flaw cannot be exploited within a sandbox come from Kaspersky's Securelist write-up at https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/; the syscall race is listed as a hunting heuristic, not a detection artifact. The affected releases and fixed builds come from Microsoft's advisory recorded in the March 2019 update guide at https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2019-Mar. The SYSTEM-without-service entry is a general hunting heuristic. This is a local flaw, so no network indicator is given, and no file hash or command-and-control address is listed because the source describes the technique rather than hosting attributable indicators."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "No source claims AI involvement. The flaw was found by Vasily Berdnikov and Boris Larin of Kaspersky Lab through detection of an in-the-wild exploit in February 2019.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2019-0797 (no NVD CWE; CWE-362 and CWE-416 supplied, CVSS 7.8) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2019-0797. Detected in the wild and reported to Microsoft by Vasily Berdnikov and Boris Larin of Kaspersky Lab, an external firm, so ai_discovery_source is human_researcher. Source: https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2019-0797 to its Known Exploited Vulnerabilities catalog on 2021-11-03 with a due date of 2022-05-03 and records ransomware use as Unknown. Kaspersky's Automatic Exploit Prevention detected an exploitation attempt in February 2019, in targeted attacks against 64-bit Windows 8 through Windows 10 build 15063, and Kaspersky reported the flaw to Microsoft on February 22, 2019. Kaspersky believes the exploit is used by several threat actors including, but possibly not limited to, FruityArmor and SandCat, and notes that SandCat also uses the FinFisher/FinSpy framework. The KEV entry's forensic-triage flag is No.",
+    "attack_refs": [
+      "T1068"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 flaw remediation runs on organization-defined timeframes. This Win32k escalation was a zero-day used in targeted attacks before the March 12, 2019 update, so the exposure existed before any timeframe could start, and SI-2 does not model an escalation already exploited at disclosure.",
+      "NIST-800-53-SC-39": "SC-39 requires a separate execution domain for each executing process. This flaw is a race between two undocumented win32k system calls, NtDCompositionDiscardFrame and NtDCompositionDestroyConnection, in which one frees composition frames the other still uses. Kaspersky states the flaw cannot be exploited within a sandbox, which is why the in-the-wild exploit stops when it runs from Google Chrome; an ordinary unsandboxed process that runs the crafted application can still reach kernel-mode code execution. SC-39 separates processes from each other and does not require the sandboxing that stops this exploit, so a host that meets SC-39 still exposes the race to every unsandboxed user process.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and disclosure and sets no timeframe, and for entities under Implementing Regulation (EU) 2024/2690, point 6.6.1 requires security patches within a reasonable time after they become available. Microsoft published the fix on March 12, 2019 with the flaw already marked exploited in the targeted attacks Kaspersky detected in February 2019, so a reasonable time counted from availability starts after exploitation, and neither text shortens it for a flaw that is exploited at release.",
+      "NIS2-Art21-incident-handling": "NIS2 Article 21(2)(b) requires incident handling. This flaw is a local escalation, so a detection of it means an attacker already runs code on the host, and Kaspersky found it in targeted attacks it believes involved several actors; Article 21(2)(b) does not say what a handling process must investigate once an escalation attempt is detected, so a blocked attempt can be closed on the endpoint without tracing how the attacker first gained code execution.",
+      "UK-CAF-B4": "CAF B4.d expects announced vulnerabilities to be tracked and prioritized and externally exposed ones mitigated promptly, and at Partially achieved it accepts temporary mitigations for an extended period on vulnerabilities that are not externally exposed. Microsoft announced this local Win32k race condition on March 12, 2019, already marked exploited, and lists no workaround or mitigation, so there is no temporary mitigation to hold, and a flaw classed as not externally exposed can wait for an extended period at that level with no protection until the update and its reboot.",
+      "AU-Essential-8-Patch": "The Essential Eight patches operating systems within windows the ISM sets by asset class. Microsoft rated this flaw Important and marked it exploited when it released the fix on March 12, 2019, so a working exploit existed from release. Internet-facing servers on Windows Server 2012, 2012 R2, 2016, 2019, 1709 or 1803 were due within 48 hours at every maturity level (ISM-1877), since the two-week window (ISM-1694) applies only when the vendor rates a flaw non-critical and no working exploit exists. Workstations and non-internet-facing servers were due within one month at Maturity Levels One and Two (ISM-1695) and within 48 hours at Maturity Level Three (ISM-1696). Kaspersky detected exploitation in February 2019, before any fix or mitigation existed, and every window starts at the vendor's release, so that exposure is outside every window at every maturity level.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities is obtained, exposure is evaluated and appropriate measures are taken. Kaspersky reported this flaw to Microsoft privately on February 22, 2019, so no public information existed until the March 12, 2019 release, which already marked it exploited, and Microsoft lists no workaround; the only measure A.8.8 can drive is the update, and A.8.8 does not require the register to confirm that the host restarted into the fixed win32k component."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path; the March 2019 Windows security update replaces the Win32k component and requires a host restart. Microsoft lists no workaround or mitigation for this race condition. Extended support has ended for Windows 8.1 and RT 8.1 (January 2023) and for Windows Server 2012 and 2012 R2 (October 2023, with paid Extended Security Updates running to October 2026), servicing has ended for Windows Server 1709 and 1803, and Windows 10 reached end of support on October 14, 2025 for its Home, Pro, Enterprise and Education editions and for Windows 10 Enterprise 2015 LTSB (version 1507); replacing those releases is the remaining remediation. Windows Server 2016 is supported to January 2027, Windows Server 2019 and Windows 10 Enterprise LTSC 2019 (version 1809) to January 2029, and Windows 10 Enterprise 2016 LTSB (version 1607) to October 2026.",
+    "affected": "Microsoft Windows Win32k, the Windows Graphics Component. A local, authenticated user who runs a crafted application triggers a race condition between the NtDCompositionDiscardFrame and NtDCompositionDestroyConnection syscalls, producing a use-after-free and kernel-mode code execution. Affected: Windows 8.1, Windows RT 8.1, Windows 10 1507, 1607, 1703, 1709, 1803 and 1809, Windows Server 2012 and 2012 R2, Windows Server 1709 and 1803, and Windows Server 2016 and 2019. The in-the-wild exploit targeted 64-bit Windows 8 through Windows 10 build 15063 and stopped execution if its module file name contained chrome.exe, because, per Kaspersky, the flaw cannot be exploited within a sandbox.",
+    "affected_versions": [
+      "Windows 8.1 and Server 2012 R2 (fixed by the March 12, 2019 update KB4489881 monthly rollup or KB4489883 security-only); Windows RT 8.1 (KB4489881 only)",
+      "Windows Server 2012 (KB4489891 or KB4489884)",
+      "Windows 10 1507 (KB4489872), 1607 and Server 2016 (KB4489882), 1703 (KB4489871), 1709 and Server 1709 (KB4489886), 1803 and Server 1803 (KB4489868), 1809 and Server 2019 (KB4489899)"
+    ],
+    "vendor_update_paths": [
+      "Apply the March 12, 2019 Microsoft security update for the affected release, per Microsoft's advisory for CVE-2019-0797 (for example KB4489899 for Windows 10 1809 and Server 2019, KB4489882 for 1607 and Server 2016, KB4489881 or KB4489883 for Windows 8.1 and Server 2012 R2, or KB4489881 for Windows RT 8.1); the update completes on a system restart.",
+      "No vendor configuration workaround is published; the security update is the remedy, and applying it requires a host reboot for the fixed Win32k component to load."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 53,
+    "rwep_notes": "RWEP 53. cisa_kev +25, active_exploitation +20, blast_radius +18, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2021-28310": {
+    "name": "Microsoft Win32k Privilege Escalation Vulnerability (CVE-2021-28310)",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-787"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "An out-of-bounds write in dwmcore.dll, part of Desktop Window Manager (dwm.exe), reached through the DirectComposition API. Only three win32kbase.sys syscalls are needed: NtDCompositionCreateChannel, NtDCompositionProcessChannelBatchBuffer and NtDCompositionCommitChannel. An attacker grooms the dwm.exe heap with CreateResource, ReleaseResource and SetResourceBufferProperty commands so a controlled buffer is allocated at a chosen location, then triggers the missing bounds check to write controlled data at a controlled offset. The exploit writes shellcode, gains code execution in the Desktop Window Manager context and injects further shellcode into another system process, escalating a local low-privileged process to SYSTEM.",
+    "epss_score": 0.0833,
+    "epss_percentile": 0.94698,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-28310",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-28310",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28310",
+        "severity": "important",
+        "published_date": "2021-04-13"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-28310",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28310"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation.",
+    "type": "dwm-directcomposition-oob-write-lpe",
+    "blast_radius": 26,
+    "poc_available": false,
+    "poc_description": "No packaged working exploit that reaches SYSTEM was located at a nameable public location. There is no Exploit-DB entry, no Metasploit module and no ProjectDiscovery nuclei template for this CVE, which is a local privilege escalation rather than a network-reachable flaw. The GitHub repository jessica0f0116/DirectComposition-exp hosts a cve_2021_28310 source project (a Rust project with a main.rs), which its author describes as variant analysis; its README states that the attached proof of concept only shows how to overwrite a vtable pointer and that dwm.exe crashes when the heap groom fails, so the hosted code demonstrates the out-of-bounds write primitive rather than a full escalation to SYSTEM. Kaspersky's Securelist article is a technical analysis without hosted exploit code.",
+    "iocs": {
+      "behavioral": [
+        "A process that is not a graphics or compositor component issuing the DirectComposition syscalls NtDCompositionCreateChannel, NtDCompositionProcessChannelBatchBuffer and NtDCompositionCommitChannel in volume to groom and spray the dwm.exe heap",
+        "A batch of DirectComposition commands built from repeated CreateResource, ReleaseResource and SetResourceBufferProperty operations followed by a low-privileged process gaining SYSTEM",
+        "Shellcode running in the Desktop Window Manager (dwm.exe) context and a second stage injected into another system process, which is the last step of the documented exploitation chain"
+      ],
+      "network": [],
+      "host": [
+        "Kaspersky endpoint verdicts HEUR:Exploit.Win32.Generic, HEUR:Trojan.Win32.Generic or PDM:Exploit.Win32.Generic raised on the host, which are the detections named for this exploit",
+        "dwm.exe crashing or becoming unstable, consistent with a failed heap groom or an out-of-bounds write that missed its target",
+        "A host missing the April 13, 2021 cumulative update (KB5001330, KB5001337, KB5001339 or KB5001342 depending on the Windows build) while a local user can run code"
+      ],
+      "_ioc_source_note": "The mechanism, the three DirectComposition syscalls, the CreateResource/ReleaseResource/SetResourceBufferProperty command set, the heap-groom-and-spray sequence, the shellcode-into-dwm.exe then inject-into-another-system-process steps, and the Kaspersky detection verdicts (HEUR:Exploit.Win32.Generic, HEUR:Trojan.Win32.Generic, PDM:Exploit.Win32.Generic) were read from Kaspersky's Securelist write-up at https://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898/ , which is a technical analysis and not exploit code. The missing-update host indicator lists the April 2021 KB numbers taken from Microsoft's Security Update Guide at https://api.msrc.microsoft.com/sug/v2.0/en-US/affectedProduct?%24filter=cveNumber%20eq%20%27CVE-2021-28310%27 . The following are general hunting heuristics rather than artifacts read from a source: the qualifier that the syscalls issue from a process that is not a graphics or compositor component and in volume, and dwm.exe crashing or becoming unstable on a failed heap groom. No network indicators are given because the flaw is a local privilege escalation with no network component. No actor infrastructure, file hash or command-and-control address is listed: Kaspersky links the exploit to the same actor as CVE-2021-1732 (the BITTER group) but publishes the supporting indicators only to its intelligence customers, so none are reproduced here."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Kaspersky researcher Boris Larin found the exploit through the company's exploit-prevention technology while analyzing the CVE-2021-1732 exploit used by the BITTER group. The write-up credits human analysis and names no AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-28310 (CWE-787, CVSS 7.8) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2021-28310 (Win32k Elevation of Privilege Vulnerability). Kaspersky's Boris Larin is credited with finding the in-the-wild exploit and reporting it to Microsoft in February 2021.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the KEV catalog on 2021-11-03 with a 2021-11-17 due date; the KEV entry records ransomware use as Unknown and does not flag forensic triage. Microsoft's Security Update Guide records the flaw as exploited and not publicly disclosed at the April 13, 2021 release, marking it Exploitation Detected. Kaspersky reports the zero-day was used in the wild before the patch, found while analyzing the CVE-2021-1732 exploit attributed to the BITTER group, and states the escalation was likely paired with a browser exploit to leave a sandbox or reach SYSTEM, though it did not capture the full chain. No named campaign indicators are public beyond Kaspersky's intelligence-customer reporting.",
+    "attack_refs": [
+      "T1068",
+      "T1055"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "NIST SP 800-53 SI-2 flaw remediation drives the April 13, 2021 cumulative update (KB5001330, KB5001337, KB5001339, KB5001342), but SI-2 measures the clock from a published fix. This flaw was exploited as a zero-day before that release, so for the pre-patch period there was no update to deploy and the control offers no coverage for the window in which SYSTEM was reached.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe. For an operator within the scope of Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches applied within a reasonable time and, where no patch is available, additional measures with residual risk accepted, without naming those measures. The only vendor remediation for the dwmcore.dll out-of-bounds write was the April 13, 2021 cumulative update, and Kaspersky reports the exploit was used in the wild before that update shipped, so a reasonable-time patch policy had no fix to apply and 6.6.1 identifies no concrete interim measure for the pre-patch window.",
+      "UK-CAF-B4": "UK CAF Principle B4 asks that externally exposed vulnerabilities are mitigated promptly and that temporary mitigations are in place for unsupported systems. This local escalation abuses DirectComposition syscalls in win32kbase.sys and an out-of-bounds write in dwmcore.dll, for which there is no vendor configuration mitigation to stand up short of the April 13, 2021 cumulative update, so B4's outcome rests entirely on patching, and promptly is not calibrated to a flaw exploited as a zero-day before the fix existed.",
+      "AU-Essential-8-Patch": "The Essential Eight patch controls run every window from the vendor's release. The affected set includes Windows Server 2019 and Server versions 1909, 2004 and 20H2, so an internet-facing server instance maps to ISM-1877 (48 hours at every maturity level when the vendor rates the flaw critical or a working exploit exists; two weeks when it rates it non-critical and no working exploit exists, ISM-1694), and a workstation or non-internet-facing server maps to ISM-1695 (one month at Maturity Levels One and Two) and, at Maturity Level Three, ISM-1696 (48 hours when the vendor rates it critical or a working exploit exists) and ISM-1902 (one month when the vendor rates it non-critical and no working exploit exists). Microsoft marked the flaw Exploitation Detected at the April 13, 2021 release, so the working-exploit condition was met from that date, but Kaspersky reports it was exploited as a zero-day before the update existed, so no window covered the period of compromise, which began before any fix shipped.",
+      "ISO-27001-2022-A.8.8": "ISO/IEC 27001:2022 control A.8.8 requires technical vulnerabilities to be evaluated and addressed on timescales set by the assessed risk. Microsoft rated this flaw Important rather than Critical yet marked it Exploitation Detected at the April 13, 2021 release. The exploit was already in use by February 2021, when Kaspersky reported it to Microsoft, and it remained a zero-day until the April 13, 2021 update. An A.8.8 program that keys its timescale to the vendor severity would assign a lower-priority window to a flaw already exploited in the wild, and in any case the timescale can only start once the April 13, 2021 fix exists, so it offers nothing for the pre-patch period."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "The April 13, 2021 cumulative update that fixes dwmcore.dll in the Desktop Window Manager requires a host reboot to take effect. No source documents a reload-free or live-patch path for this fix.",
+    "affected": "Microsoft Windows Desktop Window Manager (dwmcore.dll) reached through the DirectComposition API in win32kbase.sys. A local, low-privileged process escalates to SYSTEM. Affected builds are Windows 10 1803, 1809, 1909, 2004 and 20H2, and Windows Server 2019, Server version 1909, Server version 2004 and Server version 20H2.",
+    "affected_versions": [
+      "Windows 10 Version 1803: fixed by KB5001339 (April 13, 2021); reboot required",
+      "Windows 10 Version 1809 and Windows Server 2019: fixed by KB5001342 (April 13, 2021); reboot required",
+      "Windows 10 Version 1909 and Windows Server version 1909: fixed by KB5001337 (April 13, 2021); reboot required",
+      "Windows 10 Version 2004, Windows 10 Version 20H2, Windows Server version 2004 and Windows Server version 20H2: fixed by KB5001330 (April 13, 2021); reboot required"
+    ],
+    "vendor_update_paths": [
+      "Apply the April 13, 2021 cumulative update for the running build: KB5001339 for Windows 10 1803, KB5001342 for Windows 10 1809 and Windows Server 2019, KB5001337 for Windows 10 and Windows Server version 1909, and KB5001330 for Windows 10 and Windows Server versions 2004 and 20H2. Each update requires a reboot to take effect.",
+      "Because the flaw was exploited as a zero-day, treat a host that ran a local user's code before the update as potentially compromised and investigate rather than assuming the patch is sufficient after the fact."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 61,
+    "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2019-0863": {
+    "name": "Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-59"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.",
+    "epss_score": 0.05207,
+    "epss_percentile": 0.92128,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-0863",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2019-0863",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0863",
+        "severity": "important",
+        "published_date": "2019-05-14"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2019-0863",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0863"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.",
+    "type": "wer-file-handling-lpe",
+    "blast_radius": 26,
+    "poc_available": true,
+    "poc_description": "A public proof of concept exists at Exploit-DB 46917 (exploits/windows/local/46917.txt), a Windows Error Reporting discretionary access control list local privilege escalation indexed against CVE-2019-0863 in the Exploit-DB catalog. Its description turns c:\\programdata\\microsoft\\windows\\wer\\reportqueue into a junction to an attacker-controlled folder, drops a crafted .wer file, and triggers the WER reporting queue task so the service writes an attacker-chosen DACL; the sample makes c:\\windows\\system32\\drivers\\pci.sys writable by a non-admin user. The named vulnerable function is UtilAddAccessToPath in wer.dll.",
+    "iocs": {
+      "behavioral": [
+        "A local process creating a junction (reparse point) at c:\\programdata\\microsoft\\windows\\wer\\reportqueue or another Windows Error Reporting queue path pointing outside the WER tree",
+        "A crafted .wer file dropped into a redirected report folder followed by the WER reporting queue scheduled task being triggered",
+        "A previously non-writable protected file, such as a driver in c:\\windows\\system32\\drivers, becoming writable or modified by a non-administrative account"
+      ],
+      "network": [],
+      "host": [
+        "New or unexpected junction points under the WER report queue or archive directories",
+        "The Windows Error Reporting component, running as SYSTEM and triggered by the WER reporting queue task, writing a DACL to a file in a protected location on behalf of a low-privileged user",
+        "A host missing the May 14, 2019 update that fixes WER while a local user can run code: the Monthly Rollup KB4499164 or Security-Only KB4499175 on Windows 7 SP1 and Windows Server 2008 R2 SP1; KB4499151 or KB4499165 on Windows 8.1 and Windows Server 2012 R2 (KB4499151 only on Windows RT 8.1); KB4499171 or KB4499158 on Windows Server 2012; or the cumulative update for the Windows 10 or Windows Server build: KB4499154 (1507), KB4494440 (1607 and Windows Server 2016), KB4499181 (1703), KB4499179 (1709), KB4499167 (1803 and Windows Server version 1803), KB4494441 (1809 and Windows Server 2019) or KB4497936 (1903 and Windows Server version 1903)"
+      ],
+      "_ioc_source_note": "The junction from c:\\programdata\\microsoft\\windows\\wer\\reportqueue to an attacker folder, the crafted .wer file, triggering the WER reporting queue task, the pci.sys-becomes-writable result and the vulnerable function UtilAddAccessToPath in wer.dll were read from the Exploit-DB proof-of-concept description at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/windows/local/46917.txt ; only the text description was read, not compiled exploit binaries. The fixing May 14, 2019 KB numbers were read from Microsoft's Security Update Guide at https://api.msrc.microsoft.com/sug/v2.0/en-US/affectedProduct?%24filter=cveNumber%20eq%20%27CVE-2019-0863%27 . The following are general hunting heuristics rather than artifacts read from the proof of concept: new or unexpected junction points under the WER report queue or archive directories, and the Windows Error Reporting component writing to a protected location on behalf of a non-administrative user (the source names no process). No network indicators are given because the flaw is a local privilege escalation. No actor infrastructure, file hash or command-and-control address is listed because no source consulted attributes this CVE to a named campaign."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Microsoft credits Polar Bear and Gal De Leon of Palo Alto Networks in the May 2019 update. The public proof of concept, AngryPolarBearBug2, was published by SandboxEscaper on May 22, 2019. No AI tooling is claimed by any source.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2019-0863 (CWE-59, CVSS 7.8) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2019-0863 (Windows Error Reporting Elevation of Privilege Vulnerability). Microsoft's May 2019 acknowledgments credit Polar Bear and Gal De Leon of Palo Alto Networks, both outside the vendor.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the KEV catalog on 2021-11-03 with a 2022-05-03 due date; the KEV entry records ransomware use as Unknown and does not flag forensic triage. Microsoft's Security Update Guide records the flaw as both publicly disclosed and exploited at the May 14, 2019 release, marking it Exploitation Detected. A public proof of concept (Exploit-DB 46917, AngryPolarBearBug2) followed on May 22, 2019. No named campaign is attributed to this CVE in the sources consulted.",
+    "attack_refs": [
+      "T1068"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "NIST SP 800-53 SI-2 flaw remediation drives the May 14, 2019 update and measures its clock from that published fix. Microsoft marked the flaw both publicly disclosed and exploited at release, so from day one a low-privileged user could turn the Windows Error Reporting junction and DACL-write into a writable protected driver and reach SYSTEM; an SI-2 program on a routine monthly cadence leaves that window open on every multi-user host until the update is installed.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe. For an operator within the scope of Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires patches applied within a reasonable time and, where no patch is available, additional measures with residual risk accepted. Here a fix shipped on May 14, 2019, the same day Microsoft recorded public disclosure and exploitation, so the shortfall is that the directive fixes no deadline: an operator treating an Important-rated local escalation as routine can leave the WER DACL-write reachable on shared hosts while the flaw is already exploited.",
+      "UK-CAF-B4": "UK CAF Principle B4 asks that externally exposed vulnerabilities are mitigated promptly and that temporary mitigations are in place for unsupported systems. This is a local escalation abusing a junction on the Windows Error Reporting queue and the WER service, for which the only vendor remedy is the May 14, 2019 update; there is no vendor configuration mitigation to stand up as an interim measure, so B4's outcome rests entirely on prompt patching, and promptly is not calibrated to a flaw Microsoft recorded as exploited on the day it was disclosed.",
+      "AU-Essential-8-Patch": "The Essential Eight patch controls run every window from the vendor's release. Microsoft's Security Update Guide marked this flaw exploited at the May 14, 2019 release, so a working exploit existed from that date. An internet-facing instance of any affected Windows Server release (Windows Server 2008 R2 SP1, 2012, 2012 R2, 2016 and 2019, and Windows Server versions 1803 and 1903) maps to ISM-1877 (48 hours at every maturity level when the vendor rates the flaw critical or a working exploit exists; two weeks when it rates it non-critical and no working exploit exists, ISM-1694). A workstation or non-internet-facing server maps to ISM-1695 (one month at Maturity Levels One and Two) and, at Maturity Level Three, ISM-1696 (48 hours when the vendor rates it critical or a working exploit exists) and ISM-1902 (one month when the vendor rates it non-critical and no working exploit exists). Because exploitation was confirmed at release, the 48-hour windows applied to internet-facing servers at every maturity level and to workstations at Maturity Level Three, yet at Maturity Levels One and Two a workstation or non-internet-facing server kept the one-month window on an escalation already exploited in the wild.",
+      "ISO-27001-2022-A.8.8": "ISO/IEC 27001:2022 control A.8.8 sets patch timescales by assessed risk. Microsoft rated this flaw Important, not Critical, yet marked it publicly disclosed and exploited at the May 14, 2019 release, with a public proof of concept following on May 22, 2019. An A.8.8 program that keys its timescale to the vendor severity would assign a lower-priority window to an escalation that was already being exploited when the fix shipped."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Windows offers no reload-free path for a Windows Error Reporting service fix; the May 14, 2019 update requires a host reboot. No source documents a live-patch capability for this fix.",
+    "affected": "Microsoft Windows Error Reporting (WER) file handling. A local low-privileged user runs code in kernel mode or as SYSTEM by redirecting a WER queue path with a junction and forcing the service to write an attacker-chosen DACL onto a protected file. Affected builds are Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, Windows Server 2012 and R2, Windows Server 2016 and 2019, Windows Server version 1803 (Server Core) and version 1903, and Windows 10 versions 1507, 1607, 1703, 1709, 1803, 1809 and 1903.",
+    "affected_versions": [
+      "Windows 7 SP1 and Windows Server 2008 R2 SP1: fixed by the May 14, 2019 Monthly Rollup KB4499164 or Security-Only KB4499175; reboot required",
+      "Windows 8.1, Windows RT 8.1 (Monthly Rollup only) and Windows Server 2012 R2: fixed by the May 14, 2019 Monthly Rollup KB4499151 or Security-Only KB4499165; reboot required",
+      "Windows Server 2012: fixed by the May 14, 2019 Monthly Rollup KB4499171 or Security-Only KB4499158; reboot required",
+      "Windows 10 1507: KB4499154; Windows 10 1607 and Windows Server 2016: KB4494440; Windows 10 1703: KB4499181; Windows 10 1709: KB4499179; Windows 10 1803 and Windows Server version 1803 (Server Core): KB4499167; Windows 10 1809 and Windows Server 2019: KB4494441; Windows 10 1903 and Windows Server version 1903: KB4497936 (all May 14, 2019); reboot required"
+    ],
+    "vendor_update_paths": [
+      "Apply the May 14, 2019 update for the running build: the Monthly Rollup (KB4499164, KB4499151, KB4499171) or Security-Only update (KB4499175, KB4499165, KB4499158) for Windows 7, 8.1 and Server 2012/R2, and the Windows 10 cumulative updates (KB4499154, KB4494440, KB4499181, KB4499179, KB4499167, KB4494441, KB4497936) for the matching build; KB4499167 also covers Windows Server version 1803 (Server Core). Each requires a reboot.",
+      "Because the flaw was publicly disclosed and exploited at release, treat a multi-user or shared host that ran untrusted local code before the update as potentially compromised and investigate for tampered protected files such as drivers under system32\\drivers."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 81,
+    "rwep_notes": "RWEP 81. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2019-1214": {
+    "name": "Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-119"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'.",
+    "epss_score": 0.01419,
+    "epss_percentile": 0.71679,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-1214",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2019-1214",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1214",
+        "severity": "important",
+        "published_date": "2019-09-10"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2019-1214",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1214"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.",
+    "type": "clfs-driver-lpe",
+    "blast_radius": 26,
+    "poc_available": false,
+    "poc_description": "No working exploit code was located at a nameable public location. There is no Exploit-DB entry for CVE-2019-1214, no Metasploit module and no ProjectDiscovery nuclei template (it is a local kernel privilege escalation). A GitHub code search for the CVE returns no repository. Microsoft's advisory describes the flaw but hosts no proof of concept, and no public root-cause write-up with exploit code was found.",
+    "iocs": {
+      "behavioral": [
+        "A local process creating or opening a large number of Common Log File System containers (.blf base log files and their container files) to groom kernel memory before an escalation",
+        "A low-privileged process gaining SYSTEM shortly after heavy use of the CLFS API (CreateLogFile and related calls)",
+        "Unexpected use of the CLFS API by a process that has no logging function"
+      ],
+      "network": [],
+      "host": [
+        "A host missing the September 10, 2019 update that fixes the CLFS driver while a local user can run code: the Monthly Rollup KB4516065 or Security-Only KB4516033 on Windows 7 SP1 and Windows Server 2008 R2 SP1; KB4516026 or KB4516051 on Windows Server 2008 SP2; KB4516067 or KB4516064 on Windows 8.1 and Windows Server 2012 R2 (KB4516067 only on Windows RT 8.1); KB4516055 or KB4516062 on Windows Server 2012; or the cumulative update for the Windows 10 or Windows Server build: KB4516070 (1507), KB4516044 (1607 and Windows Server 2016), KB4516068 (1703), KB4516066 (1709), KB4516058 (1803 and Windows Server version 1803), KB4512578 (1809 and Windows Server 2019) or KB4515384 (1903 and Windows Server version 1903)",
+        "Kernel crash or bugcheck involving clfs.sys, consistent with a failed memory-corruption attempt",
+        "New .blf files or CLFS containers created in unusual locations by a non-service account"
+      ],
+      "_ioc_source_note": "The affected component (the Windows Common Log File System driver, which improperly handles objects in memory) and the September 10, 2019 fixing KB numbers were read from Microsoft's Security Update Guide at https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2019-1214 and https://api.msrc.microsoft.com/sug/v2.0/en-US/affectedProduct?%24filter=cveNumber%20eq%20%27CVE-2019-1214%27 . No detection-grade exploit source (Exploit-DB, Metasploit, nuclei template or public root-cause write-up) was reachable for this CVE, so all behavioral and host indicators are general hunting heuristics for a CLFS-driver local privilege escalation rather than artifacts read from a working exploit. No network indicators are given because the flaw is a local privilege escalation. No actor infrastructure, file hash or command-and-control address is listed because no source consulted attributes this CVE to a named campaign."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Microsoft credits bee13oy of Qihoo 360 Vulcan Team in the September 2019 update. No AI tooling is claimed by any source.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2019-1214 (CWE-119, CVSS 7.8) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2019-1214 (Windows Common Log File System Driver Elevation of Privilege Vulnerability). Microsoft's September 2019 acknowledgments credit bee13oy of Qihoo 360 Vulcan Team, outside the vendor.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the KEV catalog on 2021-11-03 with a 2022-05-03 due date; the KEV entry records ransomware use as Unknown and does not flag forensic triage. At the September 10, 2019 release Microsoft flagged the Common Log File System driver flaw as under active attack, reported as seen only against older operating systems, and on September 11, 2019 revised the advisory to not under active attack; Microsoft's current record marks it not exploited. The KEV listing more than two years later is CISA's evidence of in-the-wild exploitation. No named campaign is attributed to this CVE in the sources consulted.",
+    "attack_refs": [
+      "T1068"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "NIST SP 800-53 SI-2 flaw remediation drives the September 10, 2019 update and measures its clock from that fix. Microsoft's release-day active-attack flag was corrected on September 11, 2019 and Exploit-DB indexes no public exploit for the flaw, so a routine SI-2 window would have closed long before CISA added the flaw to KEV on November 3, 2021; no source dates the exploitation itself. The residual gap is that SI-2's flaw-remediation loop does not re-open a case when a fixed flaw is later KEV-listed, so a host still unpatched at that point has no fresh trigger.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe. For an operator within the scope of Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires patches applied within a reasonable time and additional measures where no patch is available. A fix for the CLFS driver flaw shipped on September 10, 2019, so a reasonable-time policy could have closed it; the shortfall is that the directive sets no deadline and no re-evaluation trigger, so a host left unpatched by the time CISA listed the flaw in November 2021 is not brought back into scope by the obligation.",
+      "UK-CAF-B4": "UK CAF Principle B4 asks that externally exposed vulnerabilities are mitigated promptly and that temporary mitigations are in place for unsupported systems. This is a local kernel escalation in clfs.sys with no vendor configuration mitigation, so B4's outcome rests on prompt patching from the September 10, 2019 release; because the flaw was only confirmed exploited by the 2021 KEV listing, B4 gives no signal to re-check a host that was deferred as low-priority in 2019 and left unpatched.",
+      "AU-Essential-8-Patch": "The Essential Eight patch controls run every window from the vendor's release. An internet-facing Windows Server 2008 through 2019 instance maps to ISM-1877 (48 hours at every maturity level when the vendor rates the flaw critical or a working exploit exists; two weeks when it rates it non-critical and no working exploit exists, ISM-1694). A workstation or non-internet-facing server maps to ISM-1695 (one month at Maturity Levels One and Two) and, at Maturity Level Three, ISM-1696 (48 hours when the vendor rates it critical or a working exploit exists) and ISM-1902 (one month when the vendor rates it non-critical and no working exploit exists). Microsoft rated the flaw Important for every affected product and corrected its release-day active-attack flag on September 11, 2019, and Exploit-DB indexes no public exploit for the flaw, so the slower windows are the ones that applied: ISM-1694 for internet-facing servers, and for workstations and non-internet-facing servers ISM-1695 at Maturity Levels One and Two and ISM-1902 at Maturity Level Three. CISA did not list the flaw until November 3, 2021, so even the one-month window closed around October 2019, long before any confirmed exploitation; meeting it would have patched the flaw. The residual is that installing the update does not trigger a compromise assessment of a host that ran untrusted code during the exposure period.",
+      "ISO-27001-2022-A.8.8": "ISO/IEC 27001:2022 control A.8.8 sets patch timescales by assessed risk. Microsoft rated the CLFS driver flaw Important and, after retracting a release-day active-attack flag on September 11, 2019, marked it not exploited; an A.8.8 program keyed to the vendor severity and exploit status would assign it a low-priority window, which is at odds with CISA's later KEV listing establishing in-the-wild use in November 2021."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Windows offers no reload-free path for a Common Log File System driver fix; the September 10, 2019 update requires a host reboot. No source documents a live-patch capability for this fix.",
+    "affected": "The Microsoft Windows Common Log File System (CLFS) driver, which improperly handles objects in memory. A local low-privileged process escalates to SYSTEM. Affected builds are Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows RT 8.1, Windows Server 2012 and R2, Windows Server 2016 and 2019, Windows Server version 1803 (Server Core) and version 1903, and Windows 10 versions 1507, 1607, 1703, 1709, 1803, 1809 and 1903.",
+    "affected_versions": [
+      "Windows 7 SP1 and Windows Server 2008 R2 SP1: fixed by the September 10, 2019 Monthly Rollup KB4516065 or Security-Only KB4516033; reboot required",
+      "Windows Server 2008 SP2: fixed by the September 10, 2019 Monthly Rollup KB4516026 or Security-Only KB4516051; reboot required",
+      "Windows 8.1, Windows RT 8.1 (Monthly Rollup only) and Windows Server 2012 R2: fixed by the September 10, 2019 Monthly Rollup KB4516067 or Security-Only KB4516064; reboot required",
+      "Windows Server 2012: fixed by the September 10, 2019 Monthly Rollup KB4516055 or Security-Only KB4516062; reboot required",
+      "Windows 10 1507: KB4516070; Windows 10 1607 and Windows Server 2016: KB4516044; Windows 10 1703: KB4516068; Windows 10 1709: KB4516066; Windows 10 1803 and Windows Server version 1803 (Server Core): KB4516058; Windows 10 1809 and Windows Server 2019: KB4512578; Windows 10 1903 and Windows Server version 1903: KB4515384 (all September 10, 2019); reboot required"
+    ],
+    "vendor_update_paths": [
+      "Apply the September 10, 2019 update for the running build: the Monthly Rollup (KB4516065, KB4516026, KB4516067, KB4516055) or Security-Only update (KB4516033, KB4516051, KB4516064, KB4516062) for Windows 7, Server 2008/R2, 8.1 and Server 2012/R2, and the Windows 10 cumulative updates (KB4516070, KB4516044, KB4516068, KB4516066, KB4516058, KB4512578, KB4515384) for the matching build; KB4516058 also covers Windows Server version 1803 (Server Core). Each requires a reboot.",
+      "Because CISA lists the flaw as exploited, prioritize multi-user and shared hosts where a low-privileged attacker could reach the CLFS driver, and confirm the running build on-host after deployment."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 61,
+    "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2020-0601": {
+    "name": "Microsoft Windows CryptoAPI Spoofing Vulnerability",
+    "cvss_score": 8.1,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
+    "cwe_refs": [
+      "CWE-295"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.",
+    "epss_score": 0.89436,
+    "epss_percentile": 0.99778,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-0601",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2020-0601",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601",
+        "severity": "important",
+        "published_date": "2020-01-14"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-0601",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.",
+    "type": "certificate-validation-spoofing",
+    "blast_radius": 26,
+    "poc_available": true,
+    "poc_description": "Working exploit code is at the named repositories ly4k/CurveBall on GitHub and kudelskisecurity/chainoffools on GitHub, and at Exploit-DB 47933 (author ollypwn). Each builds a rogue certificate authority whose public key matches a trusted ECC root while supplying an attacker-chosen generator, then signs an executable (code signing) or a TLS server certificate (man-in-the-middle) that the platform accepts as trusted. The README files describe the method rather than host attack traffic. The repositories' text files and public certificates and the Exploit-DB entry were read for detection artifacts only; the private key files were not fetched.",
+    "iocs": {
+      "behavioral": [
+        "After the January 2020 update is applied, an Application event log entry with Event ID 1 from source Audit-CVE, which the update records when a certificate that exploits this flaw is validated.",
+        "An executable whose Authenticode signature carries, in its certificate chain, an issuing CA certificate whose public key equals the key of a trusted ECC root but which uses explicit elliptic-curve domain parameters with a non-standard generator rather than a named curve. The signing (leaf) certificate itself can use any key type; the explicit parameters are on the CA certificate.",
+        "A code-signing or TLS certificate whose signing authority presents the same public key as a trusted ECC root, for example Microsoft ECC Product Root Certificate Authority 2018 or another root on the P-384 curve, while carrying explicit ECC domain parameters rather than a named curve, so it validates without having been issued by that root."
+      ],
+      "network": [
+        "A TLS server that sends, in its certificate chain, a CA certificate presenting the public key of a trusted ECC root while carrying explicit ECC domain parameters with an attacker-supplied generator, the condition the public exploits rely on. The explicit parameters are on that CA certificate, not on the server's own certificate, which can use any key type.",
+        "A TLS server chain whose top certificate is a self-signed CA certificate that carries the public key of a trusted ECC root (and, in CurveBall, the same Subject Key Identifier) while its name, serial number and thumbprint differ from that root's. The trusted root itself is not in the served chain, so a check for a chain ending at a trusted root's name or thumbprint does not find it; compare the CA certificate's public key against the trusted ECC roots instead. The CurveBall demonstration CA has the subject C=DK, ST=Denmark, L=Copenhagen, O=ollypwn and a 30-day validity, and the chainoffools CA has the subject O=Kudelski Security PoC, CN=github.com; an attacker can change these values."
+      ],
+      "host": [
+        "Windows 10 (any build from 1507 through 1909), Windows Server 2016 or 2019, or Windows Server version 1803, 1903 or 1909 (Server Core installation), at a patch level earlier than the January 2020 cumulative update.",
+        "Certificates carrying explicit ECC parameters, rather than a named curve, in a machine or user certificate store."
+      ],
+      "_ioc_source_note": "The impact and the detection basis (the platform failing to check the ECC generator so a spoofed authority validates) come from CISA advisory AA20-014A at https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-014a and from the CurveBall source at https://raw.githubusercontent.com/ly4k/CurveBall/master/ (README.md, main.rb, openssl_cs.conf, openssl_tls.conf, tls/index.js, and the public certificates code_signing/rogue.crt, code_signing/cert.crt, tls/spoofed_ca.crt and tls/cert.crt parsed with openssl), the chainoffools source at https://raw.githubusercontent.com/kudelskisecurity/chainoffools/master/ (README.md, gen-key.py, ca.cnf and openssl.cnf) and Exploit-DB 47933 at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/windows/local/47933.rb, all read for detection artifacts only; the private key files were not fetched. The self-signed CA subjects, the 30-day validity and the matching public key and Subject Key Identifier in the second network entry come from tls/spoofed_ca.crt and the chainoffools ca.cnf. Both READMEs put the explicit parameters on the spoofed CA certificate and create the signing or server certificate from a separate key, which the CurveBall README says can be of any type, and the CurveBall README has the spoofed CA certificate sent as the certificate chain; the Authenticode and TLS indicators therefore inspect the CA certificate in the chain, not the leaf. The chainoffools README states the spoofing authority can be built from any trusted P-384 root, not only a Microsoft ECC root, so the certificate indicators are keyed to any trusted ECC root and name the Microsoft root only as one example. The Event ID 1 (Audit-CVE) detection is from Microsoft's Security Update Guide record for this vulnerability at https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2020-Jan. The explicit-generator certificate indicators are general trust-inspection heuristics derived from that method rather than signatures copied from a detection product. No actor infrastructure, file hash or command-and-control address is listed, because no source consulted attributes this vulnerability to a named campaign; the National Security Agency reported it and Microsoft's advisory did not mark it exploited at release."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "The National Security Agency found and reported this flaw to Microsoft and is credited in the January 2020 advisory. No source claims any AI tooling was involved in its discovery.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2020-0601 (CWE-295, CVSS 8.1) + CISA KEV (added 2021-11-03) + Microsoft Security Update Guide advisory CVE-2020-0601 (Windows CryptoAPI Spoofing Vulnerability), which credits the National Security Agency.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2022-05-03 due date and records known ransomware use as Unknown. Microsoft rated the flaw Important and marked it not exploited at release, and the National Security Agency reported it proactively. CISA issued Emergency Directive 20-02 on 2020-01-14 requiring federal civilian agencies to patch all affected endpoints within ten business days, later folded into BOD 22-01. No named campaign or actor is attributed in the sources reviewed; public exploit code (ly4k/CurveBall, kudelskisecurity/chainoffools) appeared on 2020-01-15, the day after the fix, so a working exploit has been available since then.",
+    "attack_refs": [
+      "T1553.002",
+      "T1557"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SC-8": "SC-8 requires the confidentiality and integrity of transmitted information, which for a Windows client rests on CryptoAPI validating the server's certificate. This flaw lets an attacker present a certificate that chains to a trusted ECC root with a forged generator, so a man-in-the-middle can read or alter a TLS session that SC-8 treats as protected, and the control is restored only when the January 2020 update corrects the validation.",
+      "NIS2-Art21-network-security": "NIS2 Article 21(2) requires essential and important entities to take appropriate measures to secure network and information systems, which presumes the platform's TLS and code-signing certificate validation works. On an unpatched Windows 10 or Server 2016 and 2019 host the validation routine itself is defective, so the man-in-the-middle and signed-executable defenses an operator attests to do not hold until the January 2020 update is installed, and the obligation has no working control to point at while the platform trusts a forged ECC certificate.",
+      "UK-CAF-B4": "CAF Principle B4 expects networks and information systems to be protected through secure configuration and vulnerability management. This flaw sits in the operating system's own certificate-validation code, so a B4 assessment that checks TLS is enabled and code signing is enforced records those controls as present while the platform beneath them trusts a spoofed ECC certificate, and no configuration setting closes the gap until the January 2020 update is installed.",
+      "AU-Essential-8-Patch": "The Essential Eight patches operating systems within the timeframes the ISM sets by asset class. For the operating system of an internet-facing Windows Server 2016 or 2019 host the window is 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1877) and two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1694). For a Windows 10 workstation or a non-internet-facing Windows Server host it is one month at Maturity Levels One and Two (ISM-1695) and 48 hours at Maturity Level Three when the vendor rates the flaw critical or a working exploit exists (ISM-1696). Microsoft rated this flaw Important, not critical, but public exploit code was released on 2020-01-15, the day after the fix, so the working-exploit half of the condition was met from that date. The shortfall is that a workstation or internal-server fleet below Maturity Level Three still had a full month to apply an update against a flaw that forges trusted code-signing and TLS certificates.",
+      "ISO-27001-2022-A.8.24": "Annex A.8.24 requires rules for the effective use of cryptography and presumes the platform correctly validates the certificates the organization relies on. This flaw is in that validation: Windows CryptoAPI does not check the ECC generator, so a certificate chaining to a trusted root is accepted with an attacker-chosen key, and an A.8.24 control set that mandates TLS and signed code cannot detect that the cryptographic trust decision beneath it is forged until the update is applied."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free path exists for a defect in the operating system's certificate-validation library. Remediation is the January 2020 cumulative update, which requires a host reboot; no source documents a live-patch capability for this fix.",
+    "affected": "Windows CryptoAPI (Crypt32.dll) on Windows 10 (versions 1507 through 1909), Windows Server 2016 and 2019, and Windows Server version 1803, 1903 and 1909 (Server Core installations). Windows 7, 8.1 and Windows Server 2008 and 2012 did not include the ECC-parameter code path and are not affected. Go programs on Windows that use the system root store are also affected (Go 1.12.x before 1.12.16 and 1.13.x before 1.13.7). A forged certificate is accepted for code-signing trust, TLS server authentication and any other use of CryptoAPI elliptic-curve certificate validation.",
+    "affected_versions": [
+      "Windows 10, versions 1507 through 1909, Windows Server 2016 and 2019, and Windows Server version 1803, 1903 and 1909 (Server Core installation), at any build earlier than the January 2020 cumulative update (fixed for example by KB4534273 on Windows 10 1809 and Windows Server 2019, KB4534293 on Windows 10 1803 and Windows Server version 1803, KB4528760 on Windows 10 1903 and 1909 and Windows Server version 1903 and 1909, KB4534271 on Windows 10 1607 and Windows Server 2016)",
+      "Go on Windows, versions 1.12.x before 1.12.16 and 1.13.x before 1.13.7, when the program uses the system root store; the go1.12.16 and go1.13.7 releases (2020-01-28) mitigate the flaw for Go programs, and the Windows operating-system update is still required",
+      "Windows 7, Windows 8.1 and Windows Server 2008 and 2012 are not affected"
+    ],
+    "vendor_update_paths": [
+      "Install the January 2020 cumulative update for the running release (for example KB4534273 for Windows 10 1809 and Windows Server 2019, KB4534293 for Windows 10 1803 and Windows Server version 1803, KB4528760 for Windows 10 1903 and 1909 and Windows Server version 1903 and 1909, KB4534271 for Windows 10 1607 and Windows Server 2016); the update requires a reboot. See the Microsoft Security Update Guide entry for the full per-release build list.",
+      "After patching, alert on Application event log Event ID 1 from source Audit-CVE, which the update raises when a certificate that exploits this flaw is validated.",
+      "For Go programs on Windows that use the system root store, update to go1.12.16 or go1.13.7 (2020-01-28), which mitigate the flaw for Go applications; the Windows operating-system update is still required."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 81,
+    "rwep_notes": "RWEP 81. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2020-0986": {
+    "name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-787"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316.",
+    "epss_score": 0.15932,
+    "epss_percentile": 0.96746,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-0986",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2020-0986",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0986",
+        "severity": "important",
+        "published_date": "2020-06-09"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-0986",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0986"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.",
+    "type": "untrusted-pointer-dereference-lpe",
+    "blast_radius": 26,
+    "poc_available": false,
+    "poc_description": "No retrievable working exploit was found. A search of Exploit-DB, the ProjectDiscovery nuclei templates, the Metasploit modules and GitHub returned no dedicated exploit repository for CVE-2020-0986. Project Zero's root-cause analysis, published from its googleprojectzero/0days-in-the-wild GitHub repository as 0day-RCAs/2020/CVE-2020-0986.md, includes a proof of concept by Boris Larin of Kaspersky that the page describes as minimized and commented by Maddie Stone. The write request that code sends targets the placeholder address 0x4141414141414141, so as published it demonstrates the arbitrary write into splwow64.exe memory rather than escalating privilege. Only the lines of that code carrying detection artifacts (the port connection, the CreateDC.exe launch and the write call) were searched; the code was not read whole. NVD references a Packet Storm listing (file 160698, Microsoft Windows splWOW64 Privilege Escalation); an automated request to it is redirected to a terms-acceptance gate and then a login page, so its contents could not be retrieved and it is not cited as a working exploit. Kaspersky reports that a fully weaponized exploit was used in the wild but was not published.",
+    "iocs": {
+      "behavioral": [
+        "The print driver host splwow64.exe, which runs at medium integrity, spawning an unexpected child process or running an encoded PowerShell command.",
+        "A low-integrity process of any name, such as a browser renderer or a program the renderer started (ok.exe in the observed attack), connecting to the splwow64.exe local procedure call port and sending printer requests that splwow64.exe passes to GdiPrinterThunk, the step used to reach the vulnerable code.",
+        "A process writing a file named CreateDC.exe to disk, and splwow64.exe executing a module named PoPc.dll at medium integrity, the two components named in the observed exploit.",
+        "An Internet Explorer process creating a file named ok.exe in a temporary folder and running it; in the observed attack ok.exe contained the privilege-escalation exploit for this flaw."
+      ],
+      "network": [
+        "An outbound request to www[.]static-cdn1[.]com/update.zip, the second-stage download in the observed campaign, saved as upgrader.exe in a temporary folder."
+      ],
+      "host": [
+        "Windows 10 or Windows Server (1507 and 1607 through 2004) or Windows 8.1, Windows RT 8.1 and Server 2012 and 2012 R2 without the January 2021 update; because the June 2020 fix was incomplete, a host remains exposed until the January 2021 update (CVE-2021-1648), which also covers Windows 10 and Windows Server, version 20H2 (KB4598242). Windows 10 1709 and 1903, and Windows Server, version 1803 and 1903 (Server Core installation), received no corrected update. Endpoint detection verdict PDM:Exploit.Win32.Generic is what flagged the observed attack.",
+        "File indicators from the observed campaign, as four MD5 and SHA-256 pairs: MD5 B06F1F2D3C016D13307BC7CE47C90594 / SHA-256 D02632CFFC18194107CC5BF76AECA7E87E9082FED64A535722AD4502A4D51199; MD5 5877EAECA1FE8A3A15D6C8C5D7FA240B / SHA-256 7577E42177ED7FC811DE4BC854EC226EB037F797C3B114E163940A86FD8B078B; MD5 B72731B699922608FF3844CCC8FC36B4 / SHA-256 7765F836D2D049127A25376165B1AC43CD109D8B9D8C5396B8DA91ADC61ECCB1; MD5 E01254D7AF1D044E555032E1F78FF38F / SHA-256 81D07CAE45CAF27CBB9A1717B08B3AB358B647397F08A6F9C7652D00DBF2AE24."
+      ],
+      "_ioc_source_note": "The splwow64.exe local-procedure-call abuse, the arbitrary write into its medium-integrity memory and the GdiPrinterThunk handler that processes the printer requests come from Kaspersky's follow-up analysis at https://securelist.com/operation-powerfall-cve-2020-0986-and-variants/98329/, and the variant note from Project Zero's root-cause analysis at https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2020-0986.html; from the proof-of-concept code on that page only the lines carrying the port connection, the CreateDC.exe launch and the write call were searched. The ok.exe file that the Internet Explorer exploit writes to a temporary folder and runs, the CreateDC.exe and PoPc.dll components, the encoded PowerShell command, the www[.]static-cdn1[.]com/update.zip download, the upgrader.exe drop to a temporary folder, the PDM:Exploit.Win32.Generic verdict and the four file-hash pairs come from Kaspersky's Operation PowerFall report at https://securelist.com/ie-and-windows-zero-day-operation-powerfall/97976/, which states CreateDC.exe is written to disk and PoPc.dll is executed by splwow64.exe, and names a temporary folder for ok.exe and upgrader.exe but not for CreateDC.exe. The low-integrity local-procedure-call entry is a hunting heuristic that follows from Project Zero's description of the attacker sending the message from the low-integrity renderer and Kaspersky's report that ok.exe carried the exploit; no source publishes a detection rule for it. Kaspersky attributes the activity to Operation PowerFall and, with lower confidence, to DarkHotel, so the download domain and file hashes are listed as campaign indicators."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "The flaw was reported to Microsoft by an anonymous researcher working with Trend Micro's Zero Day Initiative, and found under exploitation by Boris Larin of Kaspersky; Microsoft also credits a reporter named Andy. No source claims AI tooling was involved.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2020-0986 (CWE-787, CVSS 7.8) + CISA KEV (added 2021-11-03) + Microsoft Security Update Guide advisory CVE-2020-0986 (Windows Kernel Elevation of Privilege Vulnerability), which credits Andy and an anonymous reporter working with Trend Micro's Zero Day Initiative. Boris Larin of Kaspersky, who found it under exploitation, is credited in the Project Zero root-cause analysis, not in Microsoft's acknowledgment for this CVE.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2022-05-03 due date and known ransomware use Unknown. Kaspersky observed it exploited in the wild on 2020-05-20 in Operation PowerFall, chained after an Internet Explorer remote code execution flaw, CVE-2020-1380 (fixed 2020-08-11), to escape the browser sandbox and escalate privilege, and attributes the activity with lower confidence to DarkHotel. The Zero Day Initiative published a limited advisory (ZDI-20-663) on 2020-05-19 after its disclosure deadline expired. Microsoft's advisory records Exploited: No; Kaspersky reported the in-the-wild use to Microsoft on 2020-06-08, one day before the June 9 2020 update. The June 2020 fix was incomplete and the same splwow64 memcpy primitive was corrected only in January 2021 as CVE-2021-1648.",
+    "attack_refs": [
+      "T1068",
+      "T1559"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SC-39": "SC-39 requires the system to maintain a separate execution domain for each process, the boundary a low-integrity browser renderer must not cross. This flaw lets a low-integrity process send a crafted local procedure call that makes the medium-integrity splwow64.exe print host dereference an attacker-controlled pointer and write to its memory, so the integrity boundary SC-39 depends on is bypassed and privilege is escalated out of the sandbox.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Article 21(2)(e) requires essential and important entities to handle vulnerabilities, and for entities within Commission Implementing Regulation (EU) 2024/2690 Annex point 6.6.1 requires patches within a reasonable time after they become available, with additional measures and residual risk accepted where a patch is not available or is not applied under a documented 6.6.2 derogation. Microsoft's June 2020 update for this flaw was incomplete: the same splwow64 memcpy primitive remained reachable and was corrected only in January 2021 as CVE-2021-1648. An entity that recorded the item remediated on the June update had applied a patch that did not remove the flaw, so its residual risk went unaccounted for until the January 2021 update, and Windows 10 1709 and 1903 received no corrected fix at all.",
+      "UK-CAF-B4": "CAF Principle B4 is outcome-based and asks that exposed vulnerabilities are mitigated promptly. This privilege-escalation flaw was public through the Zero Day Initiative advisory on 2020-05-19 before a fix existed, and the June 2020 update was itself incomplete, so a B4 review that treated the June patch as remediation missed that the untrusted-pointer write survived until the January 2021 CVE-2021-1648 update, which never shipped for Windows 10 1709 or 1903.",
+      "AU-Essential-8-Patch": "The Essential Eight patches operating systems within timeframes the ISM sets by asset class. For a Windows 10 workstation or a non-internet-facing Windows Server host the window is one month at Maturity Levels One and Two (ISM-1695) and 48 hours at Maturity Level Three when the vendor rates the flaw critical or a working exploit exists (ISM-1696); for the operating system of an internet-facing Windows Server it is 48 hours under that same condition (ISM-1877) and two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1694). This flaw was exploited as a zero-day before the June 2020 update, so no window ran during the pre-release period, and the June update was incomplete: applying it inside any window still left the splwow64 memcpy primitive reachable until the January 2021 CVE-2021-1648 update, which never shipped for Windows 10 1709 or 1903.",
+      "ISO-27001-2022-A.8.8": "Annex A.8.8 requires an entity to evaluate its exposure to technical vulnerabilities and take appropriate, timely measures. For this flaw the June 2020 update was such a measure, but it did not remove the vulnerability: the splwow64 memcpy primitive remained and was corrected only in January 2021 as CVE-2021-1648. An A.8.8 program that closed the item on the June update recorded remediation for a flaw that stayed reachable, and because no corrected update shipped for Windows 10 1709 or 1903, evaluating exposure there meant tracking an unpatched primitive rather than a closed control."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free path exists for this operating-system flaw. Remediation is the June 2020 update, which requires a reboot, and because that fix was incomplete, full remediation needs the January 2021 update, CVE-2021-1648, which corrects the same splwow64 memcpy primitive; Windows 10 1709 and 1903, and Windows Server, version 1803 and 1903 (Server Core installation), received no corrected update and must be upgraded to a serviced release. No source documents a live-patch capability.",
+    "affected": "The Windows kernel handling of objects in memory as exposed through the GDI print and print-spooler path in splwow64.exe. A low-integrity local process, such as a sandboxed browser renderer, gains an arbitrary write in the medium-integrity print host and escalates privilege. Affected releases are Windows 8.1, Windows RT 8.1, Windows Server 2012 and 2012 R2, and Windows 10 and its server editions from 1507 and 1607 through 2004.",
+    "affected_versions": [
+      "Windows 8.1, Windows RT 8.1, Windows Server 2012 and 2012 R2, and Windows 10 and Windows Server editions from 1507 and 1607 through 2004, without the June 2020 update (fixed for example by KB4561649 for Windows 10 1507, KB4561608 for 1809 and Server 2019, KB4560960 for 1903 and 1909, KB4561616 for 1607 and Server 2016, KB4557957 for 2004, KB4561666 for Windows 8.1, Windows RT 8.1 and Server 2012 R2); the update requires a reboot",
+      "The June 2020 fix is incomplete; the same splwow64 memcpy primitive is corrected only by the January 2021 update, CVE-2021-1648 (for example KB4598230 for 1809 and Server 2019, KB4598229 for 1909, KB4598243 for 1607 and Server 2016, KB4598242 for 2004 and 20H2, KB4598231 for Windows 10 1507, KB4598285 for Windows 8.1, Windows RT 8.1 and Server 2012 R2). Windows 10 1709 and 1903, and Windows Server, version 1803 and 1903 (Server Core installation), received no corrected update and must be upgraded"
+    ],
+    "vendor_update_paths": [
+      "Install the June 2020 update for the running release (for example KB4561649 for Windows 10 1507, KB4561608 for Windows 10 1809 and Server 2019, KB4560960 for 1903 and 1909, KB4561616 for 1607 and Server 2016, KB4557957 for 2004, KB4561666 for Windows 8.1, Windows RT 8.1 and Server 2012 R2); the update requires a reboot. See the Microsoft Security Update Guide entry for the full per-release build list.",
+      "Because the June fix is incomplete, apply the January 2021 update that corrects the same primitive, CVE-2021-1648 (for example KB4598230 for Windows 10 1809 and Windows Server 2019, KB4598229 for 1909, KB4598243 for 1607 and Windows Server 2016, KB4598242 for 2004 and 20H2, KB4598231 for Windows 10 1507, KB4598285 for Windows 8.1, Windows RT 8.1 and Windows Server 2012 R2); Windows 10 1709 and 1903, and Windows Server, version 1803 and 1903 (Server Core installation), received no corrected update and must be upgraded to a serviced release.",
+      "The observed attack chained this flaw after the Internet Explorer remote code execution flaw CVE-2020-1380; the August 2020 cumulative update fixes CVE-2020-1380 (for example KB4565349 for Internet Explorer 11 on Windows 10 1809 and Windows Server 2019), and closing the observed chain needs that update together with the January 2021 CVE-2021-1648 fix."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 61,
+    "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2020-6819": {
+    "name": "Mozilla Firefox And Thunderbird Use-After-Free Vulnerability (CVE-2020-6819)",
+    "cvss_score": 8.1,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-362",
+      "CWE-416"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "high",
+    "vector": "Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.",
+    "epss_score": 0.03039,
+    "epss_percentile": 0.86948,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-6819",
+    "vendor_advisories": [
+      {
+        "vendor": "Mozilla",
+        "advisory_id": "https://www.mozilla.org/security/advisories/mfsa2020-11/",
+        "url": "https://www.mozilla.org/security/advisories/mfsa2020-11/",
+        "severity": "critical",
+        "published_date": "2020-04-03"
+      },
+      {
+        "vendor": "Mozilla",
+        "advisory_id": "https://www.mozilla.org/security/advisories/mfsa2020-14/",
+        "url": "https://www.mozilla.org/security/advisories/mfsa2020-14/",
+        "severity": "critical",
+        "published_date": "2020-04-09"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-6819",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.mozilla.org/security/advisories/mfsa2020-11/",
+      "https://www.mozilla.org/security/advisories/mfsa2020-14/"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.",
+    "type": "use-after-free-browser-rce",
+    "blast_radius": 26,
+    "poc_available": false,
+    "poc_description": "No working exploit code was found at Exploit-DB, in the Metasploit framework, in the ProjectDiscovery nuclei-templates set, or in a public GitHub repository for this identifier. The Mozilla bug carries an AddressSanitizer crash log but no exploit sample.",
+    "iocs": {
+      "behavioral": [
+        "A Firefox or Thunderbird content process crashing as a document shell is torn down on an affected build.",
+        "A content-process crash report whose crashing frame is nsDocShell::SynchronizeLayoutHistoryState, with the nsDocShell destructor further down the stack, as in the reporter's crash log. This is a heuristic for failed or unstable exploitation attempts; a successful exploit may leave no crash."
+      ],
+      "network": [
+        "Outbound connections from an endpoint to a page that serves the exploit; the race-condition trigger carries no distinctive request signature.",
+        "Repeated navigations to a single site preceding content-process crashes, consistent with attempts to win the race."
+      ],
+      "host": [
+        "Firefox below 74.0.1, Firefox ESR below 68.6.1, or Thunderbird below 68.7.0 present on the endpoint."
+      ],
+      "_ioc_source_note": "The version boundary and the reporters come from Mozilla's advisories at https://www.mozilla.org/security/advisories/mfsa2020-11/ and https://www.mozilla.org/security/advisories/mfsa2020-14/. The crash location, nsDocShell::SynchronizeLayoutHistoryState with the nsDocShell destructor further down the stack, and the confirmation of targeted attacks in the wild come from the Mozilla bug at https://bugzilla.mozilla.org/show_bug.cgi?id=1620818, whose reporter captured the crash with an AddressSanitizer build, so the crash-report items match on the crashing frame rather than on AddressSanitizer's heap-use-after-free label. Google Project Zero notes at https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2020/CVE-2020-6820.html that Firefox crash logs could show failed exploitation attempts; the crash-report items are hunting heuristics for failed or unstable attempts, and a successful exploit may leave no crash. No public exploit was reachable at Exploit-DB, in Metasploit, in the ProjectDiscovery nuclei-templates set, or in a GitHub repository for this identifier. The navigation-pattern and generic outbound items are general hunting heuristics. No actor infrastructure, file hash or command-and-control address is listed, because no reachable source attributes this flaw to a named campaign."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Predates AI-assisted vulnerability discovery becoming operational. Mozilla credits Francisco Alonso (@revskills) working with Javier Marcos of @JMPSec; no source claims AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2020-6819 (CWE-362, CWE-416, CVSS 8.1) + CISA KEV (added 2021-11-03) + Mozilla advisory MFSA 2020-11 and MFSA 2020-14, which credit Francisco Alonso working with Javier Marcos of JMPSec.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to KEV on 2021-11-03 with a due date of 2022-05-03 and records known ransomware use as Unknown; the KEV listing is CISA's evidence of in-the-wild use. Mozilla shipped the fix on April 3, 2020 for Firefox and April 9, 2020 for Thunderbird, and stated in its advisory that it was aware of targeted attacks in the wild abusing this flaw. Google Project Zero records that it was used in a chain with CVE-2020-6820, with this flaw as the renderer exploit and CVE-2020-6820 as the sandbox escape; both are fixed in the same Firefox 74.0.1, ESR 68.6.1 and Thunderbird 68.7.0 builds, so those builds close the chain. The reporter, quoted in the Mozilla bug, says the crash came from a website belonging to a threat actor network known to the reporter's team that runs campaigns against specific profiles, and describes a second-stage privilege escalation found after it. No named campaign or actor is public in the sources reviewed. The KEV entry is not flagged for forensic triage.",
+    "attack_refs": [
+      "T1203",
+      "T1189"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires system flaws to be corrected and security-relevant updates to be installed within an organization-defined period of the updates' release. The reporter filed this nsDocShell use-after-free on March 8, 2020 after a crash at a website belonging to a threat actor network, and Mozilla released Firefox 74.0.1 and ESR 68.6.1 on April 3, 2020, so for about four weeks the flaw had been seen in targeted attacks with no update to install, a period that SI-2's installation clock, which starts at release, does not cover.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and, for entities in scope of Regulation (EU) 2024/2690, applying security patches within a reasonable time after they become available. The directive names no hours-scale window for an actively exploited client-side use-after-free, so a race-condition zero-day in Firefox and Thunderbird can sit within a reasonable-time reading while it is being used against the entity.",
+      "UK-CAF-B4": "CAF B4.d expects announced vulnerabilities to be tracked and mitigated, for example by patching, promptly, and does not define promptly. This renderer flaw was reported on March 8, 2020 from a crash at a threat-actor site and fixed on April 3, 2020 in Firefox and on April 9, 2020 in Thunderbird 68.7.0, and the outcome does not tell an operator whether a routine update cycle after those dates is prompt enough for a browser and mail-client flaw already used in targeted attacks.",
+      "AU-Essential-8-Patch": "Essential Eight patch application covers web browsers and email clients, which Firefox and Thunderbird are: two weeks from release at Maturity Levels One and Two (ISM-1691), and at Maturity Level Three 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1692), or two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1901). Mozilla rated this flaw critical and it was used in targeted attacks, so ISM-1692 applied from the April 3, 2020 Firefox 74.0.1 and ESR 68.6.1 release and from April 9, 2020 for Thunderbird 68.7.0. The windows start only at those releases, so the roughly four weeks between the March 8, 2020 report from a threat-actor site and the first fix fell outside all of them at every maturity level.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires the organization to evaluate its exposure to each technical vulnerability and take appropriate measures, and leaves the timescale to that evaluation. NVD scores this flaw 8.1 with high attack complexity because the use-after-free depends on a race in the nsDocShell destructor, while Mozilla rated it critical, reported targeted attacks, and Project Zero records it as the renderer stage of a chain with CVE-2020-6820; an evaluation that takes its timescale from the CVSS band places it below the critical tier."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for a browser or mail client of this shape; the fix is the updated build, which takes effect only after the application is restarted, not after a host reboot.",
+    "affected": "Mozilla Firefox, Firefox ESR and Thunderbird. A race condition in the nsDocShell destructor causes a use-after-free while a document shell is torn down, reachable through web content in a browser or browser-like context.",
+    "affected_versions": [
+      "Firefox < 74.0.1 (74.0.1 is fixed)",
+      "Firefox ESR < 68.6.1 (68.6.1 is fixed)",
+      "Thunderbird < 68.7.0 (68.7.0 is fixed)"
+    ],
+    "vendor_update_paths": [
+      "Update Firefox to 74.0.1 or Firefox ESR to 68.6.1, and Thunderbird to 68.7.0, per Mozilla advisory MFSA 2020-11 and MFSA 2020-14; the application must be restarted for the fix to take effect.",
+      "On endpoints that cannot update immediately, keep untrusted web content away from the affected builds, since the flaw is reached through rendered content."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 56,
+    "rwep_notes": "RWEP 56. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2020-6820": {
+    "name": "Mozilla Firefox And Thunderbird Use-After-Free Vulnerability (CVE-2020-6820)",
+    "cvss_score": 8.1,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-362"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "high",
+    "vector": "Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.",
+    "epss_score": 0.07063,
+    "epss_percentile": 0.93925,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-6820",
+    "vendor_advisories": [
+      {
+        "vendor": "Mozilla",
+        "advisory_id": "https://www.mozilla.org/security/advisories/mfsa2020-11/",
+        "url": "https://www.mozilla.org/security/advisories/mfsa2020-11/",
+        "severity": "critical",
+        "published_date": "2020-04-03"
+      },
+      {
+        "vendor": "Mozilla",
+        "advisory_id": "https://www.mozilla.org/security/advisories/mfsa2020-14/",
+        "url": "https://www.mozilla.org/security/advisories/mfsa2020-14/",
+        "severity": "critical",
+        "published_date": "2020-04-09"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-6820",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.mozilla.org/security/advisories/mfsa2020-11/",
+      "https://www.mozilla.org/security/advisories/mfsa2020-14/"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.",
+    "type": "use-after-free-sandbox-escape",
+    "blast_radius": 26,
+    "poc_available": false,
+    "poc_description": "No working exploit code was found at Exploit-DB, in the Metasploit framework, in the ProjectDiscovery nuclei-templates set, or in a public GitHub repository for this identifier. The Mozilla bug carries an AddressSanitizer crash log but no exploit sample.",
+    "iocs": {
+      "behavioral": [
+        "A Firefox or Thunderbird parent (browser) process crashing on its IPDL Background thread while the Cache API handles a stream, on an affected build.",
+        "A parent-process crash report on the IPDL Background thread whose crashing frame is in the DOM Cache IPC code, such as mozilla::dom::cache::PCacheStreamControlParent::SendCloseAll, as in the reporter's crash log. This is a heuristic for failed or unstable exploitation attempts; a successful sandbox escape may leave no crash."
+      ],
+      "network": [
+        "Outbound connections from an endpoint to a page that serves the exploit chain; the race-condition trigger carries no distinctive request signature."
+      ],
+      "host": [
+        "Firefox below 74.0.1, Firefox ESR below 68.6.1, or Thunderbird below 68.7.0 present on the endpoint."
+      ],
+      "_ioc_source_note": "The version boundary and the ReadableStream description come from Mozilla's advisories at https://www.mozilla.org/security/advisories/mfsa2020-11/ and https://www.mozilla.org/security/advisories/mfsa2020-14/. The IPDL Background thread and the PCacheStreamControlParent::SendCloseAll frame come from the AddressSanitizer log in the Mozilla bug at https://bugzilla.mozilla.org/show_bug.cgi?id=1626728, so the crash-report items match on that frame rather than on AddressSanitizer's heap-use-after-free label. The parent-process location of the freed object and the chain with CVE-2020-6819 come from Google Project Zero at https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2020/CVE-2020-6820.html, which notes that Firefox crash logs could show failed exploitation attempts; the crash-report items are hunting heuristics for failed or unstable attempts, and a successful sandbox escape may leave no crash. No public exploit was reachable at Exploit-DB, in Metasploit, in the ProjectDiscovery nuclei-templates set, or in a GitHub repository for this identifier. The generic outbound item is a general hunting heuristic. No actor infrastructure, file hash or command-and-control address is listed, because no reachable source attributes this flaw to a named campaign."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Predates AI-assisted vulnerability discovery becoming operational. Mozilla credits Francisco Alonso (@revskills) working with Javier Marcos of @JMPSec; no source claims AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2020-6820 (CWE-362, CVSS 8.1) + CISA KEV (added 2021-11-03) + Mozilla advisory MFSA 2020-11 and MFSA 2020-14, which credit Francisco Alonso working with Javier Marcos of JMPSec.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to KEV on 2021-11-03 with a due date of 2022-05-03 and records known ransomware use as Unknown; the KEV listing is CISA's evidence of in-the-wild use. Mozilla shipped the fix on April 3, 2020 for Firefox and April 9, 2020 for Thunderbird, and stated in its advisory that it was aware of targeted attacks in the wild abusing this flaw. Google Project Zero records that this flaw was used in a chain with CVE-2020-6819, with CVE-2020-6819 as the renderer exploit and this flaw as the sandbox escape, and that both were found by visiting a URL known to be affiliated with a threat actor; both are fixed in the same Firefox 74.0.1, ESR 68.6.1 and Thunderbird 68.7.0 builds, so those builds close the chain. In the Mozilla bug the reporter confirms seeing this crash in the wild. No named campaign or actor is public in the sources reviewed. The KEV entry is not flagged for forensic triage.",
+    "attack_refs": [
+      "T1203",
+      "T1189"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires system flaws to be corrected and security-relevant updates to be installed within an organization-defined period of their release. Mozilla fixed this sandbox escape two days after the reporter filed it on April 1, 2020, but the reporter had already seen it in the wild, and Project Zero records that it was found together with CVE-2020-6819 at a URL affiliated with a threat actor, so the chain was in use before either fix; SI-2's installation period starts at the April 3, 2020 release of Firefox 74.0.1 and ESR 68.6.1 and does not cover that earlier use.",
+      "NIS2-Art21-vulnerability-handling": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe; for entities within the scope of Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available and additional measures, with residual risk accepted, where a patch is not available. Mozilla announced this flaw in MFSA 2020-11 on April 3, 2020, the day it shipped Firefox 74.0.1 and ESR 68.6.1, so for Firefox and Firefox ESR an entity had no period without a patch, although the chain with CVE-2020-6819 was already in use. Thunderbird 68.7.0 did not ship until April 9, 2020, so from April 3 to April 9 the flaw was public with no Thunderbird patch, a period in which point 6.6.1 required additional measures that it does not name. 'Reasonable time' is then the only clock for deploying the fixes, starting April 3 for Firefox 74.0.1 and ESR 68.6.1 and April 9 for Thunderbird 68.7.0.",
+      "UK-CAF-B4": "CAF B4.d expects announced vulnerabilities to be tracked and mitigated, for example by patching, promptly; at Partially achieved it expects externally exposed vulnerabilities to be mitigated promptly and accepts temporary mitigations for an extended period for some that are not externally exposed. This flaw is reached only from code already running in a content process, which can lead an operator to class it as not externally exposed, yet in the documented chain a web page reached it through CVE-2020-6819, and the outcome gives no rule for classifying a sandbox escape that sits one step behind an internet-reachable flaw.",
+      "AU-Essential-8-Patch": "Essential Eight patch application covers web browsers and email clients, which Firefox and Thunderbird are: two weeks from release at Maturity Levels One and Two (ISM-1691), and at Maturity Level Three 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1692), or two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1901). Mozilla rated this sandbox escape critical and reported targeted attacks, so ISM-1692 applied from the April 3, 2020 Firefox 74.0.1 and ESR 68.6.1 release. Because the same builds fix CVE-2020-6819, one update meets the window for the whole chain, but below Maturity Level Three the control allows that exploited chain to stay open for two weeks after release.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires the organization to evaluate its exposure to each technical vulnerability and take appropriate measures. Mozilla's advisory describes this flaw only as a use-after-free caused by a race while handling a ReadableStream, and does not say that the freed CacheStreamControlParent object is in the parent (browser) process or that the flaw served as the sandbox escape for CVE-2020-6819, which Project Zero's analysis records; an exposure evaluation based on the advisory text treats it as a second web-content flaw rather than the step that takes an attacker out of the content sandbox."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path for a browser or mail client of this shape; the fix is the updated build, which takes effect only after the application is restarted, not after a host reboot.",
+    "affected": "Mozilla Firefox, Firefox ESR and Thunderbird. A race condition while a ReadableStream is handled causes a use-after-free; Google Project Zero identifies the freed object as CacheStreamControlParent in the parent (browser) process and records the flaw as the sandbox escape used with CVE-2020-6819, so it is reached from code already running in a compromised content process.",
+    "affected_versions": [
+      "Firefox < 74.0.1 (74.0.1 is fixed)",
+      "Firefox ESR < 68.6.1 (68.6.1 is fixed)",
+      "Thunderbird < 68.7.0 (68.7.0 is fixed)"
+    ],
+    "vendor_update_paths": [
+      "Update Firefox to 74.0.1 or Firefox ESR to 68.6.1, and Thunderbird to 68.7.0, per Mozilla advisory MFSA 2020-11 and MFSA 2020-14; the application must be restarted for the fix to take effect.",
+      "On endpoints that cannot update immediately, keep untrusted web content away from the affected builds, since the flaw is reached through rendered content."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 56,
+    "rwep_notes": "RWEP 56. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2019-15949": {
+    "name": "Nagios XI Remote Code Execution Vulnerability",
+    "cvss_score": 8.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-78"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.",
+    "epss_score": 0.77039,
+    "epss_percentile": 0.99529,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-15949",
+    "vendor_advisories": [
+      {
+        "vendor": "Nagios",
+        "advisory_id": "Nagios XI 5.6.6 changelog (TPS#14364)",
+        "url": "https://www.nagios.com/changelog/nagios-xi/",
+        "severity": "unknown",
+        "published_date": "2019-08-20"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2019-15949",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root.",
+    "type": "authenticated-command-injection-to-root",
+    "blast_radius": 20,
+    "poc_available": true,
+    "poc_description": "A public exploit is at the named GitHub repository github.com/jakgibb/nagiosxi-root-rce-exploit, the reporter's original PHP proof of concept, and there is a Metasploit module modules/exploits/linux/http/nagios_xi_plugins_check_plugin_authenticated_rce.rb, titled Nagios XI Prior to 5.6.6 getprofile.sh Authenticated Remote Command Execution. From the reporter's repository the README was read and exploit.php was searched only for its upload filename; from the module only its description, options and request paths were read, not payload code.",
+    "iocs": {
+      "behavioral": [
+        "A root shell or root command spawned from the Nagios XI web stack, such as php-fpm or the web server, on an affected version.",
+        "getprofile.sh running as root and executing a check_ping plugin, or another plugin it runs, that was replaced outside a legitimate plugin deployment.",
+        "The nagios account or a web plugin upload writing to check_ping or to another plugin file that getprofile.sh executes."
+      ],
+      "network": [
+        "An authenticated POST to a path ending in /admin/monitoringplugins.php that uploads a plugin file, which the Metasploit module names check_ping, followed by a GET to a path ending in /includes/components/profile/profile.php with cmd=download, which triggers the root execution. Match on the path suffix because the base path defaults to /nagiosxi but is configurable.",
+        "A later GET to the monitoring-plugins path with a delete parameter set to the uploaded plugin name and an nsp token, which the Metasploit module issues as cleanup."
+      ],
+      "host": [
+        "Nagios XI below 5.6.6 present on the server.",
+        "A passwordless sudo entry that runs getprofile.sh as root.",
+        "A check_ping plugin, or another plugin that getprofile.sh executes, whose modification time or contents changed without a corresponding legitimate plugin deployment."
+      ],
+      "_ioc_source_note": "The request paths, the check_ping plugin name, the profile.php cmd=download trigger, the nsp token and the cleanup request come from the Metasploit module at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/nagios_xi_plugins_check_plugin_authenticated_rce.rb, of which only the description, options and request paths were read; its description says it uploads a malicious check_ping plugin, and a search of the reporter's exploit.php at https://raw.githubusercontent.com/jakgibb/nagiosxi-root-rce-exploit/master/exploit.php for its upload field shows the same filename. NVD's description calls the file getprofile.sh executes check_plugin, so the file indicators name check_ping and any other plugin getprofile.sh runs rather than a file literally named check_plugin. The getprofile.sh and passwordless-sudo mechanism, the fixed version 5.6.6 and the requirement for plugin-modification rights or the nagios account come from the README of the reporter's exploit repository at https://github.com/jakgibb/nagiosxi-root-rce-exploit, and the 5.6.6 fix date from the Nagios XI changelog at https://www.nagios.com/changelog/nagios-xi/. The item about a root shell or root command spawned from the Nagios XI web stack, such as php-fpm or the web server, is a general hunting heuristic rather than an artifact read from a source. No actor infrastructure, file hash or command-and-control address is listed, because no reachable source attributes this flaw to a named campaign."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Predates AI-assisted vulnerability discovery becoming operational. The flaw was reported by Jak Gibb, who published the original PHP proof of concept; no source claims AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2019-15949 (CWE-78, CVSS 8.8) + CISA KEV (added 2021-11-03) + Nagios advisory Nagios XI 5.6.6 changelog (TPS#14364), which credits Jak Gibb, with the reporter's exploit repository and the Metasploit module.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to KEV on 2021-11-03 with a due date of 2022-05-03 and records known ransomware use as Unknown; the KEV listing is CISA's evidence of in-the-wild use. A working exploit predates the listing: the reporter's PHP proof of concept was public and a Metasploit module was released, both well before 2021, and the reporter records the fix shipping in Nagios XI 5.6.6 on August 20, 2019. No named campaign or actor is attributed in the sources reviewed. The KEV entry is not flagged for forensic triage.",
+    "attack_refs": [
+      "T1190",
+      "T1059.004",
+      "T1548.003"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-AC-6": "AC-6 requires the organization to employ least privilege, allowing only the access needed for assigned tasks. On Nagios XI before 5.6.6 the getprofile.sh helper runs as root through a passwordless sudo entry and executes a monitoring plugin that the unprivileged nagios account can rewrite (check_ping in both public exploits; NVD calls it check_plugin), so a low-privilege plugin operator gains root; least privilege is defeated by the product's own sudo configuration rather than by the organization's account grants.",
+      "NIS2-Art21-network-security": "NIS2 Article 21(2) requires essential and important entities to take measures that include access control policies (point (i)) and security in the acquisition, development and maintenance of network and information systems, including vulnerability handling (point (e)). An access control policy can grant a Nagios XI user the right to manage monitoring plugins as an application role, but before 5.6.6 the product's own passwordless sudo entry for getprofile.sh runs a plugin file that the nagios account can replace, so that right becomes root on the server, and neither point requires the entity to check how a product's application roles map to operating-system privileges before it grants them.",
+      "UK-CAF-B4": "CAF B4.d expects announced vulnerabilities to be tracked and mitigated, for example by patching, promptly, and at Partially achieved it accepts temporary mitigations for an extended period for some vulnerabilities that are not externally exposed. Removing the passwordless sudo entry for getprofile.sh stops the script from running as root and closes the root path. Restricting plugin-modification rights in the web interface does not: the nagios account can still replace the plugin that getprofile.sh runs as root, yet on an internal Nagios XI server the Partially achieved allowance would accept that measure in place of the 5.6.6 upgrade for an extended period. 'Promptly' is not defined for an authenticated root path with a public exploit and a Metasploit module.",
+      "AU-Essential-8-Patch": "For a Nagios XI instance directly accessible over the internet, Essential Eight patch application treats it as an online service, patched within 48 hours of release at every maturity level when the vendor rates the flaw critical or a working exploit exists (ISM-1876), and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1690). Nagios released 5.6.6 on August 20, 2019 and the reporter's exploit repository was created on August 21, 2019, so from that date the 48-hour window applied, and it closed more than two years before CISA's November 3, 2021 KEV listing, the earliest evidence of exploitation in the sources reviewed; meeting it would have closed the flaw before any documented exploitation. An instance reachable only internally is an other application, patched within one month from Maturity Level Two (ISM-1693), and Maturity Level One gives it no patch timeframe, so an organization at that level can leave an internal server with a public root exploit unpatched and still meet the control.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires information about technical vulnerabilities of systems in use to be obtained, the organization's exposure to be evaluated and appropriate measures to be taken. NVD scores this flaw 8.8 with low privileges required, since it needs a Nagios XI account allowed to modify plugins or the nagios account, and an evaluation that discounts an authenticated flaw can set a longer timescale for the 5.6.6 upgrade, although the reporter's exploit repository, created on August 21, 2019, the day after 5.6.6 was released, gives root to any account allowed to manage plugins."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path is documented; the fix is the Nagios XI 5.6.6 upgrade. Removing the passwordless sudo entry and restricting plugin-modification rights are configuration measures available before the upgrade.",
+    "affected": "Nagios XI before 5.6.6. The getprofile.sh script, run as root through a passwordless sudo entry when a system profile is downloaded, executes a monitoring plugin owned by the nagios user (check_ping in both public exploits; NVD calls it check_plugin). A user with plugin-modification rights in the web interface, or the nagios operating-system account, can replace that plugin so that its commands run as root.",
+    "affected_versions": [
+      "Nagios XI < 5.6.6 (5.6.6 is fixed; on 5.5.0 through 5.6.5 the injected commands run as root, and on 5.2.0 through 5.4.13 they run as the nagios user)"
+    ],
+    "vendor_update_paths": [
+      "Upgrade to Nagios XI 5.6.6 or later, which closes the flaw.",
+      "Restrict who holds plugin-modification rights in the web interface, and remove or narrow the passwordless sudo entry that runs getprofile.sh as root.",
+      "Keep the Nagios XI web interface off untrusted networks so the authenticated attack surface is not internet-reachable."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 70,
+    "rwep_notes": "RWEP 70. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +20, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2020-14882": {
+    "name": "Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2020-14882)",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-22"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
+    "epss_score": 0.99997,
+    "epss_percentile": 0.9999,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-14882",
+    "vendor_advisories": [
+      {
+        "vendor": "Oracle",
+        "advisory_id": "cpuoct2020.html",
+        "url": "https://www.oracle.com/security-alerts/cpuoct2020.html",
+        "severity": "critical",
+        "published_date": "2020-10-20"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-14882",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.oracle.com/security-alerts/cpuoct2020.html"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.",
+    "type": "console-auth-bypass-to-rce",
+    "blast_radius": 22,
+    "poc_available": true,
+    "poc_description": "Public nuclei template http/cves/2020/CVE-2020-14882.yaml in projectdiscovery/nuclei-templates sends a single GET to /console/images/%252e%252e%252fconsole.portal with a handle referencing com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext. The Metasploit module modules/exploits/multi/http/weblogic_admin_handle_rce.rb (Oracle WebLogic Server Administration Console Handle RCE) chains CVE-2020-14882 with CVE-2020-14883 and cites EDB 48971; it credits voidfyoo for discovery and Jang for analysis. Working exploit strings against honeypots are documented by the SANS Internet Storm Center.",
+    "iocs": {
+      "behavioral": [
+        "The WebLogic Java process (weblogic.Server) spawning a shell child (/bin/sh -c on Unix, cmd.exe /c on Windows), which is not part of its normal child set and is how the console command gadget runs an operating system command",
+        "Outbound DNS or HTTP callbacks from the WebLogic host to a scanning service (for example a Burp Collaborator or dnslog domain), which the published scans use to confirm reachability before landing a payload",
+        "Download and execution of a second-stage binary by the WebLogic account shortly after a console.portal request, as a general hunting heuristic for follow-on payload retrieval",
+        "A burst of near-identical console.portal requests to one host from a single internet source, matching the internet-wide scanning that followed publication of the analysis"
+      ],
+      "network": [
+        "A request whose path ends in console.portal reached through an encoded ../ traversal under /console/, in any case and any encoding (for example /console/images/%252e%252e%252fconsole.portal, the uppercase %252E%252E%252F form, /console/css/%252e%252e%252fconsole.portal, /console/css/.%252e/console.portal or /console/..%2Fconsole.portal). Match case-insensitively on an encoded ../ segment before console.portal rather than a fixed prefix, and match any HTTP method: the requests seen in the wild are GET, and the Metasploit module sends a POST with the handle in the request body",
+        "A console.portal request whose handle or test_handle parameter names a Java class the console instantiates, including com.tangosol.coherence.mvel2.sh.ShellSession, com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext or ClassPathXmlApplicationContext, weblogic.work.ExecuteThread, or a bare class such as java.lang.String",
+        "An ADMINCONSOLESESSION response header on a console.portal request together with an out-of-band HTTP or DNS callback from the WebLogic host to the address named in the request, which is the success condition the public nuclei check uses",
+        "The WebLogic administration console answering on its default port 7001 (or 7002 for TLS) from an untrusted or internet-facing source address"
+      ],
+      "host": [
+        "A WebLogic Server whose administration console is reachable over the network and that has not applied both the Oracle October 2020 Critical Patch Update and the later Security Alert CVE-2020-14750 patch (My Oracle Support Note 2724951.1), since the version string alone does not change when either patch is applied",
+        "The administration console left exposed beyond a trusted management network"
+      ],
+      "_ioc_source_note": "The traversal path to console.portal, the handle and FileSystemXmlApplicationContext gadget and the ADMINCONSOLESESSION-plus-callback success condition come from the ProjectDiscovery template at https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2020/CVE-2020-14882.yaml. The GET requests seen in the wild, the uppercase %252E%252E%252F double-encoding, the ShellSession and java.lang.String handles and the saturation scanning come from the SANS Internet Storm Center diary at https://isc.sans.edu/diary/26734. The additional traversal forms (/console/css/ and /console/..%2Fconsole.portal) and the ClassPathXmlApplicationContext and FileSystemXmlApplicationContext handles come from CrowdStrike at https://www.crowdstrike.com/en-us/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/, and the trivial case and encoding bypass of the October 2020 fix comes from Rapid7 at https://www.rapid7.com/blog/post/ra-cve-2020-14882-unauthenticated-rce-in-console-component-of-oracle-weblogic-server-analysis/. The POST method and the /console/css/.%252e/console.portal form were read from the Metasploit module weblogic_admin_handle_rce.rb at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/weblogic_admin_handle_rce.rb, for detection artifacts only. The affected versions and console component come from Oracle's October 2020 Critical Patch Update at https://www.oracle.com/security-alerts/cpuoct2020.html. The shell-child, outbound-callback, download-and-execute and single-source request-burst entries are general hunting heuristics rather than artifacts read from one source. CrowdStrike names the eCrime actor PROPHET SPIDER as an operator of this flaw and publishes, in the Indicators of Compromise table of the same blog, four SHA256 hashes for that actor's GOTROJ backdoor and two for its JSP webshell, and it describes host artifacts from PROPHET SPIDER intrusions such as tools stored in C:\\Windows\\Temp\\7fde\\ and a reverse shell binary in /var/tmp/. Operators should take those indicators from the blog; they are not reproduced here. The example requests in the blog use placeholder callback addresses, so no fixed C2 address is listed."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Oracle's October 2020 Critical Patch Update credits voidfyoo of Chaitin Security Research Lab with reporting CVE-2020-14882 and CVE-2020-14883, and the Metasploit module credits voidfyoo for discovery and Jang for the analysis and proof of concept. No source claims AI tooling was involved.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2020-14882 (NVD-CWE-Other, CVSS 9.8) + CISA KEV (added 2021-11-03) + Oracle Critical Patch Update Advisory cpuoct2020, which credits voidfyoo of Chaitin Security Research Lab.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2020-14882 to the KEV catalog on 2021-11-03 with a 2022-05-03 due date and records known ransomware campaign use as Unknown. The SANS Internet Storm Center reported active exploitation against its honeypots on 2020-10-29, about nine days after Oracle's 2020-10-20 Critical Patch Update and once proof-of-concept exploits were published, and noted that scanning had saturated all IPv4 space and that any vulnerable server found should be assumed compromised. CrowdStrike attributes exploitation of CVE-2020-14882 and CVE-2020-14750 to the eCrime actor PROPHET SPIDER, which it assesses most likely acted as an access broker. CrowdStrike reports two cases in which PROPHET SPIDER access was followed by Egregor and MountLocker ransomware deployment, likely by separate groups; the Egregor case began with a breach of an Apache web server, CrowdStrike names no initial access for the MountLocker case, and it does not link either case to these WebLogic flaws. Rapid7 reports that at least two botnets incorporated exploits for CVE-2020-14882, citing Juniper Threat Labs and Tolisec.",
+    "attack_refs": [
+      "T1190",
+      "T1059",
+      "T1105"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-AC-3": "AC-3 enforces approved authorizations by mediating access to protected operations, but the double-encoded traversal to console.portal reaches an administrative handler behind the console's authentication filter without an authorization decision, so the enforcement point the control relies on is never invoked for the request that takes over the server.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Article 21(2)(e) requires vulnerability handling and disclosure but sets no timeframe, and for entities in scope of Commission Implementing Regulation (EU) 2024/2690 point 6.6.1 requires security patches to be applied within a reasonable time after they become available, with additional measures where none exists. Here the fix shipped in Oracle's 2020-10-20 update, public exploitation began on 2020-10-29, and that October fix was itself bypassed until the 2020-11-01 Security Alert, so an operator meeting a reasonable time from the first patch could still have been taken over before the effective fix existed.",
+      "UK-CAF-B2": "CAF principle B2 restricts access to authorized users and systems, yet an unauthenticated request that traverses to console.portal exercises administrative function without any account, so a B2 assessment of user accounts and privileges finds nothing to review while the takeover path stays open to anyone who can route to port 7001.",
+      "ISO-27001-2022-A.5.15": "A.5.15 frames access control as an organizational policy enforced through identity and role, but the console's own request-routing accepts a traversal that bypasses its authentication layer, so a single defect in the vendor's URI matching collapses the role model without triggering any A.5.15 policy evidence.",
+      "AU-ISM-1546": "ISM-1546 requires users to be authenticated before they are granted access to a system and its resources, and is met by configuring authentication in front of the console; it does not reach a flaw in the vendor's own handling that lets an unauthenticated request traverse to console.portal, so a deployment that satisfies the control on paper still admits the unauthenticated request that compromises the server.",
+      "AU-Essential-8-Patch": "ISM-1876 patches an online service within 48 hours of release when the vendor rates the flaw critical or a working exploit exists, and ISM-1690 within two weeks when the vendor rates it non-critical and no working exploit exists; an internet-facing WebLogic administration console is an online service, and an instance reachable only internally is an other application patched within one month from Maturity Level Two (ISM-1693) with no timeframe at Maturity Level One. Oracle rated this flaw critical (CVSS 9.8) and the October 2020 Critical Patch Update shipped on 2020-10-20, so the 48-hour window ran from that release, but applying that update inside the window still left the console exposed because the fix was bypassed until the 2020-11-01 Security Alert for CVE-2020-14750, whose own 48-hour window is the one that closes the flaw."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free live patch exists for this defect. Remediation is the October 2020 Critical Patch Update followed by the 2020-11-01 Security Alert for CVE-2020-14750 (My Oracle Support Note 2724951.1), which is the patch that closes the traversal after the October fix was bypassed; applying it requires restarting the WebLogic server for the patched classes to load, but not a reboot of the host operating system.",
+    "affected": "Oracle WebLogic Server (Fusion Middleware, Console component). An unauthenticated attacker with HTTP access to the administration console reaches remote code execution with the privileges of the WebLogic process, taking over the server.",
+    "affected_versions": [
+      "Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 (Console); the October 2020 Critical Patch Update fix for this flaw was bypassed, so the 2020-11-01 Security Alert for CVE-2020-14750 (My Oracle Support Note 2724951.1) is the build that closes the traversal (apply the patch and restart the server)",
+      "Other WebLogic Server releases outside Oracle Premier Support or Extended Support are not tested by Oracle and receive no patch; the October 2020 Critical Patch Update states that earlier versions of affected releases are likely also affected and recommends upgrading to a supported version"
+    ],
+    "vendor_update_paths": [
+      "Apply the Oracle October 2020 Critical Patch Update and then the 2020-11-01 Security Alert for CVE-2020-14750 (My Oracle Support Note 2724951.1) to WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 or 14.1.1.0.0 and restart the server; the Security Alert is the build that closes the traversal, because the October update for this flaw was bypassed.",
+      "On a WebLogic Server release outside Premier Support or Extended Support, for which Oracle releases no patch, upgrade to a supported release, then apply the October 2020 Critical Patch Update and the 2020-11-01 Security Alert patch for CVE-2020-14750 (or a later patch that includes them) and restart the server.",
+      "Restrict the administration console to a trusted management network so that reaching console.portal requires more than routing to port 7001."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 72,
+    "rwep_notes": "RWEP 72. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +22, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2020-14883": {
+    "name": "Oracle WebLogic Server Unspecified Vulnerability",
+    "cvss_score": 7.2,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-470"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
+    "epss_score": 0.97929,
+    "epss_percentile": 0.99907,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-14883",
+    "vendor_advisories": [
+      {
+        "vendor": "Oracle",
+        "advisory_id": "cpuoct2020.html",
+        "url": "https://www.oracle.com/security-alerts/cpuoct2020.html",
+        "severity": "high",
+        "published_date": "2020-10-20"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-14883",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.oracle.com/security-alerts/cpuoct2020.html"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.",
+    "type": "console-unsafe-class-instantiation-rce",
+    "blast_radius": 18,
+    "poc_available": true,
+    "poc_description": "Public nuclei template http/cves/2020/CVE-2020-14883.yaml in projectdiscovery/nuclei-templates sends a POST to /console/images/%252e%252e%252fconsole.portal whose test_handle parameter invokes com.tangosol.coherence.mvel2.sh.ShellSession against weblogic.work.ExecuteThread and matches on a reflected marker with status 200. The Metasploit module modules/exploits/multi/http/weblogic_admin_handle_rce.rb chains this class-instantiation flaw with the CVE-2020-14882 authentication bypass so the pair runs unauthenticated, crediting voidfyoo for discovery and Jang for analysis.",
+    "iocs": {
+      "behavioral": [
+        "The WebLogic Java process spawning a shell child (/bin/sh -c on Unix, cmd.exe /c on Windows) through the console command gadget, which is outside its normal child set",
+        "A console.portal request reflecting a short random string back in the response body, which the public check uses to confirm command execution before landing a payload",
+        "Outbound callbacks from the WebLogic host to a scanning or staging service immediately after a console.portal request"
+      ],
+      "network": [
+        "A console.portal request of either method (GET with the handle in the query string, as seen in the wild, or POST with it in the body, as in the public check) whose handle or test_handle value names a Java class such as com.tangosol.coherence.mvel2.sh.ShellSession, weblogic.work.ExecuteThread, com.bea.core.repackaged.springframework.context.support.ClassPathXmlApplicationContext or FileSystemXmlApplicationContext. Match the traversal to console.portal case- and encoding-insensitively rather than on a fixed prefix",
+        "A console.portal request whose handle gadget reads a request header and executes it, so a request carrying an unexpected header whose value is echoed or executed is a strong signal; the gadget may call java.lang.Runtime.exec directly rather than through weblogic.work.ExecuteThread",
+        "A 200 response to a console.portal request whose body contains a value the request asked the gadget to reverse or echo, together with an ADMINCONSOLESESSION cookie, or a 302 redirect to /console/console.portal?_pageLabel=UnexpectedExceptionPage, which the Metasploit module treats as a successful traversal",
+        "The administration console answering on its default port 7001 (or 7002 for TLS) from an untrusted source"
+      ],
+      "host": [
+        "A WebLogic Server of any release, including releases outside Oracle Premier Support or Extended Support that Oracle does not patch, whose administration console is reachable over the network and that has not applied both the October 2020 Critical Patch Update and the 2020-11-01 Security Alert patch for CVE-2020-14750 (My Oracle Support Note 2724951.1); the version string alone does not change when either patch is applied, so it does not show whether a server is fixed",
+        "The administration console reachable beyond a trusted management network, where the paired authentication bypass turns this high-privilege flaw into an unauthenticated takeover"
+      ],
+      "_ioc_source_note": "The POST form of the request, the test_handle ShellSession expression and the reversed-marker success match come from the ProjectDiscovery template at https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2020/CVE-2020-14883.yaml. The GET requests seen in the wild, the ShellSession-with-Runtime.exec form and the ClassPathXmlApplicationContext and FileSystemXmlApplicationContext handles come from the SANS Internet Storm Center diary at https://isc.sans.edu/diary/26734 and CrowdStrike at https://www.crowdstrike.com/en-us/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/. That the flaw is unsafe instantiation of an attacker-named Java class through the console handle is described by the Rapid7 module listing at https://www.rapid7.com/db/modules/exploit/multi/http/weblogic_admin_handle_rce/. The 302 redirect to /console/console.portal?_pageLabel=UnexpectedExceptionPage and the Runtime.exec gadget carrying a Base64-encoded command were read from the Metasploit module source at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/weblogic_admin_handle_rce.rb, for detection artifacts only. The affected versions, the console component and the statement that releases outside Premier or Extended Support are likely also affected and receive no patch come from Oracle's October 2020 Critical Patch Update at https://www.oracle.com/security-alerts/cpuoct2020.html. The shell-child, reflected-marker and outbound-callback entries are general hunting heuristics rather than artifacts read from one source. No source consulted attributes this CVE on its own to a single named campaign, and CrowdStrike's PROPHET SPIDER reporting covers the chain with CVE-2020-14882 and CVE-2020-14750, so no actor file hash or fixed C2 address is listed here."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Oracle's October 2020 Critical Patch Update credits voidfyoo of Chaitin Security Research Lab with reporting CVE-2020-14882 and CVE-2020-14883, and the Metasploit module that chains the two credits voidfyoo for discovery and Jang for analysis. No source claims AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2020-14883 (NVD-CWE-Other, CVSS 7.2) + CISA KEV (added 2021-11-03) + Oracle Critical Patch Update Advisory cpuoct2020, which credits voidfyoo of Chaitin Security Research Lab.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2020-14883 to the KEV catalog on 2021-11-03 with a 2022-05-03 due date and records known ransomware campaign use as Unknown. Oracle rates the flaw as needing high privileges on its own, but the public exploitation observed in the wild chained it with the CVE-2020-14882 authentication bypass so the pair executes code without credentials; the SANS Internet Storm Center reported that scanning of WebLogic consoles saturated all IPv4 space within days of Oracle's October 2020 update. Oracle's own update lists the console component and the affected versions.",
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-CM-7": "CM-7 least functionality restricts the services and functions a system exposes, but the WebLogic administration console is enabled and network-reachable by default and the command gadget lives inside it, so a CM-7 baseline that leaves the console listening on port 7001 preserves exactly the function that runs operating system commands.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and disclosure and sets no timeframe; for entities within the scope of Commission Implementing Regulation (EU) 2024/2690, point 6.6.1 requires security patches to be applied within a reasonable time after they become available, and requires additional measures, with residual risk accepted, where a patch is not available. Oracle's patch for this flaw was available on 2020-10-20 and the SANS Internet Storm Center reported exploitation of the console chain on 2020-10-29, so a reasonable time, which point 6.6.1 does not define, would have had to be shorter than those nine days to prevent compromise. An entity that applied the October update inside that time was still exposed to unauthenticated code execution through the console until the 2020-11-01 Security Alert for CVE-2020-14750, because the October fix for the paired traversal was bypassed.",
+      "UK-CAF-C1": "CAF principle C1 requires the organization to monitor the security status of the systems supporting an essential function to detect security events, and C1.a asks that the data sources in its logging and monitoring allow timely identification of events that could adversely affect those systems, with separate log datasets synchronized so they can be correlated. Met in full, that outcome lets an operator see this attack even where, as CrowdStrike reports, the command or XML file does not appear in the GET request and the trace is a traversal to console.portal in the access log that lines up with a WebLogic console log error naming com.tangosol.coherence.mvel2.sh.ShellSession. C1 falls short because it is a detection outcome: the single console.portal request has already run the command when those correlated entries are seen, so C1 limits how long a takeover of the WebLogic server goes unnoticed and does not prevent it.",
+      "ISO-27001-2022-A.8.21": "A.8.21 security of network services anchors on segmentation and secure protocols between zones, but the administration console speaks ordinary HTTP and is frequently placed where any internal or internet source can reach it, so the network-service controls A.8.21 documents do not confine the console command path this CVE exercises.",
+      "AU-Essential-8-Patch": "ISM-1876 patches an online service within 48 hours of release when the vendor rates the flaw critical or a working exploit exists, and ISM-1690 within two weeks when the vendor rates it non-critical and no working exploit exists; an internet-facing WebLogic administration console is an online service, and an instance reachable only internally is an other application patched within one month from Maturity Level Two (ISM-1693) with no timeframe at Maturity Level One. Oracle rated this flaw non-critical (CVSS 7.2, high privileges) and published no exploit with the 2020-10-20 update, so the two-week ISM-1690 window applied from release and ran to about 2020-11-03, but public exploitation of the chain began on 2020-10-29 inside that window and the paired traversal half stayed open until the 2020-11-01 Security Alert for CVE-2020-14750."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free live patch exists for this defect. Remediation is the October 2020 Critical Patch Update, and the 2020-11-01 Security Alert for CVE-2020-14750 (My Oracle Support Note 2724951.1) closes the unauthenticated chain; both require restarting the WebLogic server for the patched classes to load, not a host reboot.",
+    "affected": "Oracle WebLogic Server (Fusion Middleware, Console component). An attacker who can reach the administration console executes code on the server; chained with the CVE-2020-14882 authentication bypass the command path runs without credentials.",
+    "affected_versions": [
+      "Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 (Console); addressed by the October 2020 Critical Patch Update, with the unauthenticated chain through CVE-2020-14882 closed only by the 2020-11-01 Security Alert for CVE-2020-14750 (My Oracle Support Note 2724951.1) (apply the patches and restart the server)",
+      "Other WebLogic Server releases outside Oracle Premier Support or Extended Support are not tested by Oracle and receive no patch; the October 2020 Critical Patch Update states that earlier versions of affected releases are likely also affected and recommends upgrading to a supported version"
+    ],
+    "vendor_update_paths": [
+      "Apply the Oracle October 2020 Critical Patch Update and the 2020-11-01 Security Alert for CVE-2020-14750 (My Oracle Support Note 2724951.1) to WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 or 14.1.1.0.0 and restart the server; the October update addresses this flaw, and the Security Alert closes the unauthenticated chain with CVE-2020-14882 after the October fix for that traversal was bypassed.",
+      "On a WebLogic Server release outside Premier Support or Extended Support, for which Oracle releases no patch, upgrade to a supported release, then apply the October 2020 Critical Patch Update and the 2020-11-01 Security Alert patch for CVE-2020-14750 (or a later patch that includes them) and restart the server.",
+      "Restrict the administration console to a trusted management network so it is not reachable from untrusted sources."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 68,
+    "rwep_notes": "RWEP 68. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +18, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2020-14750": {
+    "name": "Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2020-14750)",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-22"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
+    "epss_score": 0.9927,
+    "epss_percentile": 0.99936,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-14750",
+    "vendor_advisories": [
+      {
+        "vendor": "Oracle",
+        "advisory_id": "alert-cve-2020-14750.html",
+        "url": "https://www.oracle.com/security-alerts/alert-cve-2020-14750.html",
+        "severity": "critical",
+        "published_date": "2020-11-01"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-14750",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.oracle.com/security-alerts/alert-cve-2020-14750.html"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.",
+    "type": "console-path-traversal-to-rce",
+    "blast_radius": 22,
+    "poc_available": true,
+    "poc_description": "Public nuclei template http/cves/2020/CVE-2020-14750.yaml in projectdiscovery/nuclei-templates sends a request to console.portal reached through an encoded traversal, carrying a cmd request header and a ShellSession gadget that reads that header and runs it, confirming through an out-of-band DNS callback. The Metasploit module modules/exploits/multi/http/weblogic_admin_handle_rce.rb lists CVE-2020-14750 among its CVE references, alongside CVE-2020-14882 and CVE-2020-14883; Rapid7's analysis and CrowdStrike describe this CVE as the bypass of the October 2020 fix.",
+    "iocs": {
+      "behavioral": [
+        "The WebLogic Java process spawning a shell child (/bin/sh -c on Unix, cmd.exe /c on Windows) that runs the command carried in a request header or encoded in the handle parameter",
+        "An out-of-band DNS or HTTP callback from the WebLogic host to a scanning service right after a console.portal request, which the public template uses to confirm reachability",
+        "Requests that reach console.portal through a re-encoded ../ traversal, such as the double-encoded %252e%252e%252f and .%252e forms the public exploits send. Rapid7's analysis describes the blocklist the October 2020 update added as case-sensitive, so a lowercase or mixed-case variant of the traversal also passes it"
+      ],
+      "network": [
+        "A request whose path ends in console.portal reached through an encoded ../ traversal under /console/, matched case-insensitively across encodings (for example lowercase %252e%252e%252f, uppercase %252E%252E%252F, /console/css/.%252e/console.portal or /console/..%2Fconsole.portal), because the bypass of the October 2020 fix works by re-encoding or changing the case of the traversal rather than using a fixed path",
+        "A console.portal request whose handle parameter names com.tangosol.coherence.mvel2.sh.ShellSession. The nuclei template carries the operating system command in an extra cmd header that the gadget reads, while the Metasploit module Base64-encodes the command inside the handle value and sends no extra header, so match the handle naming ShellSession rather than the header",
+        "An ADMINCONSOLESESSION response header on a console.portal request together with an out-of-band DNS callback from the WebLogic host, which is the success condition the public nuclei check uses",
+        "The administration console answering on its default port 7001 (or 7002 for TLS) from an untrusted source"
+      ],
+      "host": [
+        "A WebLogic Server of any release whose administration console is reachable over the network and that has not applied the Security Alert CVE-2020-14750 patch (My Oracle Support Note 2724951.1) or a later patch that includes it, whatever its October 2020 Critical Patch Update status; this includes releases outside Oracle Premier Support or Extended Support, which receive no Security Alert patch",
+        "The administration console reachable beyond a trusted management network"
+      ],
+      "_ioc_source_note": "The traversal-to-console.portal path, the cmd request header, the header-reading gadget and the DNS-callback success condition come from the ProjectDiscovery template at https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2020/CVE-2020-14750.yaml. The /console/css/.%252e/console.portal form and the Base64-encoded command inside the handle value were read from the Metasploit module weblogic_admin_handle_rce.rb at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/weblogic_admin_handle_rce.rb, for detection artifacts only. That the October 2020 fix was a case-sensitive traversal blocklist bypassed by re-encoding or changing case comes from Rapid7 at https://www.rapid7.com/blog/post/ra-cve-2020-14882-unauthenticated-rce-in-console-component-of-oracle-weblogic-server-analysis/. Oracle's Security Alert at https://www.oracle.com/security-alerts/alert-cve-2020-14750.html states the flaw is related to CVE-2020-14882 and that exploit code had been published on various sites, lists the affected versions without any prior-patch condition, and states that releases outside Premier or Extended Support receive no Security Alert patch. The internet-wide scanning of the related console flaw comes from the SANS Internet Storm Center diary at https://isc.sans.edu/diary/26734. The shell-child and outbound-callback entries are general hunting heuristics rather than artifacts read from one source. CrowdStrike at https://www.crowdstrike.com/en-us/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/ attributes exploitation of this CVE to the eCrime actor PROPHET SPIDER and publishes, in that blog's Indicators of Compromise table, four SHA256 hashes for the actor's GOTROJ backdoor and two for its JSP webshell, along with host artifacts such as tools stored in C:\\Windows\\Temp\\7fde\\ and a reverse shell binary in /var/tmp/. Operators should take those indicators from the blog; they are not reproduced here. The blog's example requests use placeholder callback addresses, so no fixed C2 address is listed."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Oracle's Security Alert for CVE-2020-14750 credits a long list of outside researchers and organizations who reported the flaw, including voidfyoo of Chaitin Security Research Lab and teams at Qi'anxin, Dbappsecurity and 360. No source claims AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2020-14750 (NVD-CWE-noinfo, CVSS 9.8) + CISA KEV (added 2021-11-03) + Oracle Security Alert Advisory alert-cve-2020-14750, which credits many outside reporters including voidfyoo of Chaitin Security Research Lab.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2020-14750 to the KEV catalog on 2021-11-03 with a 2022-05-03 due date and records known ransomware campaign use as Unknown. Oracle's Security Alert, released on 2020-11-01, states the flaw is related to CVE-2020-14882 and that, due to its severity and the publication of exploit code on various sites, customers should apply the update as soon as possible; Rapid7 and CrowdStrike characterize this CVE as the bypass of the October 2020 fix for CVE-2020-14882. CrowdStrike attributes exploitation of CVE-2020-14882 and CVE-2020-14750 to the eCrime actor PROPHET SPIDER, which it assesses most likely acted as an access broker. CrowdStrike reports two cases in which PROPHET SPIDER access was followed by Egregor and MountLocker ransomware deployment, likely by separate groups; the Egregor case began with a breach of an Apache web server, CrowdStrike names no initial access for the MountLocker case, and it does not link either case to this CVE.",
+    "attack_refs": [
+      "T1190",
+      "T1059",
+      "T1105"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires an organization to identify and correct flaws, test updates for effectiveness before installation, and install each security-relevant update within a defined period of its release. The clock in SI-2(c) starts from an update's release, so while the bypass of the October 2020 fix was public and Oracle had not yet released the 2020-11-01 Security Alert for CVE-2020-14750, no SI-2 period was running against the flaw, and an operator who had recorded the October update as installed had a tested, effective-looking fix that no longer closed the traversal.",
+      "NIS2-Art21-network-security": "Article 21(2)(i) requires access control policies and 21(2)(j) requires multi-factor or continuous authentication, but these govern the entity's own account and access decisions; they do not reach a vendor defect that lets a crafted traversal skip the console's authentication entirely, so an operator can satisfy the access-control and MFA measures while an unauthenticated request still takes over an internet-facing WebLogic console.",
+      "UK-CAF-B4": "CAF principle B4.d requires externally exposed vulnerabilities to be tracked, prioritized and mitigated promptly, for example by patching or by segregation that removes access to the vulnerability. An operator who had applied the October 2020 Critical Patch Update would reasonably have recorded this console vulnerability as mitigated, yet the fix was bypassed and remained exploitable until the 2020-11-01 Security Alert, so a B4.d self-assessment could read as met while the traversal stayed open.",
+      "ISO-27001-2022-A.8.8": "A.8.8 technical vulnerability management sets appropriate timescales from a fix being available, but the appropriate timescale here restarts when the October 2020 update is bypassed and the Security Alert patch is published, and the control does not distinguish a genuinely remediated instance from one still running a fix that has since been defeated.",
+      "AU-Essential-8-Patch": "ISM-1876 patches an online service within 48 hours of release when the vendor rates the flaw critical or a working exploit exists, and ISM-1690 within two weeks when the vendor rates it non-critical and no working exploit exists; an internet-facing WebLogic administration console is an online service, and an instance reachable only internally is an other application patched within one month from Maturity Level Two (ISM-1693) with no timeframe at Maturity Level One. Oracle released the Security Alert on 2020-11-01 noting exploit code had been published on various sites, so a working exploit existed and the 48-hour ISM-1876 window ran from that release; an estate that had applied only the October 2020 update had no fix for this bypass until the alert, so no patch window for it had started before 2020-11-01."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free live patch exists. Remediation is the Security Alert CVE-2020-14750 patch (My Oracle Support Note 2724951.1), which requires restarting the WebLogic server for the patched classes to load, not a host reboot.",
+    "affected": "Oracle WebLogic Server (Fusion Middleware, Console component). An unauthenticated attacker with HTTP access to the administration console reaches remote code execution and takes over the server; this CVE bypasses the October 2020 fix for the related CVE-2020-14882.",
+    "affected_versions": [
+      "Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0; the October 2020 Critical Patch Update fix for CVE-2020-14882 is bypassed, so the Security Alert CVE-2020-14750 patch (My Oracle Support Note 2724951.1) is the build that closes it (apply the patch and restart the server)",
+      "Other WebLogic Server releases outside Oracle Premier Support or Extended Support are not tested by Oracle and receive no Security Alert patch; the Security Alert states that earlier versions of affected releases are likely also affected and recommends upgrading to a supported version"
+    ],
+    "vendor_update_paths": [
+      "Apply the Oracle Security Alert CVE-2020-14750 patch (My Oracle Support Note 2724951.1) to WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 or 14.1.1.0.0 and restart the server; this is the build that closes the bypass, not the October 2020 update alone.",
+      "On a WebLogic Server release outside Premier Support or Extended Support, for which the Security Alert provides no patch, upgrade to a supported release, then apply the Security Alert CVE-2020-14750 patch (or a later patch that includes it) and restart the server.",
+      "Restrict the administration console to a trusted management network as an interim measure until the Security Alert patch is applied."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 72,
+    "rwep_notes": "RWEP 72. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +22, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2020-8644": {
+    "name": "PlaySMS Server-Side Template Injection Vulnerability",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-94"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "PlaySMS before 1.4.3 double-processes a server-side template during login. The username submitted to index.php on the login route is stored and, on a second template pass, an unauthenticated attacker's {{ ... }} expression in that field is concatenated into a PHP string of the form <?php echo(input); ?>, which the tpl engine writes to a .compiled cache file and includes, or evaluates directly, giving remote code execution with the privileges of the PlaySMS web process.",
+    "epss_score": 0.86689,
+    "epss_percentile": 0.99733,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-8644",
+    "vendor_advisories": [
+      {
+        "vendor": "PlaySMS",
+        "advisory_id": "2704",
+        "url": "https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704",
+        "severity": "unknown",
+        "published_date": null
+      },
+      {
+        "vendor": "PlaySMS",
+        "advisory_id": "https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/",
+        "url": "https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/",
+        "severity": "unknown",
+        "published_date": "2020-02-05"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-8644",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704",
+      "https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.",
+    "type": "template-injection-to-rce",
+    "blast_radius": 16,
+    "poc_available": true,
+    "poc_description": "Public nuclei template http/cves/2020/CVE-2020-8644.yaml in projectdiscovery/nuclei-templates first GETs the login page to read the X-CSRF-Token, then POSTs to index.php?app=main&inc=core_auth&route=login&op=login with the username field set to a template expression such as {{`echo 'CVE-2020-8644' | rev`}} and matches the reversed marker in the response with status 200. The Metasploit module modules/exploits/multi/http/playsms_template_injection.rb (PlaySMS index.php Unauthenticated Template Injection Code Execution) exploits the same pre-authentication login field, crediting Touhid M.Shaikh for the module and Lucas Rosevear of NCC Group for the finding.",
+    "iocs": {
+      "behavioral": [
+        "The PlaySMS web process (PHP under Apache or PHP-FPM) spawning a shell child (sh -c) from the login flow, which is how a command inside a {{ ... }} expression runs",
+        "The username field on the login page reflecting the output of an operating system command, which the reproduction uses to confirm execution",
+        "Outbound connections from the PlaySMS host initiated by the web process shortly after a login POST, consistent with a staged payload"
+      ],
+      "network": [
+        "A POST to index.php whose query carries app=main, inc=core_auth, route=login and op=login in any order and whose username field contains a template expression, seen URL-encoded as %7B%7B and %7D%7D around the payload, preceded by a GET to the login page to obtain the X-CSRF-Token. The Metasploit module shuffles both the query parameters and the POST fields on every request, so match the parameter set rather than their sequence",
+        "A login POST whose username carries backticks or a PHP expression inside {{ ... }} rather than a plausible account name",
+        "A 200 response to the login flow whose body reflects a value the request asked to be reversed or echoed back in the username field, the success signal of the nuclei check, or a 302 response to a login POST carrying a template expression, which the Metasploit module treats as success without reflecting any output"
+      ],
+      "host": [
+        "PlaySMS reporting a version before 1.4.3",
+        "New .compiled cache files under the tpl cache directory whose contents contain <?php echo( ... ); ?> built from submitted input, which is how the engine stages the injected code",
+        "Files or processes owned by the PlaySMS web service account that were created just after a login request"
+      ],
+      "_ioc_source_note": "The login route, the query parameters, the X-CSRF-Token step, the {{ ... }} username payload and the reversed-marker success match come from the ProjectDiscovery template at https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2020/CVE-2020-8644.yaml. The randomized parameter order and the 302 success response were read from the Metasploit module at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/playsms_template_injection.rb, for detection artifacts only. The double-processing mechanism, the concatenation into <?php echo(input); ?>, the .compiled cache file and the {{`ls -lah`}} reproduction come from NCC Group's technical advisory at https://www.nccgroup.com/research/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/. The fixed version comes from the vendor release note at https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/. The shell-child, command-reflection, outbound-connection and web-account file-or-process-creation entries are general hunting heuristics rather than artifacts read from one source. No actor infrastructure, file hash or C2 address is listed, because no source consulted attributes this CVE to a named campaign or operator."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "NCC Group's technical advisory credits Lucas Rosevear as the author and reporter of the flaw, and the vendor release note links to that advisory; the Metasploit module also credits Lucas Rosevear of NCC Group for the finding. No source claims AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2020-8644 (CWE-94, CVSS 9.8) + CISA KEV (added 2021-11-03) + NCC Group technical advisory by Lucas Rosevear, with the fix in the PlaySMS 1.4.3 release note.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2020-8644 to the KEV catalog on 2021-11-03 with a 2022-05-03 due date and records known ransomware campaign use as Unknown, which is CISA's evidence of in-the-wild use. No named campaign, actor cluster or incident report attributing exploitation of this CVE is present in the sources reviewed; what is documented is the commodity availability of the exploit, a Metasploit module and a nuclei template, which fits opportunistic use against internet-exposed PlaySMS instances.",
+    "attack_refs": [
+      "T1190",
+      "T1059.004"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-AC-3": "AC-3 enforces approved authorizations by mediating access to protected operations, but PlaySMS processes the submitted username through its template engine on the login route before any authentication succeeds, so the code executes before an authorization decision is made and the AC-3 mediator never governs the request that takes over the host.",
+      "NIS2-Art21-vulnerability-management": "NIS2 Article 21(2)(e) requires vulnerability handling and disclosure but sets no timeframe, and for entities in scope of Commission Implementing Regulation (EU) 2024/2690 point 6.6.1 requires security patches to be applied within a reasonable time after they become available, with additional measures where none exists. Here PlaySMS released 1.4.3 on 2020-02-05, the day NVD published the CVE with the boundary 'before 1.4.3', and NCC Group's advisory of 2020-02-11 published an unauthenticated reproduction ({{`ls -lah`}} as the login username, with no password), so a working method was public six days after the fix. Point 6.6.1 does not define a reasonable time or relate it to the publication of exploitation steps, so an entity could meet it with a patch cycle longer than those six days.",
+      "UK-CAF-B2": "CAF principle B2 restricts access to authorized users, yet the vulnerable code runs from the pre-authentication login field, so there is no account to enumerate or privilege to review while an unauthenticated request reaches code execution, and a B2 assessment of the identity model finds nothing that governs the flaw.",
+      "ISO-27001-2022-A.5.15": "A.5.15 frames access control as an organizational policy enforced through identity and role, but the login route evaluates a template expression from an unauthenticated caller, so a single code defect in input handling collapses the access model before any A.5.15 policy control is reached.",
+      "AU-ISM-1546": "ISM-1546 requires users to be authenticated before they are granted access to a system and its resources; PlaySMS accepts and processes the username through its template engine on the login route before authentication, so a request that never authenticates reaches code execution, which a configuration record of authentication being present does not cover.",
+      "AU-Essential-8-Patch": "ISM-1876 patches an online service within 48 hours of release when the vendor rates the flaw critical or a working exploit exists, and ISM-1690 within two weeks when the vendor rates it non-critical and no working exploit exists; an internet-facing PlaySMS portal is an online service, while a PlaySMS instance reachable only internally is an other application patched within one month from Maturity Level Two (ISM-1693) with no required timeframe at Maturity Level One. PlaySMS 1.4.3 shipped on 2020-02-05 before any public exploit, so meeting the online-service window would have closed the flaw for an internet-facing instance, but at Maturity Level One an internal-only instance has no patch timeframe at all while this unauthenticated code-execution flaw stays open."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free live patch exists for the PHP application. Remediation is the upgrade to PlaySMS 1.4.3 or later; the web server or PHP-FPM worker serving PlaySMS reloads the updated code, but no host reboot is required.",
+    "affected": "PlaySMS, an open-source SMS gateway with a PHP web portal. An unauthenticated attacker with network access to the login page reaches remote code execution with the privileges of the PlaySMS web process.",
+    "affected_versions": [
+      "PlaySMS before 1.4.3 (fixed in 1.4.3)"
+    ],
+    "vendor_update_paths": [
+      "Upgrade PlaySMS to version 1.4.3 or later, per the PlaySMS 1.4.3 release note, and reload the web server or PHP-FPM worker.",
+      "Restrict network access to the PlaySMS login page to trusted sources until the upgrade is in place."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 16,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 66,
+    "rwep_notes": "RWEP 66. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +16, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2019-18935": {
+    "name": "Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-502"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": true,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)",
+    "epss_score": 0.99737,
+    "epss_percentile": 0.99953,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-18935",
+    "vendor_advisories": [
+      {
+        "vendor": "Progress",
+        "advisory_id": "allows-javascriptserializer-deserialization",
+        "url": "https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization",
+        "severity": "unknown",
+        "published_date": null
+      },
+      {
+        "vendor": "Progress",
+        "advisory_id": "ui-for-asp-net-ajax-r1-2020-(version-2020-1-114)",
+        "url": "https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-(version-2020-1-114)",
+        "severity": "unknown",
+        "published_date": "2020-01-15"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2019-18935",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization",
+      "https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-(version-2020-1-114)"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.",
+    "type": "deserialization-to-rce",
+    "blast_radius": 24,
+    "poc_available": true,
+    "poc_description": "The public repository noperator/CVE-2019-18935 on GitHub provides a proof-of-concept exploit for the .NET JavaScriptSerializer deserialization in Telerik UI for ASP.NET AJAX, uploading and loading a mixed-mode assembly DLL through RadAsyncUpload. It depends on the encryption logic in bao7uo/RAU_crypto on GitHub, which breaks the RadAsyncUpload encryption so the upload configuration object can be manipulated. The exploit repository's README and its exploit code CVE-2019-18935.py were read for detection artifacts only; the payload-building files were not.",
+    "iocs": {
+      "behavioral": [
+        "The IIS worker process w3wp.exe loading a newly written DLL, which is how the deserialized mixed-mode assembly runs. The actors in AA23-074A wrote the DLLs to C:\\Windows\\Temp\\ and executed them from there, but the public exploit's README documents options that set the destination folder (-f) and the remote file name (-r) and that name a remote SMB server for the payload (-s), so match a newly written DLL loaded from any folder or from a UNC path",
+        "Files named in Unix epoch time as [10 digits].[7 digits].dll (regex \\d{10}\\.\\d{1,8}\\.dll), some masqueraded with a .png extension, whose file-system creation date does not match when they first appeared, indicating timestomping; this naming and the C:\\Windows\\Temp\\ folder are what the actors in AA23-074A used, so do not limit the search to that folder",
+        "Malware that searches for and removes files with a .dll extension from C:\\Windows\\Temp\\, so artifacts are missing after execution",
+        "An Application event log entry EventID 1309 recording an InvalidCastException that cannot cast System.Configuration.Install.AssemblyInstaller to Telerik.Web.UI.IAsyncUploadConfiguration in Telerik.Web.UI.AsyncUploadHandler.GetConfiguration, which marks a crafted RadAsyncUpload deserialization attempt"
+      ],
+      "network": [
+        "A POST whose URI stem ends in Telerik.Web.UI.WebResource.axd, with the query type=rau, which is the RadAsyncUpload handler the exploit targets; match on the end of the stem rather than a fixed path from the site root",
+        "Two IIS log events with the same timestamp for a single exploitation, one with sc-status 200 and one with sc-status 302, sharing the cs-method POST, cs-uri-stem /Telerik.Web.UI.WebResource.axd and cs-uri-query type=rau",
+        "Requests to the RadAsyncUpload endpoint from an untrusted or internet-facing source against an internet-facing IIS server"
+      ],
+      "host": [
+        "Telerik.Web.UI.dll from 2011.1.315 through 2019.3.1023, or 2020.1.114 with the RadAsyncUpload type allowlist (the AllowedCustomMetaDataTypes appSettings key) disabled; through 2017.2.621 exploitation needs no keys, and from 2017.2.711 it needs known or default RadAsyncUpload encryption keys",
+        "Telerik UI software installed in a nonstandard file path a version scan may not reach, so a scan can report the host clean while the vulnerable component is present",
+        "New DLL or PNG files owned by the IIS worker account in any folder it can write, C:\\Windows\\Temp\\ being the folder the actors in AA23-074A used"
+      ],
+      "_ioc_source_note": "The RadAsyncUpload endpoint and query, the two same-timestamp IIS events (sc-status 200 and 302), the C:\\Windows\\Temp\\ DLL and PNG drops, the [10 digits].[7 digits].dll naming and \\d{10}\\.\\d{1,8}\\.dll regex, the timestomping, the .dll-removing malware, the w3wp.exe execution, the EventID 1309 InvalidCastException signature and the scanner file-path miss all come from CISA advisory AA23-074A at https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a; the C:\\Windows\\Temp\\ folder and the epoch naming are what those actors did, not fixed properties of the exploit. The options that set the destination folder (-f) and the remote file name (-r), name a remote SMB server for the payload (-s) and target a URL ending in Telerik.Web.UI.WebResource.axd?type=rau (-u) come from the usage block of the public exploit's README at https://raw.githubusercontent.com/noperator/CVE-2019-18935/master/README.md. The exploit code at https://raw.githubusercontent.com/noperator/CVE-2019-18935/master/CVE-2019-18935.py was also read for detection artifacts only and matches the RadAsyncUpload endpoint, the type=rau query and the AssemblyInstaller type in these entries; the payload-building files were not read. The version tiers, the type-allowlist mitigation, the encryption-key prerequisite and the fixed version R1 2020 (2020.1.114) come from Telerik's knowledge base article at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/common-allows-javascriptserializer-deserialization. The RadAsyncUpload-endpoint-from-untrusted-source entry, the w3wp.exe load of a newly written DLL from any folder or a UNC path, and the new-DLL-or-PNG-in-any-folder entry are general hunting heuristics built from those sources rather than artifacts read from one source. AA23-074A attributes exploitation to an APT actor and to the cybercriminal group XE Group and lists that group's indicators in its own tables; operators should take the specific indicators from the advisory, and none are reproduced here."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Telerik's knowledge base thanks Markus Wulftange of Code White GmbH and Paul Taylor (@bao7uo) for helping make the information public, and the public exploit repository credits Markus Wulftange with the initial discovery and Paul Taylor with the RadAsyncUpload encryption logic. No source claims AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2019-18935 (CWE-502, CVSS 9.8) + CISA KEV (added 2021-11-03, ransomware: Known) + Progress Telerik knowledge base advisory crediting Markus Wulftange of Code White GmbH and Paul Taylor.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2019-18935 to the KEV catalog on 2021-11-03 with a 2022-05-03 due date and records known ransomware campaign use as Known. CISA advisory AA23-074A documents that multiple actors exploited the flaw on a federal agency's internet-facing IIS server running Telerik UI for ASP.NET AJAX version 2013.2.717, which also carries CVE-2017-11317 and CVE-2017-11357: the cybercriminal actor XE Group (Threat Actor 2) delivered DLL files masqueraded as PNG files as early as August 2021, and an APT actor (Threat Actor 1) exploited the flaw for system enumeration beginning in August 2022, with actors uploading DLL files to C:\\Windows\\Temp\\ and executing them through the w3wp.exe process. CISA and the authoring organizations identified indicators of compromise from November 2022 through early January 2023. The compromise went undetected by the agency's scanner because the Telerik software was installed in a file path it did not typically scan. CISA's KEV entry does not flag this CVE for forensic triage.",
+    "attack_refs": [
+      "T1190",
+      "T1105",
+      "T1055.001",
+      "T1036.005",
+      "T1070.004"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires an organization to identify, report and correct system flaws, to test updates for effectiveness and side effects before installing them, and to install security-relevant updates within a defined period of their release. The period for R1 2020 (2020.1.114) ran from its January 2020 release, but correction under SI-2 depends on the flaw being identified first, and AA23-074A records that the agency's scanner held the plugin for this CVE yet could identify only Windows Installer-installed applications, while the Telerik UI software had been installed through a continuous integration and continuous delivery pipeline in a file path the scanner did not typically scan. The flaw was therefore never identified, and the server still ran version 2013.2.717 when actors exploited it from August 2021.",
+      "NIS2-Art21-incident-handling": "NIS2 Article 21(2)(b) requires incident handling, and Article 23(4) sets the notification clocks: an early warning within 24 hours and a fuller notification within 72 hours of becoming aware of a significant incident. Both start from awareness, and the actors here uploaded DLLs masqueraded as PNG files and ran malware that removed them after use, so an operator's awareness of the compromise could arrive well after the intrusion, leaving the 24-hour and 72-hour clocks to run only once forensic evidence surfaced.",
+      "UK-CAF-D1": "CAF principle D1 response and recovery requires a plan with a comprehensive range of containment, eradication and recovery strategies, but a server whose IIS worker has loaded an attacker's mixed-mode assembly and had DLLs planted in C:\\Windows\\Temp\\ needs evidence capture, host rebuild and credential rotation, and D1 does not require the plan to default to rebuild rather than in-place patching for an actively exploited code-execution compromise.",
+      "ISO-27001-2022-A.8.16": "A.8.16 requires networks, systems and applications to be monitored for anomalous behavior and appropriate actions to be taken to evaluate potential information security incidents. The control leaves the choice of monitored events to the organization and does not name the events that mark this exploitation: the IIS POST to Telerik.Web.UI.WebResource.axd with type=rau, which AA23-074A records as a same-timestamp pair with sc-status 200 and 302 and which reads as ordinary application traffic, and the EventID 1309 InvalidCastException in Telerik.Web.UI.AsyncUploadHandler.GetConfiguration. The actors' malware deleted the dropped DLLs from C:\\Windows\\Temp\\, so the file evidence was removed from the host and those logged events remained the record of the compromise.",
+      "AU-ISM-1808": "ISM-1808 requires a vulnerability scanner with an up-to-date database, but AA23-074A records that the agency's scanner held the correct plugin for this flaw and still returned no finding because the Telerik software was installed in a file path the scanner did not examine, so a compliant scan reported the host clean while the vulnerable component was present."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free live patch exists. Remediation is upgrading Telerik.Web.UI.dll to R1 2020 (2020.1.114) or later and applying the recommended security settings; the change takes effect when the IIS application pool recycles, and no host reboot is required.",
+    "affected": "Progress Telerik UI for ASP.NET AJAX (the RadAsyncUpload function), running inside a Microsoft IIS web application. An attacker who knows or can break the RadAsyncUpload encryption keys reaches remote code execution on the server in the context of the w3wp.exe process.",
+    "affected_versions": [
+      "Telerik UI for ASP.NET AJAX (Telerik.Web.UI.dll) from Q1 2011 (2011.1.315) through R3 2019 SP1 (2019.3.1023); NVD marks the range 2011.1.315 through 2020.1.114 inclusive. Through R2 2017 SP1 (2017.2.621) the RadAsyncUpload encryption can be broken without the keys and the type allowlist does not exist; from R2 2017 SP2 (2017.2.711) to R3 2019 (2019.3.917) exploitation needs the encryption keys and the allowlist is still unavailable; R3 2019 SP1 (2019.3.1023) adds the allowlist as opt-in; R1 2020 (2020.1.114) enables it by default, and that default prevents the exploit while it stays enabled, with unique encryption keys remaining a recommended setting. Fixed by upgrading to R1 2020 (2020.1.114) or later, setting unique RadAsyncUpload encryption keys and enabling the type allowlist, then recycling the IIS application pool"
+    ],
+    "vendor_update_paths": [
+      "Upgrade Telerik.Web.UI.dll to R1 2020 (2020.1.114) or later, set unique RadAsyncUpload encryption keys and enable the type allowlist (the AllowedCustomMetaDataTypes appSettings key) per Telerik's recommended security settings, then recycle the IIS application pool.",
+      "Restrict access to the /Telerik.Web.UI.WebResource.axd RadAsyncUpload endpoint from untrusted sources until the upgrade and settings are in place."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 74,
+    "rwep_notes": "RWEP 74. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2015-4852": {
+    "name": "Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-502"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.",
+    "epss_score": 0.96032,
+    "epss_percentile": 0.99875,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2015-4852",
+    "vendor_advisories": [
+      {
+        "vendor": "Oracle",
+        "advisory_id": "cpujan2018-3236628.html",
+        "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
+        "severity": "unknown",
+        "published_date": "2018-01-16"
+      },
+      {
+        "vendor": "Oracle",
+        "advisory_id": "cpuoct2016-2881722.html",
+        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
+        "severity": "unknown",
+        "published_date": "2016-10-18"
+      },
+      {
+        "vendor": "Oracle",
+        "advisory_id": "cpuoct2017-3236626.html",
+        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
+        "severity": "unknown",
+        "published_date": "2017-10-17"
+      },
+      {
+        "vendor": "Oracle",
+        "advisory_id": "alert-cve-2015-4852-2763333.html",
+        "url": "http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html",
+        "severity": "unknown",
+        "published_date": "2015-11-10"
+      },
+      {
+        "vendor": "Oracle",
+        "advisory_id": "cpujan2016-2367955.html",
+        "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
+        "severity": "unknown",
+        "published_date": "2016-01-19"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2015-4852",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
+      "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
+      "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
+      "http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html",
+      "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.",
+    "type": "java-deserialization-rce",
+    "blast_radius": 22,
+    "poc_available": true,
+    "poc_description": "The Metasploit module exploit/multi/misc/weblogic_deserialize_rawobject targets this flaw; its Rapid7 listing at https://www.rapid7.com/db/modules/exploit/multi/misc/weblogic_deserialize_rawobject/ ranks it Excellent and unauthenticated (Privileged? No) and states it sends a serialized weblogic.jms.common.StreamMessageImpl object to the T3 interface. NVD tags Exploit-DB entries 42806 and 46628 as Exploit for this CVE, and entry 46628 is the reference on Emerging Threats rule sid 2035204. The original public tooling is the foxglovesec/JavaUnserializeExploits project (weblogic.py). The module source, Exploit-DB 42806 and weblogic.py were read for detection artifacts only; their gadget and payload bytes were not read.",
+    "iocs": {
+      "behavioral": [
+        "An unauthenticated T3 connection to a WebLogic listen port (7001 by default) from a host that is not on the WebLogic administration or managed-server network.",
+        "The WebLogic Server Java process launching a command interpreter (/bin/sh -c, cmd /c) or a downloader that it does not spawn during normal operation.",
+        "A WebLogic instance with no connection filter configured (weblogic.security.net.ConnectionFilterImpl), so any host that can reach a T3 listen port can open a T3 session."
+      ],
+      "network": [
+        "Inbound TCP to a WebLogic T3 listen port carrying a Java serialization stream. Emerging Threats rule sid 2035204 ('ET EXPLOIT Oracle Weblogic Server Deserialization RCE T3 (CVE-2015-4852)') matches a segment that starts with the bytes 00 00, has 01 65 two bytes later, then carries ac ed 00 followed by the class name weblogic.rjvm.ClassTableEntry; its destination port is any, so it fires on whatever port the server listens on, not only 7001.",
+        "The raw Java serialized-object header bytes AC ED 00 05 in the T3 stream. The class names that follow depend on the gadget chain: the Exploit-DB 42806 proof of concept uses the ysoserial CommonsCollections1 chain, which carries org.apache.commons.collections class names, and other ysoserial chains carry other class names. Emerging Threats rule sid 2022114 ('ET EXPLOIT Serialized Java Object Calling Common Collection Function') matches the base64 markers rO0ABXNyA and jb21tb25zLmNvbGxlY3Rpb25z, so it covers only channels that carry the object as base64 text and does not fire on raw T3 delivery, which carries the object as raw bytes.",
+        "WebLogic's T3 or T3s listener answering connections from an untrusted or internet-facing source address, on whatever port the server is configured with (7001 is the default).",
+        "A T3 handshake carrying PU:t3://us-l-breens:7001, a value hardcoded in the foxglovesec weblogic.py tool and in Exploit-DB 42806. An operator can change it, so its absence does not clear a connection."
+      ],
+      "host": [
+        "Oracle WebLogic Server reporting version 10.3.6.0, 12.1.2.0, 12.1.3.0 or 12.2.1.0 without the CVE-2015-4852 fix applied (patch availability tracked in Oracle MOS Note 2075927.1). This check covers only the four WebLogic Server versions Oracle's Security Alert lists; Oracle states that earlier versions of affected releases are likely also affected, and the other affected products listed for this CVE are checked against their own versions.",
+        "The Apache Commons Collections library on the WebLogic classpath at oracle_common/modules/com.bea.core.apache.commons.collections.jar, which supplies the CommonsCollections1 gadget chain the Exploit-DB 42806 proof of concept uses. The jar is present on patched servers too, and ysoserial offers other gadget chains, so neither its presence nor its absence shows whether the server is vulnerable.",
+        "New files, cron jobs or scheduled tasks owned by the operating-system account that runs the WebLogic server."
+      ],
+      "_ioc_source_note": "The sid 2035204 byte pattern (00 00, then 01 65, then ac ed 00 and weblogic.rjvm.ClassTableEntry, destination port any) and the sid 2022114 base64 markers come from the Emerging Threats open ruleset at https://rules.emergingthreats.net/open/suricata-5.0/rules/emerging-exploit.rules, which was read as detection content; sid 2022114 matches base64-encoded delivery and not raw T3. The affected versions and the vulnerable classpath jar come from NVD and Oracle's Security Alert at https://www.oracle.com/security-alerts/alert-cve-2015-4852.html. The connection-filter class name weblogic.security.net.ConnectionFilterImpl comes from Oracle's connection-filter documentation at https://docs.oracle.com/middleware/1213/wls/SCPRG/con_filtr.htm, and the default port 7001 comes from the NVD description. The unauthenticated T3 delivery is described in the Metasploit module listing at https://www.rapid7.com/db/modules/exploit/multi/misc/weblogic_deserialize_rawobject/. The PU:t3://us-l-breens:7001 handshake value and the ysoserial CommonsCollections1 chain were read from the Metasploit module source at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/misc/weblogic_deserialize_rawobject.rb, Exploit-DB 42806 at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/java/remote/42806.py and the foxglovesec tool at https://raw.githubusercontent.com/foxglovesec/JavaUnserializeExploits/master/weblogic.py, for detection artifacts only; their gadget and payload bytes were not read. The following are general hunting heuristics rather than artifacts read from a source: the raw AC ED 00 05 header in the T3 stream (neither Emerging Threats rule matches it; only that item's description of sid 2022114 comes from the ruleset), the process-tree item, the new-file item, the no-connection-filter item, the listener-answering-untrusted-sources item, the unauthenticated-connection item, and the jar-present item (the jar is on patched servers too). No actor infrastructure, file hash or C2 address is listed, because no source reviewed attributes this CVE to a named campaign or operator."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Predates AI-assisted vulnerability discovery. The Java deserialization class was presented by Gabriel Lawrence and Chris Frohoff at AppSec California in January 2015; CERT/CC records that Stephen Breen of Foxglove Security identified the Apache Commons Collections InvokerTransformer gadget reaching WebLogic in November 2015, and Oracle credits Matthias Kaiser of Code White with reporting the vulnerabilities its Security Alert addresses. No source claims AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2015-4852 (CWE-502, CVSS 9.8) + CISA KEV (added 2021-11-03) + Oracle Security Alert for CVE-2015-4852 (2015-11-10), which credits Matthias Kaiser of Code White; the Apache Commons Collections deserialization gadget was identified by Stephen Breen of Foxglove Security and the underlying class by Gabriel Lawrence and Chris Frohoff, per CERT/CC VU#576313.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to the KEV catalog on 2021-11-03 with a remediation due date of 2022-05-03 and records known ransomware use as Unknown; the KEV listing is CISA's evidence of in-the-wild exploitation, and the KEV entry's forensic-triage flag is No. No named campaign or actor is attributed in the sources reviewed. The public exploitation technique was published by Foxglove Security on 2015-11-06, days before Oracle's 2015-11-10 Security Alert, and commodity tooling (a Metasploit module and Exploit-DB entries) followed.",
+    "attack_refs": [
+      "T1190",
+      "T1210",
+      "T1059"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SC-7": "SC-7 requires monitoring and controlling communications at external and key internal boundaries. From the 2015-11-10 Security Alert until the WebLogic patch was available, Oracle's only published measure was the mitigation recommendations at MOS Note 2076338.1, so limiting which hosts can reach the T3 and T3s listen port was the boundary control available to an operator in that interval. A boundary control that permits T3 from any host on its allow list still passes the serialized object to the WLS Security component, so SC-7 evidence recording a perimeter firewall does not show that the T3 listen port is limited to the specific hosts that need it. In the 2015-11-06 to 2015-11-10 window, before any vendor measure, working exploit code was already public.",
+      "NIST-800-53-SI-2": "SI-2 requires applying fixes within an organization-defined time period, measured from when a fix is available. For this flaw a working exploit was public on 2015-11-06, and the vendor's first response on 2015-11-10 was mitigation recommendations (MOS Note 2076338.1), not a patch; the WebLogic patch followed later and its availability was tracked at MOS Note 2075927.1. A remediation period keyed to patch availability does not begin during the interval when a public exploit already exists and only those mitigation recommendations are available, so SI-2 as written leaves that interval, which is where the real exposure sat for this CVE, ungoverned.",
+      "NIS2-Art21-network-security": "NIS2 Article 21 requires appropriate and proportionate measures and sets no timeframe; for entities within the scope of Commission Implementing Regulation (EU) 2024/2690 it requires patches within a reasonable time after they become available and additional measures with residual risk accepted where a patch is not available. This CVE is exactly the no-patch-yet case: on 2015-11-10 the only vendor measure was the mitigation recommendations at MOS Note 2076338.1, and the reasonable-time clock could not start until the WebLogic patch became available. The shortfall is that neither the timeframe nor the additional-measure requirement forces re-evaluation of the residual risk that a network restriction on T3 leaves, namely that any host the restriction still allows can deliver the serialized object, while working exploit code had been public since 2015-11-06.",
+      "UK-CAF-B4": "CAF B4.d asks that announced vulnerabilities in the systems supporting an essential function are tracked, prioritized and mitigated (e.g. by patching) promptly; at the partially achieved level, externally exposed vulnerabilities are mitigated promptly, some vulnerabilities that are not externally exposed have temporary mitigations for an extended period, and unsupported systems have temporary mitigations while migration to supported technology is pursued. For this CVE, 'promptly' is not defined against a timeline in which working exploit code was public on 2015-11-06, four days before Oracle's first measure, the 2015-11-10 Security Alert with mitigation recommendations (MOS Note 2076338.1) and no patch. An outcome judged against 'mitigated (e.g. by patching)' can accept a restriction on which hosts reach T3 as the mitigation, even though any host the restriction still allows can deliver the serialized object. The affected releases are now unsupported, so B4.d's provision for them is temporary mitigation while migrating to a supported release.",
+      "AU-Essential-8-Patch": "Under the Essential Eight, an internet-facing WebLogic instance is an online service and is patched within 48 hours of a fix or mitigation release when the vendor rates the flaw critical or a working exploit exists (ISM-1876), and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1690), at every maturity level; an instance reachable only internally is an other application, patched within one month from Maturity Level Two (ISM-1693). A working exploit existed here from 2015-11-06, so the 48-hour ISM-1876 window applies; because every ISM patch control covers patches, updates or other vendor mitigations, that window started on 2015-11-10 when Oracle published its mitigation recommendations (MOS Note 2076338.1). A network restriction on T3 applied within that window still leaves the deserialization reachable from any host the restriction allows until the later patch (MOS Note 2075927.1) is applied. The genuine timing gap is the 2015-11-06 to 2015-11-10 period, before any vendor fix or mitigation, when the working exploit was public and no window could close the exposure.",
+      "ISO-27001-2022-A.8.28": "A.8.28 requires secure coding principles across development. The root cause is that WebLogic's WLS Security component deserializes attacker-supplied Java objects from T3 traffic into arbitrary object graphs, reaching the Apache Commons Collections InvokerTransformer gadget on the classpath; A.8.28 as commonly implemented checks the organization's own code and does not reach a third-party application server's deserialization of untrusted network input, so the unsafe-deserialization defect ships regardless of the operator's secure-coding attestation."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch path exists for a Java application server of this shape. Remediation is Oracle's patch, tracked at MOS Note 2075927.1 and later carried in the cumulative Critical Patch Updates. WebLogic Server 12.1.2.0, 12.1.3.0 and 12.2.1.0 are patched with OPatch, which requires shutting down the WebLogic server processes and restarting them afterward (https://docs.oracle.com/middleware/1213/core/OPATC/toc.htm). WebLogic Server 10.3.6.0 is patched with Oracle Smart Update (bsu), and Oracle's Smart Update guide says to stop the server when applying a patch (https://docs.oracle.com/cd/E14759_01/doc.32/e14143/install.htm). In both cases this is a process restart rather than a host reboot. Oracle's Security Alert refers to mitigation recommendations at MOS Note 2076338.1 and does not describe them. WebLogic's documented mechanism for limiting which hosts can open T3 and T3s sessions is a connection filter; connection-filter rules entered in the WebLogic Server Administration Console are evaluated at startup and at runtime (https://docs.oracle.com/middleware/1213/wls/SCPRG/con_filtr.htm), so such a filter takes effect without a restart. All four affected releases are past their support windows: WebLogic Server 10.3.6.0, 12.1.2.0 and 12.1.3.0 are past Extended Support, and 12.2.1.0 is a superseded 12.2.x patch set; the supported path is a current release carrying the latest Critical Patch Update.",
+    "affected": "Oracle WebLogic Server, the WLS Security component, reachable over the T3 protocol (TCP port 7001 by default). An unauthenticated remote request carrying a crafted serialized Java object reaches the Apache Commons Collections library (oracle_common/modules/com.bea.core.apache.commons.collections.jar) on the classpath and executes arbitrary commands with the permissions of the WebLogic process. NVD's description carries a note limiting the CVE's scope to WebLogic Server, but NVD's own CPE configuration also lists Oracle Virtual Desktop Infrastructure (through 3.5.2) and StorageTek Tape Analytics SW Tool as vulnerable, and Oracle's later Critical Patch Updates state that the CVE-2015-7501 fix also addresses this issue for further product lines that bundle the affected library.",
+    "affected_versions": [
+      "Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0 and 12.2.1.0, the versions Oracle's Security Alert lists as affected; Oracle notes that releases outside Premier or Extended Support were not tested and that earlier versions of affected releases are likely also affected.",
+      "Oracle Virtual Desktop Infrastructure through 3.5.2 (inclusive), listed as vulnerable in NVD's CPE configuration for this CVE.",
+      "StorageTek Tape Analytics SW Tool, reached through the bundled WebLogic Server over T3: NVD's CPE lists version 2.3, and Oracle's April 2017 Critical Patch Update lists it as affected prior to 2.2.1 (fixed in 2.2.1). See https://www.oracle.com/security-alerts/cpuapr2017.html.",
+      "Product lines in Critical Patch Update appendices where Oracle states 'The fix for CVE-2015-7501 also addresses CVE-2015-4852', each fixed by that Critical Patch Update. The October 2016 update's Retail appendix (https://www.oracle.com/security-alerts/cpuoct2016.html) lists MICROS XBR 7.0.2 and 7.0.4, Oracle Retail Clearance Optimization Engine 13.2, 13.3, 13.4 and 14.0, and Oracle Retail Xstore Point of Service 5.0, 5.5, 6.0, 6.5, 7.0 and 7.1. The October 2017 update's Communications appendix (https://www.oracle.com/security-alerts/cpuoct2017.html) lists Oracle Communications WebRTC Session Controller 7.0, 7.1 and 7.2 and Oracle Communications Order and Service Management 7.2.4.x.x, 7.3.0.x.x, 7.3.1.x.x and 7.3.5.x.x. The January 2018 update's Fusion Middleware appendix (https://www.oracle.com/security-alerts/cpujan2018.html) lists Oracle Identity Manager Connector CA ACF2 9.0.4.20.6, 9.0.4.21.0 and 9.0.4.25.4 and Oracle Identity Manager 11.1.2.3.0."
+    ],
+    "vendor_update_paths": [
+      "Apply Oracle's patch for CVE-2015-4852. On 2015-11-10 Oracle published the Security Alert, which refers to mitigation recommendations at MOS Note 2076338.1 and states that creation of WebLogic Server patches is in progress, with patch availability tracked at MOS Note 2075927.1; the fixes are cumulative and carried forward in Oracle's later Critical Patch Updates. See https://www.oracle.com/security-alerts/alert-cve-2015-4852.html. WebLogic Server 12.1.2.0, 12.1.3.0 and 12.2.1.0 are patched with OPatch; Oracle states that Smart Update is no longer supported for Fusion Middleware 12c (https://docs.oracle.com/middleware/1221/core/OPATC/GUID-B7BA7B93-43EF-4B34-B5AE-400230494B71.htm), and applying an OPatch fix requires shutting down the WebLogic server processes and restarting them (https://docs.oracle.com/middleware/1213/core/OPATC/toc.htm). WebLogic Server 10.3.6.0 is patched with Oracle Smart Update, whose command-line interface is bsu (https://docs.oracle.com/cd/E14759_01/doc.32/e14143/intro.htm), and Oracle's Smart Update guide says to stop the server when applying a patch (https://docs.oracle.com/cd/E14759_01/doc.32/e14143/install.htm).",
+      "Where the patch cannot be applied at once, follow Oracle's mitigation recommendations at MOS Note 2076338.1, which the Security Alert does not describe, and limit which hosts can reach the T3 and T3s protocols with a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) or with network access controls, so that the T3 listen port does not accept connections from untrusted networks. Connection-filter rules entered in the WebLogic Server Administration Console are evaluated at startup and at runtime (https://docs.oracle.com/middleware/1213/wls/SCPRG/con_filtr.htm), so a filter takes effect without a restart, but it leaves the deserialization reachable from any host it still allows.",
+      "For the product lines in Critical Patch Update appendices where Oracle states that the fix for CVE-2015-7501 also addresses this issue, apply the Critical Patch Update named for each: October 2016 for MICROS XBR, Oracle Retail Clearance Optimization Engine and Oracle Retail Xstore Point of Service (https://www.oracle.com/security-alerts/cpuoct2016.html); October 2017 for Oracle Communications WebRTC Session Controller and Oracle Communications Order and Service Management (https://www.oracle.com/security-alerts/cpuoct2017.html); and January 2018 for Oracle Identity Manager Connector CA ACF2 and Oracle Identity Manager (https://www.oracle.com/security-alerts/cpujan2018.html).",
+      "For StorageTek Tape Analytics SW Tool, which Oracle lists for CVE-2015-4852 directly through its bundled WebLogic Server over T3, upgrade to release 2.2.1 or later: the April 2017 Critical Patch Update lists versions prior to 2.2.1 as affected (https://www.oracle.com/security-alerts/cpuapr2017.html). NVD's CPE configuration lists version 2.3 as vulnerable, which conflicts with Oracle's 2.2.1 boundary.",
+      "For Oracle Virtual Desktop Infrastructure, Oracle names no fix for CVE-2015-4852. NVD lists VDI through 3.5.2 as vulnerable to this CVE, and the October 2016 Critical Patch Update lists VDI prior to 3.5.3 as affected by the Apache Commons Collections flaw CVE-2015-7501, without the note that this fix also addresses CVE-2015-4852 (https://www.oracle.com/security-alerts/cpuoct2016.html). VDI 3.5.3 is the release that carries the CVE-2015-7501 fix.",
+      "CERT/CC advises applications that use the Apache Commons Collections library to update it to 3.2.2 or 4.1, which disables the unsafe InvokerTransformer functionality but leaves other deserialization gadgets reachable (https://www.kb.cert.org/vuls/id/576313); Oracle does not name a swap of the bundled oracle_common/modules/com.bea.core.apache.commons.collections.jar as a WebLogic remediation, so on WebLogic this is background rather than a vendor update path."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 72,
+    "rwep_notes": "RWEP 72. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +22, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2020-2555": {
+    "name": "Oracle Multiple Products Remote Code Execution Vulnerability",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-502"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
+    "epss_score": 0.97116,
+    "epss_percentile": 0.99891,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-2555",
+    "vendor_advisories": [
+      {
+        "vendor": "Oracle",
+        "advisory_id": "cpujan2020.html",
+        "url": "https://www.oracle.com/security-alerts/cpujan2020.html",
+        "severity": "critical",
+        "published_date": "2020-01-14"
+      },
+      {
+        "vendor": "Oracle",
+        "advisory_id": "cpujan2021.html",
+        "url": "https://www.oracle.com/security-alerts/cpujan2021.html",
+        "severity": "critical",
+        "published_date": "2021-01-19"
+      },
+      {
+        "vendor": "Oracle",
+        "advisory_id": "cpujul2020.html",
+        "url": "https://www.oracle.com/security-alerts/cpujul2020.html",
+        "severity": "critical",
+        "published_date": "2020-07-14"
+      },
+      {
+        "vendor": "Oracle",
+        "advisory_id": "cpujul2021.html",
+        "url": "https://www.oracle.com/security-alerts/cpujul2021.html",
+        "severity": "critical",
+        "published_date": "2021-07-20"
+      },
+      {
+        "vendor": "Oracle",
+        "advisory_id": "cpuoct2020.html",
+        "url": "https://www.oracle.com/security-alerts/cpuoct2020.html",
+        "severity": "critical",
+        "published_date": "2020-10-20"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-2555",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.oracle.com/security-alerts/cpujan2020.html",
+      "https://www.oracle.com/security-alerts/cpujan2021.html",
+      "https://www.oracle.com/security-alerts/cpujul2020.html",
+      "https://www.oracle.com/security-alerts/cpujul2021.html",
+      "https://www.oracle.com/security-alerts/cpuoct2020.html"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).",
+    "type": "java-deserialization-rce",
+    "blast_radius": 20,
+    "poc_available": true,
+    "poc_description": "Public exploit code is listed at Exploit-DB 48320 (Oracle WebLogic Server 12.2.1.4.0, remote code execution, published 2020-04-14) and at Exploit-DB 48508 (the Metasploit module, published 2020-05-22). The Metasploit module is modules/exploits/multi/misc/weblogic_deserialize_badattrval.rb, and its Rapid7 listing at https://www.rapid7.com/db/modules/exploit/multi/misc/weblogic_deserialize_badattrval/ describes unauthenticated code execution by sending a serialized BadAttributeValueExpException object over the T3 protocol and names Jang, Y4er, Shelby Pace and Steve Embling as its developers. NVD also tags three Packet Storm entries for this CVE as exploits. Exploit-DB 48320 and the Metasploit module source were read for detection artifacts only.",
+    "iocs": {
+      "behavioral": [
+        "The Java process of any WebLogic Server instance (the Administration Server or a Managed Server) or of a Coherence cache server starting a command interpreter: sh or bash on Unix, cmd.exe or powershell.exe on Windows. The Metasploit module metadata lists both Windows and Unix targets.",
+        "Outbound connections from a WebLogic or Coherence host to an address outside the application tier within minutes of an inbound T3 session from an untrusted source.",
+        "One source opening T3 sessions to WebLogic listen ports across many addresses in a short period, which is how a scan for exposed T3 listeners appears before any exploitation attempt."
+      ],
+      "network": [
+        "Inbound TCP sessions that begin with a T3 handshake (ASCII text starting with t3 followed by a version string) from addresses outside the trusted application tier. WebLogic serves T3 on its listen ports, 7001 by default, so match on the handshake rather than on a single port number.",
+        "T3 traffic carrying a serialized Java object (stream header bytes AC ED 00 05) whose class names include javax.management.BadAttributeValueExpException, the object the Metasploit module sends.",
+        "HTTP requests to Retail Assortment Planning, Rapid Planning, the Diameter Signaling Router IDIH component, WebCenter Portal, Healthcare Data Repository, Utilities Framework or Commerce Platform whose body carries a serialized Java object (bytes AC ED 00 05, or rO0AB when Base64 encoded). Oracle lists HTTP as the attack protocol for these products and no source read names the request path, so match on body content rather than on a fixed path or method.",
+        "T3S (T3 over TLS) sessions from untrusted addresses. A network sensor cannot read the serialized object inside them, so only connection metadata is available for those sessions.",
+        "A GET to /console/login/LoginForm.jsp from an untrusted address shortly before a T3 session from the same address. The Metasploit module's check requests that page and reads the WebLogic Server Version: text to decide whether the target is exploitable."
+      ],
+      "host": [
+        "An Oracle Coherence install of the 3.7.1 line at any 3.7.1.x build (Oracle listed the line as 3.7.1.17 before relabeling it 3.7.1.0), or of the 12.1.3.0.0, 12.2.1.3.0 or 12.2.1.4.0 release at any patch level, without the Coherence patch from the January 2020 Critical Patch Update. For an install in an Oracle home, the OPatch inventory (opatch lsinventory) is one way to confirm whether that patch is present.",
+        "A bundling product at a version Oracle lists for this CVE, for example Utilities Framework 4.4.0.2.0 or Commerce Platform 11.3.2, without the patch from the advisory that lists it.",
+        "WebLogic or Coherence server logs holding deserialization stack traces that name javax.management.BadAttributeValueExpException, which a failed or partial attempt can leave behind.",
+        "New files, scheduled tasks or cron entries owned by the account that runs WebLogic or Coherence."
+      ],
+      "_ioc_source_note": "T3 as the attack protocol for Oracle Coherence, the affected Coherence versions and the January 2020 patch come from Oracle's advisory at https://www.oracle.com/security-alerts/cpujan2020.html. The 3.7.1.17 label that the advisory used for the 3.7.1 line before 2020-04-20 comes from the archived copy of that advisory at https://web.archive.org/web/20200310161016id_/https://www.oracle.com/security-alerts/cpujan2020.html. HTTP as the attack protocol for the bundling products, with their component names and versions, comes from Oracle's advisories at https://www.oracle.com/security-alerts/cpujul2020.html, https://www.oracle.com/security-alerts/cpuoct2020.html, https://www.oracle.com/security-alerts/cpujan2021.html and https://www.oracle.com/security-alerts/cpujul2021.html. The serialized javax.management.BadAttributeValueExpException object sent over T3 comes from the Rapid7 listing of the Metasploit module at https://www.rapid7.com/db/modules/exploit/multi/misc/weblogic_deserialize_badattrval/, and the Windows and Unix targets come from the Metasploit module metadata index entry for the same module. Exploit-DB 48320 at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/java/webapps/48320.py and the Metasploit module source at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/misc/weblogic_deserialize_badattrval.rb were also read for detection artifacts only. They send a t3 or t3s handshake followed by the serialized BadAttributeValueExpException object, and the module's check requests GET /console/login/LoginForm.jsp and looks for the text WebLogic Server Version: in the response; the T3 handshake entry and the LoginForm.jsp entry come from those files. The remaining items are general hunting heuristics rather than artifacts read from a source: the default port 7001, the Java serialization header bytes and their Base64 form, the T3S visibility limit, the Java process starting a command interpreter, outbound connections and scan patterns, the OPatch inventory check, log stack traces, and files or scheduled tasks owned by the service account. No published detection rule or scanner template for this CVE was read. No actor infrastructure, file hash or C2 address is listed, because no source consulted attributes this CVE to a named campaign."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Oracle's January 2020 Critical Patch Update credit statement lists Jang from VNPT ISC, working with Trend Micro Zero Day Initiative, for CVE-2020-2555. No source read describes AI tooling in the discovery.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2020-2555 (CWE-502, CVSS 9.8) + CISA KEV (added 2021-11-03) + Oracle advisory Critical Patch Update Advisory, January 2020. That advisory credits Jang from VNPT ISC working with Trend Micro Zero Day Initiative, and Oracle's July 2020, October 2020, January 2021 and July 2021 advisories list the same CVE for products that bundle Coherence.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2020-2555 to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a due date of 2022-05-03 and records known ransomware campaign use as Unknown; the listing is CISA's evidence of exploitation in the wild. The KEV entry does not flag forensic triage, and its required action is to apply updates per vendor instructions. No source read names a campaign, actor or incident report for this CVE. Exploit-DB listed public exploit code on 2020-04-14 (48320) and the Metasploit module on 2020-05-22 (48508), about 18 months before the KEV listing.",
+    "attack_refs": [
+      "T1190",
+      "T1210",
+      "T1059.004",
+      "T1059.003"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires the organization to identify, report and correct system flaws and to install security-relevant software updates within organization-defined time periods of their release. Oracle released the fix for Oracle Coherence 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 on 2020-01-14 and added Coherence 3.7.1 to that advisory on 2020-01-23, but listed the same CVE for products that bundle Coherence in later advisories from July 2020 to July 2021, with Commerce Platform and Access Manager in the advisory of 2021-07-20. A flaw-remediation record keyed to the installed product starts its clock at that product's own advisory, which for Commerce Platform is about 18 months after the Coherence fix and after Exploit-DB listed public exploits on 2020-04-14 (48320) and 2020-05-22 (48508, the Metasploit module).",
+      "NIST-800-53-CM-7": "CM-7 requires the system to provide only essential capabilities and to prohibit or restrict ports, protocols and services that are not needed. Oracle's January 2020 advisory lists T3 as the attack protocol for Oracle Coherence and suggests blocking the protocols an attack requires until the patch is applied, which CM-7 supports wherever T3 is not needed from untrusted networks. The later advisories list HTTP as the attack protocol for the Coherence bundled in Retail Assortment Planning, Rapid Planning, the Diameter Signaling Router IDIH component, WebCenter Portal, Healthcare Data Repository, Utilities Framework and Commerce Platform, and HTTP is the service those applications provide, so restricting protocols does not remove the attack path for those products.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling as part of security in the acquisition, development and maintenance of network and information systems, and sets no timeframe. For entities within the scope of Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available, and additional measures with the residual risk accepted where a patch is not available, without naming those measures. Oracle published CVE-2020-2555 in product risk matrices on several dates: January 2020 for Oracle Coherence, October 2020 for the Diameter Signaling Router IDIH component, January 2021 for Utilities Framework and July 2021 for Commerce Platform. An entity that measures a reasonable time from the advisory for the product it runs starts that measure months after Exploit-DB listed public exploit code for the Coherence flaw (48320, 2020-04-14), and Oracle's interim advice to block the protocols an attack requires does not fit products whose attack protocol is HTTP.",
+      "UK-CAF-B4": "CAF principle B4 (system security) includes a vulnerability-management outcome: the operator manages known vulnerabilities in the network and information systems that support its essential function. For CVE-2020-2555 the vulnerable code is Oracle Coherence embedded in other Oracle products. Oracle's January 2020 advisory lists the CVE only under Oracle Coherence, and the Diameter Signaling Router entry, for its IDIH component 8.0.0 through 8.2.2, appears in the October 2020 advisory. An operator of a DSR-based signaling network that tracks known vulnerabilities by the product it runs would not have matched the January 2020 entry to its DSR deployment, and the outcome-based principle does not state that a component inside a vendor product must be tracked separately.",
+      "AU-Essential-8-Patch": "The Essential Eight patch strategies apply the ISM timeframes for each asset class. A Coherence or WebLogic instance directly accessible over the internet is an online service: at every maturity level it is patched within 48 hours of release when the vendor rates the flaw critical or a working exploit exists (ISM-1876), and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1690). Oracle's CVSS 3.0 score of 9.8 falls in the critical band, so the 48-hour window ran from 2020-01-14 for Coherence 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0, and from no earlier than 2020-01-23 for Coherence 3.7.1, when Oracle added that line to the advisory; both windows closed before Exploit-DB 48320 was published on 2020-04-14. An instance reachable only internally is an other application, patched within one month from Maturity Level Two (ISM-1693), with no timeframe at Maturity Level One. The shortfall is timing for the bundling products: each window starts when Oracle releases the patch for that product, and for an internet-facing Commerce Platform the 48-hour window started on 2021-07-20, about 15 months after Exploit-DB listed public exploit code for the Coherence flaw.",
+      "AU-ISM-1546": "ISM-1546 requires users to be authenticated before they are granted access to a system and its resources. CVE-2020-2555 is reached by an unauthenticated request: Oracle's January 2020 risk matrix marks it remotely exploitable without authentication over T3, the CVSS vector records PR:N, and the Rapid7 listing of the Metasploit module describes unauthenticated code execution by sending a serialized object over T3. Oracle Coherence processes that object without an authentication decision, so a WebLogic domain whose application users all authenticate can satisfy ISM-1546 and still be exploited.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires the organization to obtain information about technical vulnerabilities of the information systems in use, evaluate its exposure and take appropriate measures. Evaluating exposure to CVE-2020-2555 needs the asset register to record Oracle Coherence where another product bundles it: Oracle names the vulnerable component Dynamo Application Framework (Coherence) in Commerce Platform, General (Oracle Coherence) in Utilities Framework and Application Core (Coherence) in Retail Assortment Planning. A register that lists those products without their embedded Coherence cannot match them to the January 2020 advisory, which names only Oracle Coherence 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No source read documents a reload-free path for this fix. Applying the Coherence patch or a bundling product's patch means stopping and restarting the Coherence cache servers and WebLogic servers that load the patched libraries; no source read calls for a host reboot. Oracle's advisories list each version as supported when the advisory was published. Oracle's Lifetime Support Policy for Oracle Fusion Middleware gives the end of Extended Support for Coherence 3.7 as December 2021 and for Coherence 12.1.3 as January 31, 2022, and gives the end of the Coherence 12.2.1.3 error correction period as June 2023. Coherence 3.7.1.0, 12.1.3.0.0 and 12.2.1.3.0 are past those dates and should be replaced by a supported release. No source read states the current support status of the bundling products.",
+    "affected": "Oracle Coherence in Oracle Fusion Middleware, and Oracle products that bundle Coherence: Retail Assortment Planning, Rapid Planning, the IDIH component of Communications Diameter Signaling Router, WebCenter Portal, Healthcare Data Repository, Utilities Framework, Commerce Platform and Access Manager. An unauthenticated attacker who reaches the T3 listener of a WebLogic Server that loads the Oracle Coherence library, or the HTTP interface Oracle lists as the attack protocol for the bundling products, can take over Oracle Coherence and run code with the permissions of its server process. Oracle scores the Access Manager exposure lower, as described with its versions.",
+    "affected_versions": [
+      "Oracle Coherence 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 (Oracle Fusion Middleware, attack protocol T3): fixed by the January 2020 Critical Patch Update, released 2020-01-14.",
+      "Oracle Coherence 3.7.1.0 (Oracle Fusion Middleware, attack protocol T3): fixed by the January 2020 Critical Patch Update, to which Oracle added the 3.7.1 line on 2020-01-23 (listed as 3.7.1.17) and changed the listed version to 3.7.1.0 on 2020-04-20.",
+      "Oracle Retail Assortment Planning 15.0 and 16.0 (Application Core (Coherence)) and Oracle Rapid Planning 12.1 and 12.2 (Middle Tier), attack protocol HTTP: fixed by the July 2020 Critical Patch Update.",
+      "Oracle Communications Diameter Signaling Router IDIH component 8.0.0 through 8.2.2 inclusive, Oracle WebCenter Portal 12.2.1.3.0 and 12.2.1.4.0, and Oracle Healthcare Data Repository 7.0.1, attack protocol HTTP: fixed by the October 2020 Critical Patch Update.",
+      "Oracle Utilities Framework 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 through 4.3.0.6.0 inclusive, 4.4.0.0.0 and 4.4.0.2.0, attack protocol HTTP: fixed by the January 2021 Critical Patch Update.",
+      "Oracle Commerce Platform 11.0.0, 11.1.0, 11.2.0 and 11.3.0 through 11.3.2 inclusive (Dynamo Application Framework (Coherence)), attack protocol HTTP: fixed by the July 2021 Critical Patch Update.",
+      "Oracle Access Manager 11.1.2.3.0 (Installation Component (Oracle Coherence)): fixed by the July 2021 Critical Patch Update. Oracle scores this product's exposure 3.1, over HTTPS from an adjacent network with high privileges, and does not mark it remotely exploitable without authentication.",
+      "Each advisory lists supported versions only, and NVD describes the Coherence versions as the supported versions that are affected, so older unsupported releases of these products are not assessed."
+    ],
+    "vendor_update_paths": [
+      "Oracle Coherence 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0: apply the Coherence patch from Oracle's January 2020 Critical Patch Update (released 2020-01-14). Oracle Coherence 3.7.1.0: apply the Coherence patch from the same advisory, to which Oracle added the 3.7.1 line on 2020-01-23. Find the patches through the Fusion Middleware Patch Availability Document, My Oracle Support Doc ID 2602410.1. The Coherence and WebLogic server processes must be restarted for the patch to take effect. The January 2020 fix was bypassed by CVE-2020-2883, which Oracle fixed for WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 in the April 2020 Critical Patch Update (released 2020-04-14); a WebLogic Server host also needs that update or a later one to close the bypass.",
+      "Oracle Retail Assortment Planning 15.0 and 16.0 and Oracle Rapid Planning 12.1 and 12.2: apply the product patches from the July 2020 Critical Patch Update (released 2020-07-14).",
+      "Oracle Communications Diameter Signaling Router IDIH 8.0.0 through 8.2.2, Oracle WebCenter Portal 12.2.1.3.0 and 12.2.1.4.0, and Oracle Healthcare Data Repository 7.0.1: apply the product patches from the October 2020 Critical Patch Update (released 2020-10-20).",
+      "Oracle Utilities Framework 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 through 4.3.0.6.0, 4.4.0.0.0 and 4.4.0.2.0: apply the product patch from the January 2021 Critical Patch Update (released 2021-01-19).",
+      "Oracle Commerce Platform 11.0.0, 11.1.0, 11.2.0 and 11.3.0 through 11.3.2, and Oracle Access Manager 11.1.2.3.0: apply the product patches from the July 2021 Critical Patch Update (released 2021-07-20). Each advisory's product table links the Patch Availability Document that names the patch.",
+      "Until the patch is applied, restrict T3, T3S and IIOP on WebLogic listen ports to trusted hosts; Oracle lists IIOP and T3 as the attack protocols for the CVE-2020-2883 bypass. Oracle's advisory suggests blocking the network protocols an attack requires, states that this may break application functionality, and states that it does not correct the underlying problem. For the bundling products, where Oracle lists HTTP as the attack protocol, protocol blocking does not remove the attack path."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 70,
+    "rwep_notes": "RWEP 70. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +20, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2021-38648": {
+    "name": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability (CVE-2021-38648)",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-1390"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "OMI's front end, omiengine, runs as the omi user and forwards requests to omiserver, which runs as root, together with an AuthInfo structure that carries the caller's uid and gid. A new connection on the /var/opt/omi/run/omiserver.sock socket starts with that structure set to uid 0 and gid 0, and omiengine forwards a command-execution request that arrives before any authentication exchange, so omiserver processes it as a request from root. Any local user can connect to the socket, so a low-privileged account on a Linux or UNIX host running OMI below 1.6.8-1 can run commands as root, for example through the SCX ExecuteShellCommand provider.",
+    "epss_score": 0.11424,
+    "epss_percentile": 0.95813,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-38648",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-38648",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38648",
+        "severity": "important",
+        "published_date": "2021-09-14"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-38648",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648",
+        "severity": "important",
+        "published_date": "2021-09-14"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-38648",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38648",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
+    ],
+    "source_verified": "2026-09-24",
+    "last_updated": "2026-09-24",
+    "_kev_short_description": "Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.",
+    "type": "auth-bypass-local-privilege-escalation",
+    "blast_radius": 18,
+    "poc_available": true,
+    "poc_description": "A public working exploit exists: the Metasploit local module exploit/linux/local/cve_2021_38648_omigod (modules/exploits/linux/local/cve_2021_38648_omigod.rb in rapid7/metasploit-framework). Rapid7's module listing ties it to CVE-2021-38648 and describes it as sending requests to the local OMI management socket without the authentication exchange, which causes OMI to execute an operating system command as root. Pull request #15802, which added the module, was opened on GitHub on October 27, 2021 and merged on November 9, 2021. Its description says the module finds a Python binary on the host to run its Python exploit and, with the Linux Dropper target, uses the root command to run a payload executable written to disk; its example run writes /tmp/zbACyVFZyT and /tmp/OJ3FZ2W.py and then deletes both. A second Metasploit module with the same title, Microsoft OMI Management Interface Authentication Bypass, is exploit/linux/misc/cve_2021_38647_omigod; it references only CVE-2021-38647 and targets the remote HTTP management endpoint. NVD's exploit reference for this CVE, Packet Storm file 164925, carries that title as well but could not be read, because Packet Storm returned its terms-of-service page, so which of the two modules it holds is unconfirmed. Wiz's write-up describes the local technique in prose and links no exploit code. Rapid7's two module listings and the pull request page were read, including the pull request's title, dates, description, example output, release note and a review comment quoting the README it adds. The module source and its documentation file were also read for detection artifacts only, and the Python exploit was not opened.",
+    "iocs": {
+      "behavioral": [
+        "Commands or scripts executed as root through any of the SCXcore RunAs methods ExecuteCommand, ExecuteShellCommand and ExecuteScript, which run from the working directory /var/opt/microsoft/scx/tmp, at a time when no administrator was running OMI management commands.",
+        "A process other than omicli, or omicli started by a non-administrative account, connecting to the /var/opt/omi/run/omiserver.sock socket. Wiz reports that any local user can connect to that socket; catching the connection needs an auditd or eBPF socket-connect rule, and this entry is a general hunting heuristic built on that architecture.",
+        "A Python interpreter started by a low-privileged account that runs a script from a writable directory (/tmp in the published example run) and connects to /var/opt/omi/run/omiserver.sock. The public Metasploit module runs its Python exploit this way. The exploit replays an OMI ExecuteShellCommand request recorded with omicli, so the command it carries runs as root from /var/opt/microsoft/scx/tmp.",
+        "Root-owned shell activity that follows activity by a low-privileged local account, such as a web application or service account, with no sudo, su or login event linking the two. This is a general hunting heuristic."
+      ],
+      "network": [],
+      "host": [
+        "An installed omi package below 1.6.8-1. Microsoft lists OMI 1.6.8.0 or earlier as vulnerable.",
+        "In the VM extension list or package inventory: OMS Agent for Linux GA v1.13.39 or earlier, Azure Diagnostics (LAD) v4.0.0 through v4.0.5 or v3.0.131 or earlier, or a Linux DSC Agent on the 2.71.x or 2.70.x line below its fixed build, or at 3.0.0.1 or 2.0.0.0.",
+        "The socket /var/opt/omi/run/omiserver.sock and the omiserver (root) and omiengine (omi user) process pair on a host whose inventory does not list OMI, which indicates that another product installed it, such as an Azure VM management extension, System Center Operations Manager for Linux and UNIX monitoring, the DSC agent, or one of the Azure Marketplace images that Microsoft identified as carrying vulnerable OMI. Microsoft's guidance gives a separate update path for each.",
+        "Entries containing Invoke_ExecuteCommand, Invoke_ExecuteShellCommand or Invoke_ExecuteScript in /var/opt/microsoft/scx/log/scx.log. These appear only after logging is raised with /opt/microsoft/scx/bin/tools/scxadmin -log-set all verbose, so the setting must be in place before the activity.",
+        "auditd execve records for commands whose working directory is /var/opt/microsoft/scx/tmp.",
+        "auditd execve records of /bin/sh running a file under /etc/opt/microsoft/scx/conf/tmpdir/ whose name starts with scx, which is where the ExecuteScript method creates its script file.",
+        "auditd file-creation, execve and unlink records in which a low-privileged account writes a .py script and a second file to a writable directory (/tmp by default), the second file runs as root, and both files are then deleted. The public Metasploit module's example run with its Linux Dropper target writes /tmp/zbACyVFZyT and /tmp/OJ3FZ2W.py and then deletes both. Match the sequence of events rather than those example names. Because the files are deleted, the signal depends on audit records collected at the time; a later search of /tmp does not find them."
+      ],
+      "_ioc_source_note": "The socket path /var/opt/omi/run/omiserver.sock, the statement that any local user can connect to it, the omiserver (root) and omiengine (omi user) process pair and the omicli command-execution request come from Wiz's write-up at https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure. The SCXcore ExecuteShellCommand footprint, the /var/opt/microsoft/scx/tmp working directory, the scxadmin logging command, the Invoke_ExecuteShellCommand string in /var/opt/microsoft/scx/log/scx.log, the OMI ports TCP 5985, 5986 and 1270, the products that install OMI and the vulnerable and fixed versions come from Microsoft's guidance at https://web.archive.org/web/2021/https://msrc-blog.microsoft.com/2021/09/16/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/. That guidance names only the ExecuteShellCommand method. The ExecuteCommand and ExecuteScript methods come from the SCXcore README at https://raw.githubusercontent.com/microsoft/SCXcore/master/README.md, their Invoke_ExecuteCommand and Invoke_ExecuteScript log strings from the SCXcore provider source at https://raw.githubusercontent.com/microsoft/SCXcore/master/source/code/providers/SCX_OperatingSystem_Class_Provider.cpp, and the ExecuteScript script file under /etc/opt/microsoft/scx/conf/tmpdir/ and the /var/opt/microsoft/scx/tmp directory for all RunAs methods from Microsoft's Sentinel hunting query at https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Syslog/Hunting%20Queries/SCXExecuteRunAsProviders.yaml. Microsoft wrote its blog detection guidance for commands an attacker executes remotely; it is listed here because Wiz describes the local attack as reissuing the same command-execution request without authentication. The socket-client entry and the unlinked root activity entry are general hunting heuristics, not artifacts read from a source. No network indicator is listed, because this flaw is reached over the local socket /var/opt/omi/run/omiserver.sock. A Linux host listening on TCP 5985, 5986 or 1270 has remote OMI management enabled, which exposes the separate remote flaw CVE-2021-38647 on the same unfixed build; those ports are not an indicator of this CVE. For the public Metasploit module, Rapid7's module listing at https://www.rapid7.com/db/modules/exploit/linux/local/cve_2021_38648_omigod/ and the page of pull request #15802 at https://github.com/rapid7/metasploit-framework/pull/15802 were read. The listing names the local OMI management socket and root command execution. The pull request's description and example output name the Python exploit the module runs and the files it writes to /tmp, runs and deletes, and a review comment on that page quotes the README the pull request adds, which says the replayed messages were recorded from an omicli ExecuteShellCommand call; the Python-interpreter entry and the /tmp file-sequence entry come from that page. The module source modules/exploits/linux/local/cve_2021_38648_omigod.rb and its documentation file were then read from rapid7/metasploit-framework for detection artifacts only. They show the module resolving the socket path from /proc, writing a randomly named Python exploit and, for the Linux Dropper target, a randomly named payload to an operator-chosen writable directory (default /tmp), marking the payload executable with chmod +x and running python, python3 or python2 with a -s argument naming the socket. The Python exploit cve_2021_38648.py was not opened. No actor infrastructure, file hash or command-and-control address is listed, because no source reviewed attributes this CVE to a named campaign."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Microsoft's September 2021 update data acknowledges Shir Tamari and Nir Ohfeld with Wiz.io, and Wiz's disclosure timeline says its research team reported all four OMI flaws to MSRC on June 1, 2021, with MSRC confirming CVE-2021-38648 on July 12, 2021. Neither source mentions AI tooling.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-38648 (no NVD CWE; CWE-1390 from the KEV record, CVSS 7.8) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2021-38648 (Open Management Infrastructure Elevation of Privilege Vulnerability). Reported to MSRC by the Wiz Research Team, an outside firm, so the finder is recorded as a human researcher.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2021-38648 to its Known Exploited Vulnerabilities catalog on 2021-11-03 with a due date of 2021-11-17 and records ransomware use as Unknown; the KEV listing is CISA's evidence of in-the-wild use. Microsoft's Security Update Guide entry, last revised on 2021-09-20, still reads 'Exploited: No' and 'Exploitation Less Likely', so the vendor record does not reflect the KEV listing. No source reviewed names a campaign, actor or incident report for exploitation of this local flaw. Wiz notes that the commit fixing all four OMI flaws was visible in the OMI GitHub repository for over a month before Microsoft published the advisory on September 14, 2021. The KEV entry's forensic-triage flag is No.",
+    "attack_refs": [
+      "T1068",
+      "T1059.004"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires security-relevant updates to be installed within organization-defined time periods, which programs usually set from the vendor's severity and exploitability ratings. Microsoft rated CVE-2021-38648 Important and 'Exploitation Less Likely' with 'Exploited: No', and its record, last revised on 2021-09-20, still shows no exploitation after CISA listed the flaw on 2021-11-03. A program that sets its period from the vendor record alone schedules the OMI 1.6.8-1 update in a routine cycle and has no trigger to shorten it when the flaw is listed.",
+      "NIST-800-53-AC-6": "AC-6 requires users and processes to run with the least privilege their function needs. OMI appears to meet it: the omiengine front end runs as the unprivileged omi user and only omiserver runs as root. Wiz found that omiserver takes the caller's identity from an AuthInfo structure that starts at uid 0 and gid 0 and that omiengine forwards a request sent before authentication, so the request runs as root. A least-privilege review that checks which account each process runs as passes this design while any local account on the host can obtain root.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires essential and important entities to handle vulnerabilities and sets no timeframe. For cloud, managed and managed security service providers within Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches within a reasonable time after they become available. Microsoft updated the Azure-managed extensions itself, but its guidance requires a manual update for on-premises Log Analytics agents, System Center Operations Manager, Azure Stack Hub and standalone OMI. A provider that tracks the extension versions Azure reports can miss OMI below 1.6.8-1 on its on-premises Linux estate, and neither text says how to find a component that another product installs.",
+      "UK-CAF-B2": "CAF principle B2 expects access to systems to be limited to authorized users with appropriate privileges, and assessments usually count who holds root or sudo rights. On a host running OMI below 1.6.8-1, every local account, including the service accounts of other applications on that host, can connect to /var/opt/omi/run/omiserver.sock and have omiserver run a command as root. A B2 review of privileged accounts on such a host understates who can act as root until the OMI update is installed.",
+      "AU-Essential-8-Patch": "The Essential Eight sets patch windows by asset class. The Log Analytics, Azure Diagnostics, Azure Automation and Update Management installs that Microsoft lists as local elevation of privilege, where OMI serves only its local socket, are other applications: patched within one month, from Maturity Level Two only (ISM-1693), with no timeframe at Maturity Level One. An OMI instance that listens on TCP 5985, 5986 or 1270 for remote OMI management, which Microsoft names for on-premises System Center Operations Manager, Azure Automation State Configuration and the Azure Desired State Configuration extension, is also an other application under ISM-1693 when it is reachable only from internal networks, with no timeframe at Maturity Level One. The one-month window from the OMI 1.6.8-1 release on September 8, 2021 closed before CISA's KEV listing on November 3, 2021, so an organization at Maturity Level Two that knew OMI was installed would have patched it before the first documented evidence of exploitation, while an organization at Maturity Level One had no window for any of these installs. The OMS Agent for Linux that Azure Security Center and Azure Sentinel deploy, which Microsoft also lists as local elevation of privilege, is a component of a security product: patched within two weeks at Maturity Levels One and Two (ISM-1691), and at Maturity Level Three within 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1692) and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1901). Where an OMI instance also listens on TCP 5985, 5986 or 1270 and is directly accessible from the internet, it is an online service at every maturity level: two weeks when the vendor rates the flaw non-critical and no working exploit exists (ISM-1690), and 48 hours when the vendor rates it critical or a working exploit exists (ISM-1876). Microsoft rated it Important. A Metasploit module for this flaw was public on GitHub from October 27, 2021, when its pull request was opened, so the working-exploit condition was met from that date, before the KEV listing on November 3, 2021.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires information about technical vulnerabilities in the systems in use to be obtained, exposure evaluated and appropriate measures taken. Wiz reports that Azure services deploy OMI silently and that its use within Azure VMs is almost completely undocumented, and Microsoft states the fixed builds per extension (OMS Agent for Linux GA v1.13.40-0, LAD v4.0.15 and v3.0.135, Linux DSC Agent 2.71.1.25, 2.70.0.30 and 3.0.0.3) as well as for OMI 1.6.8-1. A register that records the Azure extension but not the omi package it installs cannot evaluate the 1.6.8-1 boundary, so A.8.8 works only as far as the asset inventory records bundled components."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No source documents a reload-free path for this fix. Microsoft's guidance says its automatic extension updates were applied without a host reboot, and the update guide marks restart as 'Maybe'. The update replaces the OMI package; the running omiserver and omiengine processes keep the vulnerable code until the OMI service restarts, so confirm the service restarted after the update.",
+    "affected": "Microsoft Open Management Infrastructure (OMI) on Linux and UNIX hosts, including the copies installed by the Azure VM management extensions (Log Analytics Agent, Azure Diagnostics (LAD), Azure Automation, Azure Automation Update Management, Azure Automation State Configuration and the DSC extension, Azure Security Center, Azure Sentinel and the Container Monitoring Solution), by System Center Operations Manager and by Azure Stack Hub, on Azure HDInsight clusters that run Ubuntu 16.04 or have Azure Monitor integration enabled, and in the subset of Azure Marketplace VM images that Microsoft identified as carrying vulnerable OMI. omiserver runs as root, so a local user of any privilege level can run commands as root on the host.",
+    "affected_versions": [
+      "Open Management Infrastructure below 1.6.8-1 (Microsoft lists 1.6.8.0 or earlier as vulnerable; 1.6.8-1 is fixed). This covers the standalone package and the OMI framework used by System Center Operations Manager, the Linux DSC Agent and Azure HDInsight clusters that run Ubuntu 16.04 or have Azure Monitor integration enabled.",
+      "OMS Agent for Linux GA v1.13.39 or earlier, used by the Log Analytics Agent, Azure Automation, Azure Automation Update Management, Azure Security Center and Azure Sentinel (v1.13.40-0 is fixed).",
+      "Azure Diagnostics (LAD) v4.0.0 through v4.0.5 and v3.0.131 or earlier. Microsoft's guidance names LAD v4.0.15 and v3.0.135 as fixed; the update guide's September 2021 data gives v4.0.13 for the 4.x line.",
+      "Linux DSC Agent on the 2.71.x and 2.70.x lines below the fixed builds, and 3.0.0.1 and 2.0.0.0 (2.71.1.25, 2.70.0.30 and 3.0.0.3 are fixed).",
+      "Azure Stack Hub: Azure Monitor, Update and Configuration Management 1.8, 1.8.11, 1.12, 1.12.17, 1.13.27 and 1.13.33 (1.14.02 is fixed per Microsoft's guidance; the update guide lists 1.14.01), and Microsoft Azure Diagnostic Extension for Linux Virtual Machines 3.0.111 and 3.0.121 (3.1.135 is fixed).",
+      "Container Monitoring Solution Docker images with an image ID other than sha256:12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707, which is the fixed image. Microsoft's guidance holds the full product table."
+    ],
+    "vendor_update_paths": [
+      "Update OMI to 1.6.8-1 on every Linux or UNIX host that carries it. Microsoft's guidance requires a manual update for standalone OMI, System Center Operations Manager and on-premises DSC and Log Analytics deployments; it updated the Azure-managed extensions itself.",
+      "Update each extension to its fixed build: OMS Agent for Linux GA v1.13.40-0; Azure Diagnostics (LAD) v4.0.15 or v3.0.135; Linux DSC Agent 2.71.1.25, 2.70.0.30 or 3.0.0.3; on Azure Stack Hub, Azure Monitor, Update and Configuration Management 1.14.02 and Microsoft Azure Diagnostic Extension for Linux Virtual Machines 3.1.135 from the Azure Stack Hub marketplace; and the Container Monitoring Solution image sha256:12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707. On HDInsight clusters where configuration prevented the automatic update, run Microsoft's update script on every cluster node.",
+      "Update manually any VM that Microsoft's automatic deployment left reported as vulnerable. Microsoft's scan script for an Azure subscription reports vulnerable VMs and can patch them with its upgradeOMI parameter.",
+      "For a VM built from one of the Azure Marketplace images that Microsoft identified as carrying vulnerable OMI, follow the Azure Service Health notification Microsoft sent for that image, and either update the omi package on the VM to 1.6.8-1 or move to a new image version from the publisher that carries OMI 1.6.8-1.",
+      "Enable automatic extension upgrade where possible; Microsoft states that its automatic extension updates were applied without a reboot. After any update, confirm the installed omi package is 1.6.8-1 or later and that the OMI service restarted.",
+      "Restricting the OMI ports TCP 5985, 5986 and 1270 to trusted hosts is Microsoft's defense-in-depth step for the remote flaw CVE-2021-38647. It does not affect this flaw, which is reached over the local socket, so the update is the only vendor remedy for it."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 68,
+    "rwep_notes": "RWEP 68. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +18, patch_available -15. Σ factors === rwep_score."
+  },
   "CVE-2026-53266": {
     "name": "Linux Kernel Out-of-Bounds Write Vulnerability (CVE-2026-53266)",
     "cvss_score": 8.8,
@@ -42634,7 +46172,7 @@
     "rwep_notes": "RWEP 56. cisa_kev +25, active_exploitation +20, blast_radius +21, patch_available -15, reboot_required +5. Σ factors === rwep_score."
   },
   "CVE-2017-11826": {
-    "name": "Microsoft Office Remote Code Execution Vulnerability",
+    "name": "Microsoft Office Remote Code Execution Vulnerability (CVE-2017-11826)",
     "cvss_score": 7.8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
     "cwe_refs": [
@@ -100126,7 +103664,7 @@
     "last_verified": "2026-08-08"
   },
   "CVE-2020-14644": {
-    "name": "Oracle WebLogic Server Remote Code Execution Vulnerability",
+    "name": "Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2020-14644)",
     "cvss_score": 9.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
     "cwe_refs": [
@@ -180640,7 +184178,7 @@
     "discovery_attribution_note": "Curated from NVD CVE-2022-41033 (CWE-843, CVSS 7.8) + CISA KEV (added 2022-10-11) + Microsoft vendor advisory."
   },
   "CVE-2022-41082": {
-    "name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
+    "name": "Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2022-41082)",
     "cvss_score": 8,
     "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cwe_refs": [