@blamejs/exceptd-skills 0.21.5 → 0.21.7

package/data/cve-catalog.json

@@ -93,6 +93,463 @@
     },
     "last_threat_review": "2026-05-30"
   },
+  "CVE-2021-1905": {
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2021-1905)",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-416"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables",
+    "epss_score": 0.01543,
+    "epss_percentile": 0.73939,
+    "epss_date": "2026-09-26",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-1905",
+    "vendor_advisories": [
+      {
+        "vendor": "Qualcomm",
+        "advisory_id": "may-2021-bulletin",
+        "url": "https://web.archive.org/web/20220324012231/https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin",
+        "severity": "high",
+        "published_date": "2021-05-03"
+      },
+      {
+        "vendor": "Google",
+        "advisory_id": "2021-05-01",
+        "url": "https://source.android.com/docs/security/bulletin/2021-05-01",
+        "severity": "high",
+        "published_date": "2021-05-03"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-1905",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin"
+    ],
+    "source_verified": "2026-09-27",
+    "last_updated": "2026-09-27",
+    "_kev_short_description": "Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.",
+    "type": "use-after-free-gpu-driver-lpe",
+    "blast_radius": 20,
+    "poc_available": false,
+    "poc_description": "No hosted working exploit for this CVE was found. Google Project Zero published a root-cause analysis of CVE-2021-1905 whose Proof-of-concept and Exploit sample fields both read N/A and which states the analysts did not have access to the exploit sample. The Exploit-DB index, the Metasploit framework repository and the ProjectDiscovery nuclei templates repository hold no entry for this CVE. The only GitHub repository that names it, https://github.com/TAKIANFIF/CVE-2021-1905-CVE-2021-1906-CVE-2021-28663-CVE-2021-28664, is empty and holds no code. What is documented is analysis and vendor and platform advisories, not obtainable exploit code.",
+    "iocs": {
+      "behavioral": [
+        "Any local process, including an untrusted app or a browser process, repeatedly opening the Qualcomm graphics device and forking children after opening the KGSL file descriptor so multiple processes share one GPU mapping, consistent with attempts to trigger the use-after-free",
+        "A local process racing two mappings of the same GPU memory at once, then reusing the freed GPU mapping structure, followed by activity that runs with elevated privileges on the device",
+        "Any local process, including an installed app or a browser process, gaining kernel-level privileges shortly after heavy or unusual use of the GPU memory-mapping interface"
+      ],
+      "network": [],
+      "host": [
+        "An Android device on an affected Qualcomm chipset whose security patch level is earlier than 2021-05-05, which includes a device that reports 2021-05-01",
+        "A Qualcomm Snapdragon chipset from the affected list (spanning Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice and Music and Wearables) reported in the Qualcomm May 2021 bulletin as affected by CVE-2021-1905",
+        "Local access to the Qualcomm Adreno GPU kernel driver (the KGSL interface) by an untrusted process, which is the precondition for triggering the flaw"
+      ],
+      "_ioc_source_note": "The use-after-free mechanism, that a GPU shared mapping with multiple virtual memory areas and a race in the driver's unmapped-area path leave a freed mapping structure reachable, was read from Google Project Zero's root-cause analysis at https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-1905.html. That analysis gives the Android 2021-05-01 security patch level as the first patched version, but the Android Security Bulletin for May 2021, archived at https://web.archive.org/web/20260917102124/https://source.android.com/docs/security/bulletin/2021-05-01, lists CVE-2021-1905 under the 2021-05-05 security patch level, so the patch-level indicator follows the bulletin. The limited, targeted exploitation statement was read from the same bulletin. The affected chipset list, the High rating and the codeaurora patch reference were read from the Qualcomm May 2021 bulletin as archived at https://web.archive.org/web/20220324012231/https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin. All host and behavioral items are general hunting heuristics derived from the mechanism, not artifacts read from an exploit sample; the flaw requires local code execution and has no network indicators. Google TAG's Buying Spying report at https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors_-_TAG_report.pdf attributes 0-day use of this CVE against Android to the tooling of the commercial surveillance vendor Intellexa. No actor infrastructure, file hash or C2 address is listed, because that report names this CVE only in its appendix table and ties no infrastructure, hash or address to it, and no other source consulted ties any of them to this exploit."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Google Project Zero's root-cause analysis lists the reporter as N/A and did not have the exploit sample; no source consulted names a party that found or reported the flaw, and no AI tooling is claimed.",
+    "ai_discovery_source": "unknown",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-1905 (CWE-416, CVSS 7.8) + CISA KEV (added 2021-11-03) + Qualcomm May 2021 security bulletin; no source names the finder, and the Project Zero analysis records the reporter as N/A.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2021-1905 to the KEV catalog on 2021-11-03 with a 2022-05-03 due date and records known ransomware use as Unknown; its forensicTriage flag is No and the required action is to apply updates per vendor instructions. The Android Security Bulletin for May 2021 states there are indications that CVE-2021-1905, together with CVE-2021-1906, CVE-2021-28663 and CVE-2021-28664, may be under limited, targeted exploitation. Google TAG's February 2024 report Buying Spying: Insights into Commercial Surveillance Vendors lists CVE-2021-1905 (Qualcomm Adreno GPU, exploited against Android) in its appendix table of commercial surveillance vendors' products and known 0-day exploits, under the vendor Intellexa, which the table lists with the alias Cytrox and with products including the ALIEN stager and the PREDATOR spyware. The report names CVE-2021-1905 only in that table and gives no campaign dates, targets or exploit chain for it.",
+    "attack_refs": [
+      "T1068"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SC-39": "SC-39 requires the system to maintain a separate execution domain for each executing system process. In the Qualcomm GPU design, several processes can share one GPU address space, such as a child forked after the KGSL file descriptor is opened, so their mappings share one kgsl_mem_entry on which the driver holds no lock, and CVE-2021-1905 is triggered by a state error on that shared structure followed by a race between two such processes mapping it at the same time. An SC-39 assessment of separation between operating-system processes does not test per-process state that a device driver shares across processes by design.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe. For entities within the scope of Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available and, in cases where a patch is not available, requires additional measures with the residual risk accepted, without naming those measures. For CVE-2021-1905 the fix is in the Android 2021-05-05 security patch level, and a handset receives it only when its maker ships that level, so an in-scope entity can hold affected devices for which no patch is available; 6.6.1 does not name gating access on the 2021-05-05 level as an additional measure for that period.",
+      "UK-CAF-B4": "CAF outcome B4.d at Achieved expects announced vulnerabilities for all software packages, network and information systems supporting an essential function to be tracked, prioritized and mitigated, for example by patching, promptly. The Partially achieved level requires prompt mitigation only for externally exposed vulnerabilities and allows some vulnerabilities that are not externally exposed to have temporary mitigations for an extended period. CVE-2021-1905 is a local flaw reached by any local code execution, including an earlier exploit in a chain, so an organization assessed at Partially achieved can keep it under an extended temporary mitigation, such as restricting untrusted app installation, which does not stop a chain that starts with a remote exploit, although the Android Security Bulletin for May 2021 reported indications of limited, targeted exploitation. At Achieved, \"promptly\" is not defined for a flaw whose fix a handset can install only after its maker ships the 2021-05-05 security patch level.",
+      "AU-ISM-0298": "ISM-0298 requires a centralized and managed approach that maintains the integrity of patches or updates and confirms that they have been applied successfully, for applications, operating systems, drivers and firmware. The Android Security Bulletin for May 2021 splits the month into a 2021-05-01 and a 2021-05-05 security patch level and lists this Qualcomm GPU driver fix only under 2021-05-05, so a confirmation that a device's May 2021 update applied successfully passes a device that reports 2021-05-01 and still carries CVE-2021-1905. ISM-0298 checks that an update was applied, not that the applied update contains the fix for a given vulnerability.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities of systems in use is obtained, the organization's exposure is evaluated, and appropriate measures are taken, and it sets no timescale for those measures. For CVE-2021-1905 the Android Security Bulletin for May 2021 reported indications of limited, targeted exploitation, and a handset can install the fix only after its maker ships the 2021-05-05 security patch level, so A.8.8 leaves how long affected devices may stay exposed to a timescale each organization sets for itself."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live patch exists; the fix is delivered as an operating-system security update that requires a device reboot to apply. Qualcomm published the fix in its May 2021 bulletin with a patch referenced on codeaurora, and on Android it is carried by the 2021-05-05 security patch level, not the 2021-05-01 level, but it reaches a given device only when its maker ships the corresponding update, so patch availability from Qualcomm does not mean every affected device can yet install it.",
+    "affected": "Multiple Qualcomm Snapdragon chipsets using the Adreno GPU kernel driver, across Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice and Music and Wearables. An untrusted local process on the device can trigger a use-after-free in the GPU memory-mapping path, which the CVSS vectors from NVD and Qualcomm rate as high impact to confidentiality, integrity and availability.",
+    "affected_versions": [
+      "Qualcomm chipsets listed in the May 2021 security bulletin as affected by CVE-2021-1905, spanning the Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice and Music and Wearables families",
+      "On Android, devices below the 2021-05-05 security patch level are affected, including devices that report 2021-05-01; the Android Security Bulletin for May 2021 lists this fix only in the 2021-05-05 patch level",
+      "On Android devices, including wearables and automotive units that run Android and report an Android security patch level, a device can install the fix only after its maker ships an update carrying the 2021-05-05 patch level; on devices that report no Android security patch level, the fix is the maker's update that integrates Qualcomm's May 2021 fix for CVE-2021-1905 (Android bug A-178809945, Qualcomm QC-CR#2826864). Project Zero and Qualcomm's bulletin give the fix commits in Qualcomm's msm-4.9 kernel tree: d236d315145f8250523ce9e14897d62e5d6639fc, the patch Qualcomm's bulletin lists, and ec3c8cf016991818ca286c4fd92255393c211405, which Project Zero also ties to this flaw; those two ids are the reference only for kernels built from msm-4.9"
+    ],
+    "vendor_update_paths": [
+      "On Android devices, including wearables and automotive units that run Android and report an Android security patch level, install the maker's update that brings the device to the 2021-05-05 security patch level or later, which requires a device reboot; a device that reports 2021-05-01 does not carry this fix. The underlying Qualcomm fix is published in the May 2021 security bulletin with a patch referenced on codeaurora.",
+      "On devices built on the affected chipsets that report no Android security patch level, install the device maker's update that integrates Qualcomm's May 2021 fix for CVE-2021-1905, and check the chipset against the affected list in Qualcomm's May 2021 security bulletin. Where such a device runs a Linux kernel with Qualcomm's KGSL graphics driver, confirm with the maker that the update integrates Qualcomm's fix for CVE-2021-1905 (Android bug A-178809945, Qualcomm QC-CR#2826864), including the locking change Project Zero describes. For a kernel built from Qualcomm's msm-4.9 tree, the reference is the two commits Project Zero considers relevant: d236d315145f8250523ce9e14897d62e5d6639fc, the one Qualcomm's bulletin lists, and ec3c8cf016991818ca286c4fd92255393c211405, the locking change the bulletin does not list. Those ids are given for the msm-4.9 tree, so do not treat their absence from a kernel built from another Qualcomm tree as a missing fix.",
+      "For a managed fleet, gate access to organizational data on the device meeting the 2021-05-05 security patch level and quarantine devices that cannot reach it, since the platform fix depends on each maker shipping an update.",
+      "Where a device maker has not yet shipped the fix, restrict installation of untrusted applications, since the flaw requires local code execution to reach the GPU driver. That restriction does not stop an exploit chain that gains code execution through the browser, so for users who fit a spyware targeting profile, also replace or retire devices that cannot reach the 2021-05-05 security patch level, or keep them away from organizational data."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 55,
+    "rwep_notes": "RWEP 55. cisa_kev +25, active_exploitation +20, blast_radius +20, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2021-20022": {
+    "name": "SonicWall Email Security Unrestricted Upload of File Vulnerability",
+    "cvss_score": 7.2,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-434"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": true,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.",
+    "epss_score": 0.16509,
+    "epss_percentile": 0.96892,
+    "epss_date": "2026-09-26",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-20022",
+    "vendor_advisories": [
+      {
+        "vendor": "SonicWall",
+        "advisory_id": "SNWLID-2021-0008",
+        "url": "https://psirtapi.global.sonicwall.com/api/v1/vulndetail/?advisory_id=SNWLID-2021-0008",
+        "severity": "medium",
+        "published_date": "2021-04-09"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-20022",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0008"
+    ],
+    "source_verified": "2026-09-27",
+    "last_updated": "2026-09-27",
+    "_kev_short_description": "SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.",
+    "type": "zip-slip-file-upload-to-webshell",
+    "blast_radius": 16,
+    "poc_available": false,
+    "poc_description": "No working exploit code is published at a nameable location. Mandiant described the technique, an authenticated administrator uploading a branding-package ZIP whose entries use directory-traversal paths (a Zip Slip attack) to write a BEHINDER JSP web shell into a web-accessible Apache Tomcat directory, but published no exploit code. No Exploit-DB entry, Metasploit module or ProjectDiscovery template for this flaw was found.",
+    "iocs": {
+      "behavioral": [
+        "An administrator session on SonicWall Email Security uploading a branding package immediately followed by requests to a newly present .jsp path under the web root.",
+        "Creation of a web shell in a directory outside the normal branding location on the Email Security server.",
+        "Any child process of the Tomcat web server process on a SonicWall Email Security server or appliance, particularly cmd.exe."
+      ],
+      "network": [
+        "An authenticated upload of a branding-package ZIP archive through the Email Security administrative panel whose entries carry directory-traversal path sequences rather than staying under the branding directory.",
+        "Requests to a .jsp file under the Apache Tomcat webapps tree that no operator placed, in particular POST requests whose body is an opaque base64-encoded or encrypted blob. Mandiant observed the web shell at \\Apache Software Foundation\\Tomcat 9.0\\webapps\\SearchEngineRMIService\\, which is one example location, not the only one.",
+        "A hit on SonicWall firewall IPS signature 15520, WEB-ATTACKS SonicWall Email Security (CVE-2021-20022 Vulnerability)."
+      ],
+      "host": [
+        "A SonicWall Email Security instance running a build before 10.0.9.6103 (Windows software or Hosted Email Security) or before 10.0.9.6105 (hardware or virtual appliance), or any end-of-life 7.0.0 through 9.2.2 release.",
+        "A branding ZIP archive in any subdirectory of data\\branding under the SonicWallES installation directory on a Windows installation, in particular one that the FireEye detections FE_PUP_Exploit_Linux_ZipSlip_1 or FE_Exploit_Win_ZipSlip_1 match.",
+        "Any JSP file in a web-accessible Apache Tomcat directory on the Email Security server that no operator created, in particular one that a FireEye BEHINDER detection (FE_Webshell_JSP_BEHINDER_1, FEC_Webshell_JSP_BEHINDER_1, Webshell.JSP.BEHINDER or Webshell.JSP.BEHINDER.MVX) matches."
+      ],
+      "_ioc_source_note": "The branding-package ZIP upload, the Zip Slip directory-traversal entries, the normal \\data\\branding extraction directory, the BEHINDER JSP web shell written to \\Apache Software Foundation\\Tomcat 9.0\\webapps\\SearchEngineRMIService\\, the web shell's AES-encrypted and base64-encoded commands carried in HTTP request bodies, the branding ZIP location to review, the FireEye detection names and the advice to monitor child processes of Tomcat, particularly cmd.exe, come from the Mandiant analysis at https://cloud.google.com/blog/topics/threat-intelligence/zero-day-exploits-in-sonicwall-email-security-lead-to-compromise/. Mandiant lists the branding directory as C:\\Program Files\\SonicWallES\\data\\branding, while the log-clearing command it recorded on the compromised host wrote to C:/Program Files (x86)/SonicWallES/logs/webUI/webui.json, so the branding path is given relative to the SonicWallES installation directory. Mandiant lists the detection names together; the ZipSlip names are paired here with the ZIP archive and the BEHINDER names with the JSP file according to what each name describes. IPS signature 15520 comes from the SonicWall notice at https://www.sonicwall.com/support/product-notification/security-notice-sonicwall-email-security-zero-day-vulnerabilities/kA1VN0000000Qyr0AE. The version boundaries come from the NVD record and SonicWall advisory SNWLID-2021-0008 at https://psirtapi.global.sonicwall.com/api/v1/vulndetail/?advisory_id=SNWLID-2021-0008. Two items are hunting heuristics derived from that analysis rather than artifacts read from it: a branding upload immediately followed by a request to a new .jsp path, and a web shell outside the branding location. No specific actor infrastructure, file hash or command-and-control address is listed: Mandiant tracked the activity as UNC2682 without publishing actor indicators for this flaw, and while the KEV record marks known ransomware use as Known, the Mandiant report names no ransomware family for this chain."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Mandiant identified the flaw in March 2021 while investigating web shell activity, and SonicWall advisory SNWLID-2021-0008 credits Josh Fleischer and Chris DiGiamo of Mandiant, an outside firm. No source claims AI tooling was used.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-20022 (CWE-434, CVSS 7.2) + CISA KEV (added 2021-11-03, ransomware: Known) + SonicWall advisory SNWLID-2021-0008 at https://psirtapi.global.sonicwall.com/api/v1/vulndetail/?advisory_id=SNWLID-2021-0008, which credits Josh Fleischer and Chris DiGiamo of Mandiant.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2021-20022 to its Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2021-11-17 due date and records known ransomware use as Known. Mandiant documented one compromise, found in March 2021 on an internet-accessible SonicWall Email Security installation running on Windows Server 2012, and tracks the activity as UNC2682. The attacker obtained an administrator session through CVE-2021-20021, used this upload flaw to plant a BEHINDER web shell, and used it with CVE-2021-20023 in the same intrusion. SonicWall states that the flaws were exploited in at least one known case. The KEV record marks forensic triage as No, so BOD 26-04 forensic-triage handling is not required for this entry.",
+    "attack_refs": [
+      "T1190",
+      "T1505.003",
+      "T1059"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-10": "SI-10 requires the system to check the validity of defined information inputs. The input check that failed here, confining the paths of entries in an uploaded branding ZIP to \\data\\branding, sits in SonicWall's code, and an organization that runs Email Security cannot add or change it. On builds before 10.0.9.6103 and 10.0.9.6105 the branding feature wrote a BEHINDER JSP web shell into a web-accessible Apache Tomcat directory, so the organization met SI-10 for this input only by installing the vendor's hotfix.",
+      "NIS2-Art21-network-security": "NIS2 Article 21(2)(a) requires policies on risk analysis and information system security, and Article 21(2)(e) requires security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure; neither point sets a method for rating a flaw. SonicWall rates this flaw medium, and exploiting it needs an administrator session, but the attacker Mandiant tracked obtained that session through CVE-2021-20021 and used this flaw to write a web shell that, on the Windows Server installation Mandiant examined, ran with the NT AUTHORITY\\SYSTEM rights of the Apache Tomcat process, so an assessment of this flaw on its own rating understates what it gave the attacker.",
+      "UK-CAF-B4": "CAF principle B4.d asks that externally exposed vulnerabilities are mitigated promptly, for example by patching, and that temporary mitigations are in place for unsupported systems and software. The outcome does not define 'promptly' against a flaw exploited before its fix exists: Mandiant found this upload flaw used in March 2021, SonicWall published the hotfix on April 9, 2021, and installing the hotfix does not remove a web shell written before it. For the unsupported Email Security 7.0.0 through 9.2.2 releases SonicWall provides no fix in that line, and the IPS signature it deployed for this flaw (15520) runs only on SonicWall firewalls with active security subscriptions.",
+      "AU-Essential-8-Patch": "Under the Essential Eight, the Windows software is an online service when an instance is directly accessible over the internet, and at every maturity level patches, updates or other vendor mitigations for an online service are applied within 48 hours of release when the vendor rates the flaw critical or a working exploit exists (ISM-1876), and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1690). SonicWall rates this flaw medium, but it was exploited in the wild, so a working exploit exists and an internet-facing instance of the Windows software falls under ISM-1876: 48 hours from the April 9, 2021 hotfix, with the build that closes the chain with CVE-2021-20023 released on April 19, 2021. The ISM's patching controls do not define 'security products', and the catalog also uses the term for network-based security products. Mandiant describes Email Security as an email security solution, so an instance of the Windows software reachable only internally can be classed as a security product, patched within two weeks at Maturity Levels One and Two (ISM-1691) and, at Maturity Level Three, within 48 hours because a working exploit exists (ISM-1692). If it is classed instead as an other application, it is patched within one month from Maturity Level Two only (ISM-1693). The hardware and virtual appliances take the appliance Hotfix 10.0.9.6105, which SonicWall ships as appliance firmware, and are network devices: an internet-facing appliance falls under ISM-1877, 48 hours at every maturity level when the vendor rates the flaw critical or a working exploit exists, and an appliance reachable only internally is patched within one month at Maturity Levels One and Two (ISM-1695) and, at Maturity Level Three, within 48 hours because a working exploit exists (ISM-1696). An internet-facing instance on the unsupported 7.0.0 through 9.2.2 releases must be replaced or removed (ISM-1905). SonicWall ends support for every Email Security product on May 1, 2027, and from that date the unsupported-product controls apply at every maturity level to instances on every release, not only to 7.0.0 through 9.2.2: an internet-facing instance is removed (ISM-1905), an internal instance of the Windows software classed as a security product is removed (ISM-1704), and an appliance's operating system is replaced (ISM-1501). Mandiant found the flaw exploited in March 2021, before SonicWall published any fix, and no window covers that period.",
+      "ISO-27001-2022-A.8.28": "A.8.28 requires secure coding principles to be applied to software development. Checking that each entry extracted from an uploaded archive resolves inside its target directory is an established defense against Zip Slip, and applied to the branding feature, which normally extracts packages to \\data\\branding, it would have stopped the traversal write of the BEHINDER web shell into the Apache Tomcat directory, so the control is adequate where the developer applies it."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Fixed builds exist for the 10.0.x line: Hotfix 10.0.9.6103 for Email Security on Windows and for Hosted Email Security, and Hotfix 10.0.9.6105 for hardware and ESXi virtual appliances, close this flaw. 10.0.9.6173 (Windows and Hosted Email Security, which SonicWall patched on April 19, 2021) and 10.0.9.6177 (hardware and ESXi virtual appliance) close the exploited chain with CVE-2021-20021 and CVE-2021-20023. Email Security 7.0.0 through 9.2.2 is also affected, is end of life and unsupported, and has no fix in that line. SonicWall has since put every Email Security product into end of life: it ended sales on April 30, 2026, support ends on May 1, 2027, and it encourages customers to migrate to cloud-based email and use Avanan (https://www.sonicwall.com/blog/partner-power-news-may-2026-protection-transition-scale). A SonicWall partner's copy of the end-of-life notice (https://www.sonicwall-sales.com/news/end-of-life-announcement-sonicwall-email-security.html) states that the software, the physical and virtual appliances and Hosted Email Security entered Limited Retirement Mode on May 1, 2026, and that the Hosted Email Security service will be shut down on May 2, 2027. SonicWall's lifecycle table (https://www.sonicwall.com/support/product-lifecycle-tables/Email-Security/Hardware) limits software and firmware support in Limited Retirement Mode to critical bugs and vulnerabilities. No live-patch path is documented. SonicWall's upgrade article, which its security notice names as the guidance for applying these updates, says the appliance reboots once the update is done and that mail flow stops during the update, so about 30 minutes of downtime should be scheduled. SonicWall's article on upgrading Email Security software says the Windows server reboots as part of the upgrade, which can take 10 to 20 minutes, and that the update package is applied through the Email Security web interface (Manage, Firmware Update, Apply Patch).",
+    "affected": "SonicWall Email Security, on-premises (software for Windows, hardware appliances and the virtual appliance) and Hosted (HES): builds before 10.0.9.6103 (Windows software and HES) and before 10.0.9.6105 (appliances), and the end-of-life 7.0.0 through 9.2.2 releases. An attacker who already holds an administrator session uploads a crafted branding-package ZIP archive whose entries use directory-traversal paths, writing an arbitrary file such as a JSP web shell into a web-accessible Apache Tomcat directory.",
+    "affected_versions": [
+      "SonicWall Email Security software for Windows and Hosted Email Security, builds before 10.0.9.6103 (fixed in Hotfix 10.0.9.6103; Hosted Email Security was updated automatically). The exploited chain with CVE-2021-20021 and CVE-2021-20023 stays open before 10.0.9.6173.",
+      "SonicWall Email Security hardware appliances (models 3300, 4300, 5000, 5050, 7000, 7050, 8300 and 9000 in the NVD record) and the virtual appliance, builds before 10.0.9.6105 (fixed in Hotfix 10.0.9.6105). The exploited chain stays open before 10.0.9.6177.",
+      "SonicWall Email Security 7.0.0 through 9.2.2, which is end of life, is unsupported and has no fix in that line."
+    ],
+    "vendor_update_paths": [
+      "Upgrade on-premises SonicWall Email Security for Windows to Hotfix 10.0.9.6103, and hardware or ESXi virtual appliance installations to Hotfix 10.0.9.6105, from MySonicWall; these builds close CVE-2021-20022. To close the exploited chain with CVE-2021-20021 and CVE-2021-20023, install 10.0.9.6173 (Windows software) or 10.0.9.6177 (hardware and ESXi virtual appliance), released on April 19, 2021.",
+      "Hosted Email Security is updated automatically by SonicWall, to 10.0.9.6103 for this flaw and to 10.0.9.6173 on April 19, 2021 for the full chain, and no customer action is required.",
+      "Email Security 7.0.0 through 9.2.2 is end of life and receives no fix in that line. Organizations with an active support license can download the latest Email Security release from MySonicWall and upgrade to a build at or above 10.0.9.6173 (Windows) or 10.0.9.6177 (appliance). An end-of-life Windows software installation, hardware appliance or virtual appliance must step through each version in SonicWall's firmware upgrade path (https://www.sonicwall.com/en-us/support/knowledge-base/180511141925681) without skipping one. SonicWall's article on upgrading the Windows software (https://www.sonicwall.com/support/knowledge-base/how-do-i-upgrade-firmware-on-an-email-security-software/kA1VN0000000PT30AM) gives the same caution and refers to that upgrade path, and SonicWall warns that skipping a version can corrupt files and leave the appliance unusable. SonicWall supports firmware 9.2.x and later only on 64-bit platforms, so an appliance on a 32-bit platform cannot reach a fixed build and must be replaced to close this CVE, and a Windows installation on a 32-bit server must move to a 64-bit server before it can reach 10.0.9.6173. SonicWall ended sales of all Email Security products on April 30, 2026 and encourages customers to migrate to cloud-based email and use Avanan, and an instance upgraded to 10.0.9.6173 or 10.0.9.6177 loses support on May 1, 2027.",
+      "Because this file-upload flaw is reached after the CVE-2021-20021 authentication bypass and is used to plant a web shell, check each instance for compromise in addition to applying the hotfix: review the branding ZIP archives in the subdirectories of data\\branding under the SonicWallES installation directory for entries with directory-traversal paths, look for any file in the web-accessible Apache Tomcat directories that no operator placed or changed, not only new .jsp files, and review the Apache Tomcat logs under Apache Software Foundation\\Tomcat 9.0\\logs in the installation directory. Rebuild a compromised instance and rotate the credentials it held, including the Active Directory credentials the application uses."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 16,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 51,
+    "rwep_notes": "RWEP 51. cisa_kev +25, active_exploitation +20, blast_radius +16, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2021-22893": {
+    "name": "Ivanti Pulse Connect Secure Use-After-Free Vulnerability",
+    "cvss_score": 10,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-287",
+      "CWE-416"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": true,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.",
+    "epss_score": 0.47172,
+    "epss_percentile": 0.98784,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-22893",
+    "vendor_advisories": [
+      {
+        "vendor": "Pulse Secure",
+        "advisory_id": "SA44784",
+        "url": "https://web.archive.org/web/20230325032400/https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/",
+        "severity": "critical",
+        "published_date": "2021-04-20"
+      },
+      {
+        "vendor": "Pulse Secure",
+        "advisory_id": "Pulse Connect Secure Security Update",
+        "url": "https://web.archive.org/web/20210421235930/https://blog.pulsesecure.net/pulse-connect-secure-security-update/",
+        "severity": "unknown",
+        "published_date": "2021-04-20"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-22893",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://blog.pulsesecure.net/pulse-connect-secure-security-update/",
+      "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/"
+    ],
+    "source_verified": "2026-09-27",
+    "last_updated": "2026-09-27",
+    "_kev_short_description": "Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.",
+    "type": "use-after-free-auth-bypass-rce",
+    "blast_radius": 18,
+    "poc_available": false,
+    "poc_description": "No functional public exploit was confirmed. Several GitHub repositories are named for CVE-2021-22893. ZephrFish/CVE-2021-22893_HoneyPoC2 states in its README that it is not a real exploit but a HoneyPoC; DarkFunct/CVE-2021-22893 is a fork of it; orangmuda/CVE-2021-22893 is a separate repository, not a fork, whose script was not verified; and MRLEE123456/CVE-2021-22893 holds only a placeholder file. No Exploit-DB entry, Metasploit module or ProjectDiscovery nuclei template for CVE-2021-22893 was located, and Mandiant and CERT/CC document exploitation in the wild without hosting exploit code.",
+    "iocs": {
+      "behavioral": [
+        "Authentication succeeding on the Pulse Connect Secure gateway without valid credentials, or multifactor prompts being bypassed, the effect of the trojanized libdsplibs.so that Mandiant tracks as SLOWPULSE.",
+        "Persistence surviving an appliance upgrade, and on-device log files being cleared by a utility Mandiant tracks as THINBLOOD."
+      ],
+      "network": [
+        "Unauthenticated requests to the appliance license-server handling endpoints, which are reachable whether or not the license-server role is configured.",
+        "Unauthenticated Requests Log entries carrying shell commands in an id parameter, for example id=cat%20/home/webserver/htdocs, which CISA alert AA21-110A shows as post-exploitation webshell use rather than the exploit request itself.",
+        "Requests matching the URI patterns the vendor Workaround-2104.xml blocks: ^/+dana/+meeting, ^/+dana/+fb/+smb, ^/+dana-cached/+fb/+smb, ^/+dana-ws/+namedusers and ^/+dana-ws/+metric."
+      ],
+      "host": [
+        "Modified legitimate Pulse files carrying webshell logic, listed with MD5 values in CISA alert AA21-110A, including DSUpgrade.pm, Licenseserverproto.cgi, Secid_canceltoken.cgi, compcheckresult.cgi (MD5 ca0175d86049fa7c796ea06b413857a3), Login.cgi and Healthcheck.cgi.",
+        "The Pulse Connect Secure Integrity Checker Tool reporting file additions or mismatches, which the vendor advisory treats as evidence of compromise."
+      ],
+      "_ioc_source_note": "The unauthenticated license-server reachability, the root-privilege execution and that the license-server role is not a prerequisite come from CERT/CC Vulnerability Note VU#213092 at https://kb.cert.org/vuls/id/213092; the Integrity Checker Tool guidance and the Workaround-2104.xml URI patterns come from Ivanti advisory SA44784 at https://web.archive.org/web/20230325032400/https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/. The webshell file names and MD5 values and the id-parameter example come from CISA alert AA21-110A at https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-110a, which attributes its file artifacts to an unnamed cyber threat actor. The SLOWPULSE and THINBLOOD names and behaviors come from the Mandiant report at https://cloud.google.com/blog/topics/threat-intelligence/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day/, which lists both among the families used by UNC2630, an actor it suspects operates on behalf of the Chinese government and may have ties to APT5; the report also tracks a second actor, UNC2717, and says it cannot associate all the code families it describes with either actor. The MD5 list is from AA21-110A's unattributed intrusions and no hash is presented as unique to CVE-2021-22893 alone."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Pulse Secure's own investigation determined that a previously unknown vulnerability, discovered in April 2021, was part of the initial infection vector; the forensic firms Mandiant/FireEye and Stroz Friedberg and the U.S. agency CISA assisted the investigation. No source claims AI tooling.",
+    "ai_discovery_source": "vendor_research",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-22893 (CWE-287 and CWE-416, CVSS 10) + CISA KEV (added 2021-11-03, ransomware: Known) + Pulse Secure advisory SA44784 and the vendor security-update blog; Pulse Secure's own investigation found the flaw in April 2021, with Mandiant, CISA and Stroz Friedberg assisting, so this is a vendor_research finding.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added this to its Known Exploited Vulnerabilities catalog on 2021-11-03 and records known ransomware use as Known; the forensic-triage flag is not set. The flaw was a zero-day that Pulse Secure's investigation found in April 2021 while examining in-the-wild intrusions. Mandiant reports intrusions at defense, government and financial organizations around the world, and assesses that UNC2630, which it suspects operates on behalf of the Chinese government and may have ties to APT5, targeted U.S. defense industrial base companies as early as August 2020. CISA Emergency Directive ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) required federal agencies to run the Integrity Checker Tool and mitigate this CVE.",
+    "attack_refs": [
+      "T1190",
+      "T1556",
+      "T1505.003"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires flaws to be identified, reported and corrected, and security-relevant updates to be installed within an organization-defined time period of their release. For CVE-2021-22893 that period runs from the release of 9.1R11.4 on 2021-05-03 (SA44784). SI-2 therefore sets no requirement for the time the flaw was exploited as a zero-day before disclosure, and it does not require importing the Workaround-2104.xml that Pulse Secure published on 2021-04-20, because that file is a configuration change rather than a software or firmware update.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe. For entities within the scope of Commission Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available and requires that \"additional measures are implemented and residual risks are accepted in cases where a patch is not available or not applied pursuant to point 6.6.2\", but it does not name those measures or set a time for applying them. CVE-2021-22893 was exploited before Pulse Secure published any fix or mitigation, and point 6.6.1 sets no date by which the Workaround-2104.xml, published on 2021-04-20, had to be imported before 9.1R11.4 shipped on 2021-05-03.",
+      "UK-CAF-C1": "CAF C1.a asks that the data sources included in logging and monitoring allow for timely identification of events that might adversely affect the essential function, and C1.b treats log data that unauthorized users or attackers can easily edit or delete as not achieved. C1 is outcome-based and does not name device logging defaults, so an operator can assess C1.a against the Pulse Connect Secure gateway's default logs, which do not record unauthenticated web requests, although CERT/CC notes that evidence of exploiting this unauthenticated flaw may only be present if the Unauthenticated Requests logging option is enabled.",
+      "AU-ISM-1546": "ISM-1546 requires users to be authenticated before they are granted access to a system and its resources, and is met by configuring authentication in front of a system. It does not reach a flaw in the appliance's own code: the license-server handling endpoints of Pulse Connect Secure are present whether or not the license-server role is configured, and the use-after-free grants an unauthenticated request root code execution on a gateway whose authentication configuration otherwise satisfies the control.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities of systems in use is obtained, the organization's exposure is evaluated, and appropriate measures are taken. It can act only on vulnerability information once that information exists, and for CVE-2021-22893 none existed until Pulse Secure published SA44784 on 2021-04-20, while the flaw was already being exploited. From 2021-04-20 until 9.1R11.4 shipped on 2021-05-03, the vendor mitigation available was the Workaround-2104.xml. Because the actor persisted across upgrades, installing 9.1R11.4 does not by itself clear a device that was already compromised."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free path exists for the fix. Remediation is the Pulse Connect Secure 9.1R11.4 upgrade (advisory SA44784), which requires running the Integrity Checker Tool first and reboots the appliance during the service-package install. The vendor Workaround-2104.xml is an interim mitigation that blocks the meeting, file-share and license-server URI patterns and takes effect without a reboot, but the vendor states it does not work on builds 9.0R1 through 9.0R4.1 or 9.1R1 through 9.1R2 (upgrade before importing it), it is not recommended for an appliance used as a license server, and below 9.1R9 the appliance stays exposed to older flaws even with the XML applied, so it does not remove the flaw. The affected PCS 9.1x line reached end of support on 2024-12-31 and receives no further code changes.",
+    "affected": "Pulse Connect Secure (PCS) VPN gateway. A use-after-free reachable through the license-server handling endpoints lets a remote, unauthenticated attacker execute code as root; CERT/CC states the endpoints are present whether or not the appliance is configured as a license server. Paired with the Windows File Share Browser and Pulse Secure Collaboration features it forms an authentication bypass to remote code execution on the gateway.",
+    "affected_versions": [
+      "Pulse Connect Secure 9.0R3 and later 9.0Rx, and 9.1R1 through 9.1R11.3, are affected per the vendor (fixed in 9.1R11.4); NVD also lists 9.0R1 through 9.0R2.1",
+      "Applying 9.1R11.4 requires running the Pulse Connect Secure Integrity Checker Tool first, per advisory SA44784",
+      "Pulse Connect Secure was later rebranded Ivanti Connect Secure; the PCS 9.1x line reached end of support on 2024-12-31 and receives no further code changes"
+    ],
+    "vendor_update_paths": [
+      "Run the Pulse Connect Secure Integrity Checker Tool, then upgrade to 9.1R11.4 (advisory SA44784). The tool reboots the appliance when it finishes, so take a snapshot of a virtual appliance before running it; installing the service package also reboots the appliance.",
+      "As an interim measure that needs no reboot, import the vendor Workaround-2104.xml, which blocks the meeting, file-share and license-server URI patterns; the vendor states it does not work on builds 9.0R1 through 9.0R4.1 or 9.1R1 through 9.1R2 (upgrade before importing), and below 9.1R9 the appliance remains exposed to older flaws even with the XML, so move to 9.1R9 or later with the XML or to 9.1R11.4. For an appliance used as a license server, do not rely on the XML; upgrade to 9.1R11.4 or restrict which source addresses can reach it.",
+      "Because the actor persisted across upgrades, treat an appliance on which the Integrity Checker Tool finds hash mismatches or new files as compromised: isolate it from the network with the power on and have the vendor help capture memory and disk forensic images, then disable the external interface, save the system and user configuration, factory-reset it through the serial console, upgrade to 9.1R11.4, re-import the saved configuration, and change the passwords of every account that passed through the appliance before returning it to service. The vendor's rollback step (roll back, run the tool on the prior version, and upgrade again if it is clean) applies only to an appliance upgraded to 9.1R11.4 without running the current Integrity Checker Tool.",
+      "On the end-of-support PCS 9.1x line, migrate to a supported Ivanti Connect Secure release rather than remaining on firmware that receives no further code changes."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 53,
+    "rwep_notes": "RWEP 53. cisa_kev +25, active_exploitation +20, blast_radius +18, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2021-38645": {
+    "name": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-290",
+      "CWE-362"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "The omiengine frontend of Open Management Infrastructure accepts connections from any local user on the world-writable UNIX socket /var/opt/omi/run/omiserver.sock and handles messages from clients and from the root-running omiserver the same way, without checking that an authentication response came from omiserver. A local low-privileged process can pose as omiserver and send the omiengine an authentication-success response carrying uid 0 and gid 0 for a client connection it also opened, identified by a small socket id, ahead of the real response. The omiengine then records that connection as authenticated as root, and commands issued on it, such as SCX ExecuteShellCommand requests, run as root on the host.",
+    "epss_score": 0.02727,
+    "epss_percentile": 0.85448,
+    "epss_date": "2026-09-23",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-38645",
+    "vendor_advisories": [
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-38645",
+        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38645",
+        "severity": "important",
+        "published_date": "2021-09-14"
+      },
+      {
+        "vendor": "Microsoft",
+        "advisory_id": "CVE-2021-38645",
+        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38645",
+        "severity": "important",
+        "published_date": "2021-09-14"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-38645",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38645",
+      "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38645"
+    ],
+    "source_verified": "2026-09-27",
+    "last_updated": "2026-09-27",
+    "_kev_short_description": "Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.",
+    "type": "authentication-spoofing-local-privilege-escalation",
+    "blast_radius": 18,
+    "poc_available": false,
+    "poc_description": "No public working exploit was found for CVE-2021-38645. The NVD record's references carry no Exploit tag, Microsoft's September 2021 security update data lists the flaw as not publicly disclosed at release, and a GitHub repository search for the CVE id returned no repositories. Wiz's disclosure write-up explains the root cause with excerpts of the OMI source code; no location hosting working exploit code for this CVE was found, and no exploit repository was read. The public OMIGOD exploitation activity that Microsoft reported concerns the remote-code-execution sibling CVE-2021-38647.",
+    "iocs": {
+      "behavioral": [
+        "A process owned by an account other than root or omi opening repeated connections in quick succession to the UNIX socket /var/opt/omi/run/omiserver.sock. Wiz documents that any local user can write to this socket and that the escalation depends on a local client posing as omiserver and guessing a connection's socket id, which Wiz says is usually below 10.",
+        "Any process running as uid 0 with the working directory /var/opt/microsoft/scx/tmp, on a host where no Operations Manager or Azure management action was scheduled. The SCXcore RunAs provider starts commands from that directory for all three of its classes: ExecuteCommand, which Microsoft describes as running a native UNIX/Linux command, and ExecuteShellCommand and ExecuteScript, which Microsoft describes as using the /bin/sh shell. Microsoft's published hunting query keeps only events whose process name is sh, so it misses a native binary that ExecuteCommand starts without a shell.",
+        "A low-privileged local account obtaining a root shell, or creating root-owned files, with no corresponding sudo, su or login event for root."
+      ],
+      "network": [
+        "An exposure check for the remote sibling CVE-2021-38647 that does not detect CVE-2021-38645: inbound connections to TCP 5985, 5986 or 1270 on a Linux host running OMI. Microsoft names these as the OMI listening ports and reports exploitation attempts against 5986 and 1270 for CVE-2021-38647. CVE-2021-38645 itself runs over a local socket and produces no network request."
+      ],
+      "host": [
+        "An OMI package below version 1.6.8-1 (Microsoft's table lists vulnerable builds as 1.6.8.0 or less), checked with the platform package manager on each Linux or UNIX host, including hosts where OMI was installed by an Azure VM extension or by Operations Manager.",
+        "OMS Agent for Linux at GA v1.13.39 or earlier, Linux Diagnostic extension (LAD) v4.0.0 through v4.0.5 or v3.0.131 and earlier, or a Linux DSC agent build below 2.71.1.25, 2.70.0.30 or 3.0.0.3.",
+        "Lines containing Invoke_Execute in /var/opt/microsoft/scx/log/scx.log, visible after verbose logging is enabled with /opt/microsoft/scx/bin/tools/scxadmin -log-set all verbose. Microsoft's guidance says to grep for Invoke_ExecuteShellCommand, which matches one of the three RunAs classes; the SCXcore provider source also logs Invoke_ExecuteCommand and Invoke_ExecuteScript lines for the other two.",
+        "Execution records for the scripts that the ExecuteScript RunAs provider writes under /etc/opt/microsoft/scx/conf/tmpdir/ with the prefix scx (for example scxzOy96), or under /tmp/ when that directory does not exist. SCXcore deletes each script file as soon as it has run, on both the success and the error path, so a later listing of the directory does not show that a script ran. Look instead in execve or AUOMS records for a command line similar to /bin/sh /etc/opt/microsoft/scx/conf/tmpdir/scx*, as Microsoft's hunting post gives it, or, on a host where an audit watch was already set on that directory, in its file-creation records.",
+        "An Azure Service Health event in the AzureActivity log whose properties name CVE-2021-38645. Microsoft sent these notices to subscriptions with affected VMs, and its Sentinel hunting post gives a query that filters CategoryValue == 'ServiceHealth' on that CVE id.",
+        "A Container Monitoring Solution Docker image whose SHA ID differs from the fixed image sha256:12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707.",
+        "Repeated crashes of the omiengine process on a host running OMI below 1.6.8-1. Wiz reports that a separate use-after-free in the code path this escalation uses keeps crashing the omiengine during exploitation."
+      ],
+      "_ioc_source_note": "The world-writable /var/opt/omi/run/omiserver.sock socket, the forged authentication response, the guessable socket id and the omiengine crashes caused by a separate use-after-free come from Wiz's disclosure at https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure, of which the architecture, root-cause and exploitation sections were read; Wiz does not say how an omiengine crash appears in a host's logs. The vulnerable and fixed versions, the Container Monitoring Solution image SHA, the scx.log and scxadmin logging guidance with its Invoke_ExecuteShellCommand search, and the OMI ports come from Microsoft's Additional Guidance post at https://web.archive.org/web/20211230015313/https://msrc-blog.microsoft.com/2021/09/16/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/. The three RunAs classes and Microsoft's description of each, the /var/opt/microsoft/scx/tmp working directory, the scx-prefixed scripts under /etc/opt/microsoft/scx/conf/tmpdir/ and the execve command line that shows them, the Service Health query and the exploitation attempts on ports 5986 and 1270 come from Microsoft's Sentinel hunting post at https://web.archive.org/web/20211230015313/https://techcommunity.microsoft.com/t5/azure-sentinel/hunting-for-omi-vulnerability-exploitation-with-azure-sentinel/ba-p/2764093. The Invoke_ExecuteCommand and Invoke_ExecuteScript log lines come from the SCXcore provider source at https://raw.githubusercontent.com/microsoft/SCXcore/master/source/code/providers/SCX_OperatingSystem_Class_Provider.cpp, and the use of one configured working directory by all three RunAs classes, the /tmp/ script fallback and the deletion of each script file after it runs, on the success and the error path, come from the RunAs provider source at https://raw.githubusercontent.com/microsoft/SCXcore/master/source/code/providers/support/runasprovider.cpp; both files are Microsoft's product source, not exploit code. The sh process-name filter in Microsoft's hunting query comes from the published rule at https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Syslog/Hunting%20Queries/SCXExecuteRunAsProviders.yaml. The network item is an exposure check for CVE-2021-38647 and does not detect CVE-2021-38645. Two entries and one part of a third are general hunting heuristics rather than artifacts read from a source: the burst of connections to omiserver.sock from an account other than root or omi (derived from Wiz's description of the flaw, not from a published rule), root access without a matching sudo, su or login event, and, in the script entry, the file-creation records of an audit watch on the tmpdir directory. No exploit repository was read. That Sentinel post lists scanning addresses and download URLs, but it ties them to exploitation of CVE-2021-38647, so no actor infrastructure, file hash or command-and-control address is listed here, and no source consulted attributes CVE-2021-38645 to a named campaign."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "No source states that AI tooling was involved. Wiz Research reported all four OMI vulnerabilities to MSRC on 2021-06-01, and Microsoft's acknowledgment for this CVE credits Shir Tamari and Nir Ohfeld with Wiz.io.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-38645 (NVD lists no CWE; CWE-290 supplied, CVSS 7.8) + CISA KEV (added 2021-11-03) + Microsoft advisory CVE-2021-38645 (Open Management Infrastructure Elevation of Privilege Vulnerability). Microsoft's acknowledgment credits Shir Tamari and Nir Ohfeld with Wiz.io, an outside firm, and Wiz's disclosure timeline records that MSRC confirmed CVE-2021-38645 on 2021-07-16.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2021-38645 to its Known Exploited Vulnerabilities catalog on 2021-11-03 with a due date of 2021-11-17 and records ransomware use as Unknown; the listing is CISA's evidence of in-the-wild use, and CISA's SSVC assessment on the NVD record marks exploitation as active. When Microsoft published its advisory on 2021-09-14, its security update data marked the flaw as not publicly disclosed and not exploited. Microsoft's Threat Intelligence Center reported exploitation attempts against the remote-code-execution sibling CVE-2021-38647, ranging from host enumeration to cryptocurrency miner installs, and noted community reports of Mirai botnet installs, but no source reviewed names a campaign or actor that used CVE-2021-38645 itself. The KEV entry's forensic-triage flag is No.",
+    "attack_refs": [
+      "T1068",
+      "T1059.004"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires flaws to be identified, reported and corrected, with security-relevant updates installed within organization-defined time periods of release. The correction for CVE-2021-38645 is OMI 1.6.8-1. Microsoft's advisory says the fix in the open-source code was made available on GitHub on 2021-08-11, and Wiz records the packaged 1.6.8-1 release on 2021-09-08, six days before Microsoft's advisory. The advisory lists OMI, System Center Operations Manager and the Azure products that carry OMI, so a process that tracks those products can match it. Microsoft published it on 2021-09-14 and added affected products to its Security Updates table on 2021-09-16 and again on 2021-09-17, so a process that matched the advisory only as first published did not match the products added in those revisions. HDInsight clusters are not among the advisory's products: Microsoft's Additional Guidance post covers them, and where a cluster's configuration prevented the automatic update to OMI 1.6.8-1, the correction is a Microsoft script run on every cluster node, which a process driven by the advisory's product list does not schedule.",
+      "NIST-800-53-AC-6": "AC-6 requires users and processes to hold only the privileges their assigned tasks need. OMI already follows that split, with omiserver running as root behind an omiengine frontend running as the omi user, but CVE-2021-38645 lets any local account that can write to /var/opt/omi/run/omiserver.sock have its connection recorded as uid 0. An AC-6 review of the accounts, groups and sudo rules on the VM finds nothing to correct, because the escalation crosses a boundary inside the vendor's daemon rather than a privilege the organization assigned.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires essential and important entities to handle vulnerabilities in the systems they operate and sets no timeframe; for entities within the scope of Commission Implementing Regulation (EU) 2024/2690, such as cloud and managed service providers, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available. Microsoft updated Azure-managed extensions automatically, while standalone OMI, Operations Manager agents, on-premises Log Analytics agents, Azure Stack Hub extensions and HDInsight clusters whose configuration blocked the update needed a manual step, so meeting the reasonable-time requirement for this CVE depends on identifying the OMI copies Azure did not update.",
+      "UK-CAF-B4": "CAF principle B4 expects the systems that support essential functions to be securely configured and their vulnerabilities managed. Microsoft's network measure for the OMI family, restricting TCP 5985, 5986 and 1270 with a network security group or perimeter firewall, protects against the remote flaw CVE-2021-38647 only; CVE-2021-38645 runs over the local omiserver.sock socket that any local user can write. A B4 assessment that accepts closed OMI ports as the OMI mitigation records a host below 1.6.8-1 as protected while this escalation to root is still open on it.",
+      "AU-Essential-8-Patch": "The Essential Eight sets patch windows by asset class. On a VM where OMI is installed with the Log Analytics agent, which Wiz says does not expose the OMI port, OMI does not listen on the network and is an other application, patched within one month from Maturity Level Two (ISM-1693), with no timeframe at Maturity Level One. An OMI instance that listens on TCP 5985, 5986 or 1270 but is reachable only from internal networks is also an other application, under the same ISM-1693 window. Where an OMI instance's port 5985, 5986 or 1270 is directly accessible over the internet, as can happen with standalone OMI, Azure Configuration Management and Operations Manager, it is an online service, patched at every maturity level within 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1876) and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1690). The two-week branch rests only on Microsoft's Important rating and on no public exploit being found, and the 48-hour condition was met no later than CISA's 2021-11-03 KEV listing. Microsoft's advisory says the fix in the open-source code was on GitHub on 2021-08-11, and the packaged OMI 1.6.8-1 release followed on 2021-09-08. Counted from 2021-08-11 every window closed by 2021-09-11, and counted from 2021-09-08 every window closed by 2021-10-08, so either way they closed before the KEV listing; no source dates the first exploitation. The shortfall is at Maturity Level One, where a host with the non-listening agent or an internally reachable OMI instance has no patch window for this local escalation to root.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires information about technical vulnerabilities of information systems in use to be obtained, the organization's exposure to them evaluated and appropriate measures taken. Microsoft's advisory for CVE-2021-38645 lists OMI, System Center Operations Manager and the Azure products that carry OMI, among them the Log Analytics agent, Azure Diagnostics (LAD) and the Container Monitoring Solution, so a register that records those products can be evaluated against it. Two groups of OMI copies are not among the advisory's products: VMs built from the subset of Azure Marketplace images that Microsoft identified as carrying a vulnerable OMI, which Microsoft reported to affected customers through Azure Service Health notifications, and HDInsight clusters, which Microsoft's Additional Guidance post lists. A register entry for such an image or cluster has no matching product in the advisory, so evaluating the exposure of those hosts depends on checking the OMI package version on each of them or on acting on the Service Health notification and the guidance post."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No vendor-documented live-patch path exists for this fix. The fix replaces the OMI package with 1.6.8-1 or updates the extension that carries it, and the fixed code takes effect only once the omiserver and omiengine processes run from the new package. Microsoft states that the automatic extension updates it pushed to Azure VMs were applied without a reboot, and its security update data lists the restart requirement as Maybe. Standalone OMI, Operations Manager agents and on-premises extensions are updated manually.",
+    "affected": "Microsoft Open Management Infrastructure (OMI), the open-source CIM/WBEM management agent for Linux and UNIX, in every version below 1.6.8-1, including the copies that Azure VM management extensions install on Linux VMs: the Log Analytics (OMS) agent used by Azure Automation, Update Management, Azure Security Center and Azure Sentinel; the Linux Diagnostic extension; the Linux DSC agent for Azure Automation State Configuration; the Container Monitoring Solution image; Azure Stack Hub extensions; and Azure HDInsight clusters. System Center Operations Manager's Linux and UNIX monitoring also uses OMI. A local low-privileged user becomes root, and because the OMI server runs as root the compromise covers the whole host.",
+    "affected_versions": [
+      "Open Management Infrastructure below 1.6.8-1: standalone, as used by System Center Operations Manager, as the prerequisite package for the Linux DSC agent on on-premises Azure Automation State Configuration nodes, and as installed on a subset of Azure Marketplace VM images (1.6.8-1 is fixed; Microsoft's table lists the vulnerable builds as 1.6.8.0 or less).",
+      "OMS Agent for Linux (Log Analytics agent) GA v1.13.39 or earlier, as deployed on Azure VMs for Log Analytics, Azure Automation, Update Management, Azure Security Center and Azure Sentinel, and on on-premises machines for Log Analytics, Azure Automation and Update Management (GA v1.13.40-0 is fixed).",
+      "Azure Diagnostics Linux extension (LAD) v4.0.0 through v4.0.5 and v3.0.131 or earlier. Microsoft's guidance gives LAD v4.0.15 and v3.0.135 as fixed; the security update guide lists v4.0.13 and v3.0.135.",
+      "Linux DSC agent for Azure Automation State Configuration (DSC extension on Azure VMs): 2.71.x and 2.70.x builds below the fixed builds, 3.0.0.1 and 2.0.0.0 (2.71.1.25, 2.70.0.30 and 3.0.0.3 are fixed).",
+      "Azure Stack Hub: Azure Monitor, Update and Configuration Management extension 1.8, 1.8.11, 1.12, 1.12.17, 1.13.27 and 1.13.33 (1.14.02 is fixed per Microsoft's guidance; the security update guide lists 1.14.01), and Microsoft Azure Diagnostic Extension for Linux Virtual Machines 3.0.111 and 3.0.121 (3.1.135 is fixed).",
+      "Container Monitoring Solution Docker images with any SHA ID other than the fixed image sha256:12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707.",
+      "Azure HDInsight clusters running Ubuntu 16.0.4 (as Microsoft's guidance writes it) or with Azure Monitor integration enabled, on OMI 1.6.8.0 or less (OMI 1.6.8-1 is fixed)."
+    ],
+    "vendor_update_paths": [
+      "Update OMI to 1.6.8-1 on every Linux and UNIX host where it is installed standalone, for System Center Operations Manager, or as the prerequisite package for the Linux DSC agent on on-premises Azure Automation State Configuration nodes; Microsoft's guidance directs these deployments to update OMI manually. The same build fixes CVE-2021-38645 and its siblings CVE-2021-38647, CVE-2021-38648 and CVE-2021-38649.",
+      "Confirm that the Azure VM extensions are at their fixed builds: OMS Agent for Linux GA v1.13.40-0, LAD v4.0.15 or v3.0.135, and Linux DSC agent 2.71.1.25, 2.70.0.30 or 3.0.0.3. Microsoft updated managed extensions across Azure regions automatically and without a reboot, and says VMs still reported as vulnerable must be updated manually; keep automatic extension upgrade enabled.",
+      "On on-premises (non-Azure) Linux machines that run the OMS Agent for Linux for Log Analytics, Azure Automation or Update Management, update the agent manually to GA v1.13.40-0, as Microsoft's guidance directs.",
+      "On VMs built from one of the Azure Marketplace images that Microsoft identified as carrying a vulnerable OMI version, follow the remediation guidance in the Azure Service Health notification Microsoft sent for that image and bring OMI to 1.6.8-1; Microsoft also notified the image publishers to release new image versions with the updated OMI framework.",
+      "On Azure Stack Hub, install Azure Monitor, Update and Configuration Management 1.14.02 and Microsoft Azure Diagnostic Extension for Linux Virtual Machines 3.1.135 from the Azure Stack Hub marketplace. For the Container Monitoring Solution, move to the image with SHA ID sha256:12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707. On HDInsight clusters where configuration prevented the automatic update to OMI 1.6.8-1, run Microsoft's update script on every cluster node.",
+      "Restricting TCP 5985, 5986 and 1270 with a network security group or perimeter firewall protects against the remote sibling CVE-2021-38647 only. It does not block this local escalation, which uses the local UNIX socket, so it is not a substitute for the update."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 48,
+    "rwep_notes": "RWEP 48. cisa_kev +25, active_exploitation +20, blast_radius +18, patch_available -15. Σ factors === rwep_score."
+  },
   "CVE-2021-20021": {
     "name": "SonicWall Email Security Improper Privilege Management Vulnerability",
     "cvss_score": 9.8,
@@ -97337,7 +97794,7 @@
     "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
   },
   "CVE-2023-33063": {
-    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2023-33063)",
     "cvss_score": 7.8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cwe_refs": [
@@ -97428,7 +97885,7 @@
     "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
   },
   "CVE-2022-22071": {
-    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2022-22071)",
     "cvss_score": 7.8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cwe_refs": [
@@ -166788,7 +167245,7 @@
     "last_verified": "2026-08-22"
   },
   "CVE-2025-27038": {
-    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2025-27038)",
     "type": "memory-corruption",
     "cvss_score": 8.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",

package/data/cwe-catalog.json

@@ -1250,6 +1250,7 @@
       "CVE-2020-4427",
       "CVE-2020-8193",
       "CVE-2020-8196",
+      "CVE-2021-22893",
       "CVE-2021-27877",
       "CVE-2021-32030",
       "CVE-2021-32648",
@@ -1796,6 +1797,7 @@
       "CVE-2021-21166",
       "CVE-2021-25394",
       "CVE-2021-25395",
+      "CVE-2021-38645",
       "CVE-2022-26904",
       "CVE-2023-36884",
       "CVE-2025-39964",
@@ -1875,8 +1877,10 @@
       "CVE-2020-9715",
       "CVE-2021-0920",
       "CVE-2021-1048",
+      "CVE-2021-1905",
       "CVE-2021-21193",
       "CVE-2021-21206",
+      "CVE-2021-22893",
       "CVE-2021-25370",
       "CVE-2021-25394",
       "CVE-2021-28550",
@@ -2009,6 +2013,7 @@
       "CVE-2018-15961",
       "CVE-2018-4063",
       "CVE-2020-13671",
+      "CVE-2021-20022",
       "CVE-2021-26828",
       "CVE-2021-27860",
       "CVE-2021-31207",
@@ -4219,6 +4224,7 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2021-38645",
       "CVE-2022-23131",
       "CVE-2022-24112",
       "CVE-2023-50224",