{"metadata": {"count": 73, "page": 1, "per_page": 100}, "data": [{"uuid": "45ad2528-d0ac-4276-bf61-3f13880c0a1c", "vulnerability": {"vulnId": "CVE-2026-32202", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "45ad2528-d0ac-4276-bf61-3f13880c0a1c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-07T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-10-07T00:00:00+00:00", "recorded_at": "2026-10-08T04:37:02+00:00", "first_seen_at": "2026-10-07T00:00:00+00:00"}, "scope": {"notes": "Affected: Microsoft / Windows 10, Windows 11, Windows Server | Description: CVE-2026-32202 is a Windows Shell protection mechanism failure that allows a crafted shortcut file to trigger automatic NTLM authentication to an attacker-controlled server, exposing the victim\u2019s authentication data when its containing folder is viewed. | Patched since: 2026/04/14 | Exploitation type: unknown | CWEs: CWE-693 | Origin source: CNW | Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-693"], "euvd": "EUVD-2026-22589", "notes": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Windows 10, Windows 11, Windows Server", "dateReported": "2026/10/07", "originSource": "CNW", "patchedSince": "2026/04/14", "vendorProject": "Microsoft", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-32202", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32202"}, {"id": "EUVD-2026-22589", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22589"}, {"id": "source", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202"}]}, {"uuid": "02fe26a4-d026-463a-ab66-0a3f372b3417", "vulnerability": {"vulnId": "CVE-2026-82329", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "02fe26a4-d026-463a-ab66-0a3f372b3417"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-02T08:52:36+02:00"}, "timestamps": {"recorded_at": "2026-10-02T06:52:36+00:00"}, "scope": {"notes": "Affected: JFrog / Artifactory | Description: Authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. | Patched since: 2026/08/28 | Exploitation type: unknown | CWEs: CWE-287 | Origin source: ENISA | Notes: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-287"], "euvd": "EUVD-2026-67861", "notes": "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Artifactory", "dateReported": "2026/09/31", "originSource": "ENISA", "patchedSince": "2026/08/28", "vendorProject": "JFrog", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-82329", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82329"}, {"id": "EUVD-2026-67861", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67861"}, {"id": "source", "url": "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201"}]}, {"uuid": "389a0597-e673-4bd4-8ada-631ed0fa0b4b", "vulnerability": {"vulnId": "CVE-2026-88779", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "389a0597-e673-4bd4-8ada-631ed0fa0b4b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-02T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-10-02T00:00:00+00:00", "recorded_at": "2026-10-05T04:37:02+00:00", "first_seen_at": "2026-10-02T00:00:00+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix NetScaler ADC, Citrix NetScaler Gateway | Description: Memory overflow vulnerability leading to Denial of Service. | Patched since: 2026/10/04 | Exploitation type: unknown | CWEs: CWE-119 | Origin source: CNW | Notes: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-119"], "euvd": "EUVD-2026-92065", "notes": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Citrix NetScaler ADC, Citrix NetScaler Gateway", "dateReported": "2026/10/02", "originSource": "CNW", "patchedSince": "2026/10/04", "vendorProject": "Citrix", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-88779", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88779"}, {"id": "EUVD-2026-92065", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92065"}, {"id": "source", "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174"}]}, {"uuid": "91594a1e-e5e5-4789-9f64-e088757548fe", "vulnerability": {"vulnId": "CVE-2026-104286", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "91594a1e-e5e5-4789-9f64-e088757548fe"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-01T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-10-01T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-10-01T00:00:00+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiMail | Description: Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Customers are urged to disable the IBE feature support or disable access to the FortiMail management interface from the internet or limit the access only from trusted private network. | Exploitation type: unknown | CWEs: CWE-22, CWE-158 | Origin source: CNW | Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-175"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-22", "CWE-158"], "euvd": "EUVD-2026-91042", "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "FortiMail", "dateReported": "2026/10/01", "originSource": "CNW", "patchedSince": "", "vendorProject": "Fortinet", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-104286", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104286"}, {"id": "EUVD-2026-91042", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91042"}, {"id": "source", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175"}]}, {"uuid": "f0eee4c5-f0aa-46f1-a762-8eb8fe37a9ba", "vulnerability": {"vulnId": "CVE-2026-102490", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "f0eee4c5-f0aa-46f1-a762-8eb8fe37a9ba"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-30T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-30T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-30T00:00:00+00:00"}, "scope": {"notes": "Affected: Zammad / Zammad | Description: All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root. | Exploitation type: unknown | Origin source: NCSC-NL | Notes: https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2026-90081", "notes": "https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Zammad", "dateReported": "2026/09/30", "originSource": "NCSC-NL", "patchedSince": "", "vendorProject": "Zammad", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-102490", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102490"}, {"id": "EUVD-2026-90081", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90081"}, {"id": "source", "url": "https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu"}]}, {"uuid": "9741ca20-f574-4fc6-b899-a2fccb65c863", "vulnerability": {"vulnId": "CVE-2026-102489", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "9741ca20-f574-4fc6-b899-a2fccb65c863"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-30T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-30T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-30T00:00:00+00:00"}, "scope": {"notes": "Affected: Zammad / Zammad | Description: Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions. | Patched since: 2026/04/08 | Exploitation type: unknown | Origin source: NCSC-NL | Notes: https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2026-90080", "notes": "https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Zammad", "dateReported": "2026/09/30", "originSource": "NCSC-NL", "patchedSince": "2026/04/08", "vendorProject": "Zammad", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-102489", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102489"}, {"id": "EUVD-2026-90080", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90080"}, {"id": "source", "url": "https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu"}]}, {"uuid": "dd665681-edea-4c21-bf97-025125d55fae", "vulnerability": {"vulnId": "CVE-2026-88771", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "dd665681-edea-4c21-bf97-025125d55fae"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-27T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-27T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-27T00:00:00+00:00"}, "scope": {"notes": "Affected: Citrix / NetScaler ADC, NetScaler Gateway | Description: A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands | Exploitation type: unknown | CWEs: CWE-20 | Origin source: CNW | Notes: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-20"], "euvd": "EUVD-2026-56431", "notes": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "NetScaler ADC, NetScaler Gateway", "dateReported": "2026/09/27", "originSource": "CNW", "patchedSince": "", "vendorProject": "Citrix", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-88771", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88771"}, {"id": "EUVD-2026-56431", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56431"}, {"id": "source", "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"}]}, {"uuid": "cb0024fd-2cdc-4806-8090-a4669d70b476", "vulnerability": {"vulnId": "CVE-2026-88772", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "cb0024fd-2cdc-4806-8090-a4669d70b476"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-27T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-27T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-27T00:00:00+00:00"}, "scope": {"notes": "Affected: Citrix / NetScaler ADC, NetScaler Gateway | Description: Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | Exploitation type: unknown | CWEs: CWE-119 | Origin source: CNW | Notes: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-119"], "euvd": "EUVD-2026-56431", "notes": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "NetScaler ADC, NetScaler Gateway", "dateReported": "2026/09/27", "originSource": "CNW", "patchedSince": "", "vendorProject": "Citrix", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-88772", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88772"}, {"id": "EUVD-2026-56431", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56431"}, {"id": "source", "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"}]}, {"uuid": "83117a75-3bb0-4467-8d76-33dc5fef9117", "vulnerability": {"vulnId": "CVE-2026-67279", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "83117a75-3bb0-4467-8d76-33dc5fef9117"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-27T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-27T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-27T00:00:00+00:00"}, "scope": {"notes": "MikroTrick | Affected: MikroTik / RouterOS | Description: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) | Patched since: 2026/09/03 | Exploitation type: unknown | CWEs: CWE-841 | Origin source: CERT.PL | Notes: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-841"], "euvd": "EUVD-2026-72027", "notes": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "RouterOS", "dateReported": "2026/09/27", "originSource": "CERT.PL", "patchedSince": "2026/09/03", "vendorProject": "MikroTik", "exploitationType": ["unknown"], "vulnerabilityName": "MikroTrick", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-67279", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67279"}, {"id": "EUVD-2026-72027", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72027"}, {"id": "source", "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}]}, {"uuid": "ac91c0b7-abc5-4664-a4e6-00265df35960", "vulnerability": {"vulnId": "CVE-2026-65660", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "ac91c0b7-abc5-4664-a4e6-00265df35960"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-25T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-25T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-25T00:00:00+00:00"}, "scope": {"notes": "Affected: Microsoft / Microsoft SharePoint Server 2019, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server Subscription Edition | Description: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a user network | Exploitation type: unknown | CWEs: CWE-94 | Origin source: CSIRT-IE | Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-94"], "euvd": "EUVD-2026-56431", "notes": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Microsoft SharePoint Server 2019, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server Subscription Edition", "dateReported": "2026/09/25", "originSource": "CSIRT-IE", "patchedSince": "", "vendorProject": "Microsoft", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-65660", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65660"}, {"id": "EUVD-2026-56431", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56431"}, {"id": "source", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660"}]}, {"uuid": "232d7698-7242-4227-be02-e8cb1ab72aed", "vulnerability": {"vulnId": "CVE-2026-85103", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "232d7698-7242-4227-be02-e8cb1ab72aed"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-25T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-25T00:00:00+00:00", "recorded_at": "2026-10-08T04:37:02+00:00", "first_seen_at": "2026-09-25T00:00:00+00:00"}, "scope": {"notes": "Affected: Check Point / Quantum Security Gateway, Quantum Security Management | Description: CVE-2026-85103 is a heap-based buffer overflow in ASN.1 certificate decoding that may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Gateway and Security Management systems. | Patched since: 2026/09/07 | Exploitation type: unknown | CWEs: CWE-122 | Origin source: CNW | Notes: https://support.checkpoint.com/results/sk/sk1000118"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-122"], "euvd": "EUVD-2026-75010", "notes": "https://support.checkpoint.com/results/sk/sk1000118", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Quantum Security Gateway, Quantum Security Management", "dateReported": "2026/09/25", "originSource": "CNW", "patchedSince": "2026/09/07", "vendorProject": "Check Point", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-85103", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85103"}, {"id": "EUVD-2026-75010", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75010"}, {"id": "source", "url": "https://support.checkpoint.com/results/sk/sk1000118"}]}, {"uuid": "b6fa4f50-8947-4fb1-bf3d-7687796314e4", "vulnerability": {"vulnId": "CVE-2026-87902", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "b6fa4f50-8947-4fb1-bf3d-7687796314e4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-23T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-23T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-23T00:00:00+00:00"}, "scope": {"notes": "Affected: WordPress Foundation / WordPress | Description: The vulnerabilitycan be exploited by an attacker without login credentials to have a special file loaded outside the normal themes of WordPress. Active abuse has been observed. | Patched since: 2026/09/22 | Exploitation type: unknown | CWEs: CWE-98 | Origin source: NCSC-NL | Notes: https://www.ncsc.nl/alerts/kwetsbaarheid-in-wordpress-wordt-actief-misbruikt-update-nu"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-98"], "euvd": "EUVD-2026-84555", "notes": "https://www.ncsc.nl/alerts/kwetsbaarheid-in-wordpress-wordt-actief-misbruikt-update-nu", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "WordPress", "dateReported": "2026/09/23", "originSource": "NCSC-NL", "patchedSince": "2026/09/22", "vendorProject": "WordPress Foundation", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-87902", "url": "https://www.cve.org/CVERecord?id=CVE-2026-87902"}, {"id": "EUVD-2026-84555", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84555"}, {"id": "source", "url": "https://www.ncsc.nl/alerts/kwetsbaarheid-in-wordpress-wordt-actief-misbruikt-update-nu"}]}, {"uuid": "f60f28a6-3acb-4d13-a059-750ef042b0de", "vulnerability": {"vulnId": "CVE-2026-85102", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "f60f28a6-3acb-4d13-a059-750ef042b0de"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-22T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-22T00:00:00+00:00"}, "scope": {"notes": "Affected: checkpoint / Quantum Security Gateway | Description: Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. | Patched since: 2026/09/09 | Exploitation type: unknown | CWEs: CWE-295 | Origin source: ENISA | Notes: https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-295"], "euvd": "EUVD-2026-75009", "notes": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Quantum Security Gateway", "dateReported": "2026/09/22", "originSource": "ENISA", "patchedSince": "2026/09/09", "vendorProject": "checkpoint", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-85102", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85102"}, {"id": "EUVD-2026-75009", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75009"}, {"id": "source", "url": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/"}]}, {"uuid": "6c303b5c-9687-4e8d-a3bb-6fed70fc3721", "vulnerability": {"vulnId": "CVE-2026-94127", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "6c303b5c-9687-4e8d-a3bb-6fed70fc3721"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-22T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-22T00:00:00+00:00"}, "scope": {"notes": "Affected: F5 / BIG-IP | Description: Unauthenticated RCE vulnerability present when BIG-IP APM is configured as an OAuth Authorization Server. | Exploitation type: unknown | CWEs: CWE-122 | Origin source: ENISA | Notes: https://my.f5.com/manage/s/article/K000162605"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-122"], "euvd": "EUVD-2026-84427", "notes": "https://my.f5.com/manage/s/article/K000162605", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "BIG-IP", "dateReported": "2026/09/22", "originSource": "ENISA", "patchedSince": "", "vendorProject": "F5", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-94127", "url": "https://www.cve.org/CVERecord?id=CVE-2026-94127"}, {"id": "EUVD-2026-84427", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84427"}, {"id": "source", "url": "https://my.f5.com/manage/s/article/K000162605"}]}, {"uuid": "28be858e-4226-490e-ba48-d8d3884fe8a2", "vulnerability": {"vulnId": "CVE-2026-93616", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "28be858e-4226-490e-ba48-d8d3884fe8a2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-22T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-22T00:00:00+00:00"}, "scope": {"notes": "Affected: checkpoint / Quantum Security Gateway | Description: A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. | Patched since: 2026/09/09 | Exploitation type: unknown | CWEs: CWE-22 | Origin source: ENISA | Notes: https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-22"], "euvd": "EUVD-2026-84375", "notes": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Quantum Security Gateway", "dateReported": "2026/09/22", "originSource": "ENISA", "patchedSince": "2026/09/09", "vendorProject": "checkpoint", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-93616", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93616"}, {"id": "EUVD-2026-84375", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84375"}, {"id": "source", "url": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/"}]}, {"uuid": "1c057ea5-2fa3-498c-8789-dd03dbab856a", "vulnerability": {"vulnId": "CVE-2026-93952", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "1c057ea5-2fa3-498c-8789-dd03dbab856a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-22T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-22T00:00:00+00:00"}, "scope": {"notes": "Affected: Arista Networks / VeloCloud Orchestrator (VCO) On-Prem | Description: A security issue that may allow a remote attacker to access privileged internal functionality and impact the VCO host. | Exploitation type: unknown | CWEs: CWE-20 | Origin source: CSIRT-IE | Notes: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-20"], "euvd": "EUVD-2026-84296", "notes": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "VeloCloud Orchestrator (VCO) On-Prem", "dateReported": "2026/09/22", "originSource": "CSIRT-IE", "patchedSince": "", "vendorProject": "Arista Networks", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-93952", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93952"}, {"id": "EUVD-2026-84296", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84296"}, {"id": "source", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183"}]}, {"uuid": "deeb0060-da4b-4174-8c7f-e6e0c780c90b", "vulnerability": {"vulnId": "CVE-2026-63030", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "deeb0060-da4b-4174-8c7f-e6e0c780c90b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-21T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-21T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-21T00:00:00+00:00"}, "scope": {"notes": "Affected: WordPress Foundation / WordPress | Description: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution. EU victimology. | Patched since: 2026/07/17 | Exploitation type: unknown | CWEs: CWE-436 | Origin source: ENISA | Notes: https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation#:~:text=GreyNoise%20discovered%20the%20MCA%20targeted%20ZyXEL%20GS1900%20Smart%20Managed%20Switches%20globally, https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-436"], "euvd": "EUVD-2026-45280", "notes": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation#:~:text=GreyNoise%20discovered%20the%20MCA%20targeted%20ZyXEL%20GS1900%20Smart%20Managed%20Switches%20globally, https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "WordPress", "dateReported": "2026/09/21", "originSource": "ENISA", "patchedSince": "2026/07/17", "vendorProject": "WordPress Foundation", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-63030", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63030"}, {"id": "EUVD-2026-45280", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45280"}, {"id": "source", "url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation#:~:text=GreyNoise%20discovered%20the%20MCA%20targeted%20ZyXEL%20GS1900%20Smart%20Managed%20Switches%20globally"}, {"id": "source", "url": "https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137"}]}, {"uuid": "c489a8e2-366c-439b-9534-23f7849c1324", "vulnerability": {"vulnId": "CVE-2026-60137", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "c489a8e2-366c-439b-9534-23f7849c1324"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-21T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-21T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-21T00:00:00+00:00"}, "scope": {"notes": "Affected: WordPress Foundation / WordPress | Description: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter. EU victimology. | Patched since: 2026/07/17 | Exploitation type: unknown | CWEs: CWE-89 | Origin source: ENISA | Notes: https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation#:~:text=GreyNoise%20discovered%20the%20MCA%20targeted%20ZyXEL%20GS1900%20Smart%20Managed%20Switches%20globally, https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-89"], "euvd": "EUVD-2026-45279", "notes": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation#:~:text=GreyNoise%20discovered%20the%20MCA%20targeted%20ZyXEL%20GS1900%20Smart%20Managed%20Switches%20globally, https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "WordPress", "dateReported": "2026/09/21", "originSource": "ENISA", "patchedSince": "2026/07/17", "vendorProject": "WordPress Foundation", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-60137", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60137"}, {"id": "EUVD-2026-45279", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45279"}, {"id": "source", "url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation#:~:text=GreyNoise%20discovered%20the%20MCA%20targeted%20ZyXEL%20GS1900%20Smart%20Managed%20Switches%20globally"}, {"id": "source", "url": "https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137"}]}, {"uuid": "845724eb-e774-4318-a9ff-2084a84c5946", "vulnerability": {"vulnId": "CVE-2026-20316", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "845724eb-e774-4318-a9ff-2084a84c5946"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-09T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-09T00:00:00+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco Secure Firewall Management Center (FMC) | Description: Vulnerability in the web interface could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. EU victimology was confirmed. Comprehensive hardening scheduled (Week of September 14th). | Patched since: 2026/08/05 | Exploitation type: ransomware | CWEs: CWE-259 | Origin source: ENISA | Notes: https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": ["CWE-259"], "euvd": "EUVD-2026-50404", "notes": "https://blog.talosintelligence.com/fmc-ongoing-exploitation/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Cisco Secure Firewall Management Center (FMC)", "dateReported": "2026/09/09", "originSource": "ENISA", "patchedSince": "2026/08/05", "vendorProject": "Cisco", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-20316", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20316"}, {"id": "EUVD-2026-50404", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-50404"}, {"id": "source", "url": "https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}]}, {"uuid": "4e9ffd58-44ea-4b18-bc85-18c18ffccc66", "vulnerability": {"vulnId": "CVE-2026-20079", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "4e9ffd58-44ea-4b18-bc85-18c18ffccc66"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-09T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-09T00:00:00+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco Secure Firewall Management Center (FMC) | Description: Vulnerability in the web interface could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. EU victimology was confirmed. Comprehensive hardening scheduled (Week of September 14th) | Patched since: 2026/08/05 | Exploitation type: ransomware | CWEs: CWE-288 | Origin source: ENISA | Notes: https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": ["CWE-288"], "euvd": "EUVD-2026-9438", "notes": "https://blog.talosintelligence.com/fmc-ongoing-exploitation/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Cisco Secure Firewall Management Center (FMC)", "dateReported": "2026/09/09", "originSource": "ENISA", "patchedSince": "2026/08/05", "vendorProject": "Cisco", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-20079", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20079"}, {"id": "EUVD-2026-9438", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-9438"}, {"id": "source", "url": "https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}]}, {"uuid": "ab4d1a9e-aa4a-42c5-9747-5978a66b4a1f", "vulnerability": {"vulnId": "CVE-2026-67276", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "ab4d1a9e-aa4a-42c5-9747-5978a66b4a1f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-05T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-05T00:00:00+00:00"}, "scope": {"notes": "MikroTrick | Affected: MikroTik / RouterOS | Description: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) | Patched since: 2026/09/03 | Exploitation type: unknown | CWEs: CWE-347 | Origin source: CERT.PL | Notes: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-347"], "euvd": "EUVD-2026-72024", "notes": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "RouterOS", "dateReported": "2026/09/05", "originSource": "CERT.PL", "patchedSince": "2026/09/03", "vendorProject": "MikroTik", "exploitationType": ["unknown"], "vulnerabilityName": "MikroTrick", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-67276", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67276"}, {"id": "EUVD-2026-72024", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72024"}, {"id": "source", "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}]}, {"uuid": "9e9a2427-13ee-42cf-9088-254bd7a706d1", "vulnerability": {"vulnId": "CVE-2026-86060", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "9e9a2427-13ee-42cf-9088-254bd7a706d1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-05T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-05T00:00:00+00:00"}, "scope": {"notes": "MikroTrick | Affected: MikroTik / RouterOS | Description: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) | Patched since: 2026/09/03 | Exploitation type: unknown | CWEs: CWE-88 | Origin source: CERT.PL | Notes: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-88"], "euvd": "EUVD-2026-72029", "notes": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "RouterOS", "dateReported": "2026/09/05", "originSource": "CERT.PL", "patchedSince": "2026/09/03", "vendorProject": "MikroTik", "exploitationType": ["unknown"], "vulnerabilityName": "MikroTrick", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-86060", "url": "https://www.cve.org/CVERecord?id=CVE-2026-86060"}, {"id": "EUVD-2026-72029", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72029"}, {"id": "source", "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}]}, {"uuid": "29fcc6c6-4dd2-4a00-b26d-63ead3b47cf8", "vulnerability": {"vulnId": "CVE-2026-67277", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "29fcc6c6-4dd2-4a00-b26d-63ead3b47cf8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-05T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-05T00:00:00+00:00"}, "scope": {"notes": "MikroTrick | Affected: MikroTik / RouterOS | Description: RouterOS accepts a 'related' btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With 'random-data=false', the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) | Patched since: 2026/09/03 | Exploitation type: unknown | CWEs: CWE-306 | Origin source: CERT.PL | Notes: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-306"], "euvd": "EUVD-2026-72025", "notes": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "RouterOS", "dateReported": "2026/09/05", "originSource": "CERT.PL", "patchedSince": "2026/09/03", "vendorProject": "MikroTik", "exploitationType": ["unknown"], "vulnerabilityName": "MikroTrick", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-67277", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67277"}, {"id": "EUVD-2026-72025", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72025"}, {"id": "source", "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}]}, {"uuid": "be40539b-5404-4e6b-a923-35315ab47f77", "vulnerability": {"vulnId": "CVE-2026-63219", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "be40539b-5404-4e6b-a923-35315ab47f77"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-02T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-02T00:00:00+00:00"}, "scope": {"notes": "Affected: geonetwork / core-geonetwork | Description: Unauthenticated file upload via missing authorization on formatter upload endpoint. | Patched since: 2026/07/08 | Exploitation type: unknown | CWEs: CWE-862 | Origin source: CNW | Notes: https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-862"], "euvd": "EUVD-2026-70647", "notes": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "core-geonetwork", "dateReported": "2026/09/02", "originSource": "CNW", "patchedSince": "2026/07/08", "vendorProject": "geonetwork", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-63219", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63219"}, {"id": "EUVD-2026-70647", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70647"}, {"id": "source", "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42"}]}, {"uuid": "6054d33a-4c36-447d-95a5-84cb02976972", "vulnerability": {"vulnId": "CVE-2026-58400", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "6054d33a-4c36-447d-95a5-84cb02976972"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-09-02T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-09-02T00:00:00+00:00"}, "scope": {"notes": "Affected: geonetwork / core-geonetwork | Description: Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter. | Patched since: 2026/07/08 | Exploitation type: unknown | CWEs: CWE-94, CWE-470 | Origin source: CNW | Notes: https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-94", "CWE-470"], "euvd": "EUVD-2026-70645", "notes": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "core-geonetwork", "dateReported": "2026/09/02", "originSource": "CNW", "patchedSince": "2026/07/08", "vendorProject": "geonetwork", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-58400", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58400"}, {"id": "EUVD-2026-70645", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70645"}, {"id": "source", "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r"}]}, {"uuid": "d438936a-c9b7-4d16-a2e6-fbf79cca8650", "vulnerability": {"vulnId": "CVE-2026-74233", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "d438936a-c9b7-4d16-a2e6-fbf79cca8650"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-27T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-27T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-27T00:00:00+00:00"}, "scope": {"notes": "Affected: Zbtlink / Various | Description: Zbtlink firmware contain an unauthenticated command injection in the infosrvd service (UDP/9992). | Exploitation type: unknown | CWEs: CWE-78, CWE-321 | Origin source: ENISA | Notes: https://www.vulncheck.com/blog/zbt-darklantern-speakingstone"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-78", "CWE-321"], "euvd": "EUVD-2026-67000", "notes": "https://www.vulncheck.com/blog/zbt-darklantern-speakingstone", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Various", "dateReported": "2026/08/27", "originSource": "ENISA", "patchedSince": "", "vendorProject": "Zbtlink", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-74233", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74233"}, {"id": "EUVD-2026-67000", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67000"}, {"id": "source", "url": "https://www.vulncheck.com/blog/zbt-darklantern-speakingstone"}]}, {"uuid": "854ca6c6-f0ee-42b2-a760-1aab0e4f1648", "vulnerability": {"vulnId": "CVE-2026-81578", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "854ca6c6-f0ee-42b2-a760-1aab0e4f1648"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-27T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-27T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-27T00:00:00+00:00"}, "scope": {"notes": "Affected: PaperCut / PaperCut MF/NG | Description: Authentication bypass in the web management interface. | Patched since: 2026/08/28 | Exploitation type: unknown | CWEs: CWE-305 | Origin source: ENISA | Notes: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-305"], "euvd": "EUVD-2026-67713", "notes": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "PaperCut MF/NG", "dateReported": "2026/08/27", "originSource": "ENISA", "patchedSince": "2026/08/28", "vendorProject": "PaperCut", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-81578", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81578"}, {"id": "EUVD-2026-67713", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67713"}, {"id": "source", "url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"}]}, {"uuid": "5e9b4e45-603c-41e4-991b-346b9cbbf390", "vulnerability": {"vulnId": "CVE-2026-82078", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "5e9b4e45-603c-41e4-991b-346b9cbbf390"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-27T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-27T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-27T00:00:00+00:00"}, "scope": {"notes": "Affected: PaperCut / PaperCut MF/NG | Description: Unsafe dynamic class loading vulnerability in the database connector. | Patched since: 2026/08/28 | Exploitation type: unknown | CWEs: CWE-470 | Origin source: ENISA | Notes: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-470"], "euvd": "EUVD-2026-67714", "notes": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "PaperCut MF/NG", "dateReported": "2026/08/27", "originSource": "ENISA", "patchedSince": "2026/08/28", "vendorProject": "PaperCut", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-82078", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82078"}, {"id": "EUVD-2026-67714", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67714"}, {"id": "source", "url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"}]}, {"uuid": "052e6ddf-44ae-4458-8517-07877f108480", "vulnerability": {"vulnId": "CVE-2026-74232", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "052e6ddf-44ae-4458-8517-07877f108480"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-27T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-27T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-27T00:00:00+00:00"}, "scope": {"notes": "Affected: Zbtlink / Various | Description: Zbtlink firmware ships with a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. | Exploitation type: unknown | CWEs: CWE-300, CWE-506 | Origin source: ENISA | Notes: https://www.vulncheck.com/blog/zbt-darklantern-speakingstone"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-300", "CWE-506"], "euvd": "EUVD-2026-66999", "notes": "https://www.vulncheck.com/blog/zbt-darklantern-speakingstone", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Various", "dateReported": "2026/08/27", "originSource": "ENISA", "patchedSince": "", "vendorProject": "Zbtlink", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-74232", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74232"}, {"id": "EUVD-2026-66999", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-66999"}, {"id": "source", "url": "https://www.vulncheck.com/blog/zbt-darklantern-speakingstone"}]}, {"uuid": "08fbd3cb-6257-4572-8cb7-e7edc923d879", "vulnerability": {"vulnId": "CVE-2026-72898", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "08fbd3cb-6257-4572-8cb7-e7edc923d879"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-24T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-24T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-24T00:00:00+00:00"}, "scope": {"notes": "Affected: Metabase / Metabase | Description: Metabase SQL Injection vulnerability that enables remote unauthenticated attacker to gain administrator access to connected Metabase instance. | Patched since: 2026/08/06 | Exploitation type: unknown | CWEs: CWE-89 | Origin source: EL-CSIRT | Notes: https://www.metabase.com/blog/security-update-6-aug-2026"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-89"], "euvd": "EUVD-2026-55690", "notes": "https://www.metabase.com/blog/security-update-6-aug-2026", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Metabase", "dateReported": "2026/08/24", "originSource": "EL-CSIRT", "patchedSince": "2026/08/06", "vendorProject": "Metabase", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-72898", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72898"}, {"id": "EUVD-2026-55690", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-55690"}, {"id": "source", "url": "https://www.metabase.com/blog/security-update-6-aug-2026"}]}, {"uuid": "c3a66b68-c4e9-493c-87b4-c57b300166b2", "vulnerability": {"vulnId": "CVE-2026-73570", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "c3a66b68-c4e9-493c-87b4-c57b300166b2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-18T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-18T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-18T00:00:00+00:00"}, "scope": {"notes": "Affected: Zimbra / Collaboration | Description: Improper sanitization of untrusted input during SNMP notification processing. Exploitation waves since the beginning of August 2026. | Patched since: 2026/07/20 | Exploitation type: unknown | CWEs: CWE-78 | Origin source: CERT.PL | Notes: https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.20"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-78"], "euvd": "EUVD-2026-58069", "notes": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.20", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Collaboration", "dateReported": "2026/08/18", "originSource": "CERT.PL", "patchedSince": "2026/07/20", "vendorProject": "Zimbra", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-73570", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73570"}, {"id": "EUVD-2026-58069", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58069"}, {"id": "source", "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.20"}]}, {"uuid": "9a15646b-1b7f-445b-992a-e4443be50f0b", "vulnerability": {"vulnId": "CVE-2026-42897", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "9a15646b-1b7f-445b-992a-e4443be50f0b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-18T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-18T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-18T00:00:00+00:00"}, "scope": {"notes": "Affected: Microsoft / Microsoft Exchange Server | Description: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | Patched since: 2026/05/14 | Exploitation type: unknown | CWEs: CWE-79 | Origin source: CERT.PL | Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-79"], "euvd": "EUVD-2026-30343", "notes": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Microsoft Exchange Server", "dateReported": "2026/08/18", "originSource": "CERT.PL", "patchedSince": "2026/05/14", "vendorProject": "Microsoft", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-42897", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42897"}, {"id": "EUVD-2026-30343", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30343"}, {"id": "source", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"}]}, {"uuid": "08f68c64-0d53-44d3-9433-90a7e0173c2b", "vulnerability": {"vulnId": "CVE-2026-41679", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "08f68c64-0d53-44d3-9433-90a7e0173c2b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-17T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-17T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-17T00:00:00+00:00"}, "scope": {"notes": "Affected: paperclipai / @paperclipai/server, paperclip | Description: An unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration. | Patched since: 2026/04/22 | Exploitation type: unknown | CWEs: CWE-287, CWE-862, CWE-1188 | Origin source: CNW | Notes: https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-287", "CWE-862", "CWE-1188"], "euvd": "EUVD-2026-25166", "notes": "https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "@paperclipai/server, paperclip", "dateReported": "2026/08/17", "originSource": "CNW", "patchedSince": "2026/04/22", "vendorProject": "paperclipai", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-41679", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41679"}, {"id": "EUVD-2026-25166", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25166"}, {"id": "source", "url": "https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7"}]}, {"uuid": "b514c1af-4522-443e-a8e8-bb2c88b22ee6", "vulnerability": {"vulnId": "CVE-2026-12569", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "b514c1af-4522-443e-a8e8-bb2c88b22ee6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-16T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-16T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-16T00:00:00+00:00"}, "scope": {"notes": "Affected: PTC / Windchill PDMLink, FlexPLM | Description: Critical RCE vulnerability caused by insecure deserialization of untrusted data. | Patched since: 2026/06/18 | Exploitation type: ransomware | CWEs: CWE-20, CWE-502 | Origin source: ENISA | Notes: https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": ["CWE-20", "CWE-502"], "euvd": "EUVD-2026-37831", "notes": "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Windchill PDMLink, FlexPLM", "dateReported": "2026/08/16", "originSource": "ENISA", "patchedSince": "2026/06/18", "vendorProject": "PTC", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-12569", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12569"}, {"id": "EUVD-2026-37831", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37831"}, {"id": "source", "url": "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability"}]}, {"uuid": "934adcaa-9d5e-4985-a76f-f02861ba4423", "vulnerability": {"vulnId": "CVE-2026-68820", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "934adcaa-9d5e-4985-a76f-f02861ba4423"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-11T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-11T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-11T00:00:00+00:00"}, "scope": {"notes": "Affected: Microsoft / Windows | Description: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | Patched since: 2026/08/11 | Exploitation type: APT | CWEs: CWE-416 | Origin source: ENISA | Notes: https://blog.checkpoint.com/research/state-sponsored-hackers-use-fake-job-offers-to-deliver-new-zero-day-exploit/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-416"], "euvd": "EUVD-2026-56468", "notes": "https://blog.checkpoint.com/research/state-sponsored-hackers-use-fake-job-offers-to-deliver-new-zero-day-exploit/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Windows", "dateReported": "2026/08/11", "originSource": "ENISA", "patchedSince": "2026/08/11", "vendorProject": "Microsoft", "exploitationType": ["APT"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-68820", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68820"}, {"id": "EUVD-2026-56468", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56468"}, {"id": "source", "url": "https://blog.checkpoint.com/research/state-sponsored-hackers-use-fake-job-offers-to-deliver-new-zero-day-exploit/"}]}, {"uuid": "f7921dea-9e61-4aed-bb02-357c7e67c230", "vulnerability": {"vulnId": "CVE-2026-59310", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "f7921dea-9e61-4aed-bb02-357c7e67c230"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-10T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-10T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-10T00:00:00+00:00"}, "scope": {"notes": "Affected: VMware / vCenter | Description: Directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. | Patched since: 2026/08/03 | Exploitation type: APT | CWEs: CWE-22 | Origin source: ENISA | Notes: https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-22"], "euvd": "EUVD-2026-51097", "notes": "https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "vCenter", "dateReported": "2026/08/10", "originSource": "ENISA", "patchedSince": "2026/08/03", "vendorProject": "VMware", "exploitationType": ["APT"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-59310", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59310"}, {"id": "EUVD-2026-51097", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51097"}, {"id": "source", "url": "https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff"}]}, {"uuid": "e0a45fc3-e18b-4fc8-8107-71a058990389", "vulnerability": {"vulnId": "CVE-2017-10271", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "e0a45fc3-e18b-4fc8-8107-71a058990389"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-10T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-08-10T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-08-10T00:00:00+00:00"}, "scope": {"notes": "Affected: Oracle Corporation / WebLogic Server | Description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). | Patched since: 2017/10/17 | Exploitation type: ransomware | CWEs: CWE-306 | Origin source: NCSC HU | Notes: https://github.com/c0mmand3rOpSec/CVE-2017-10271"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": ["CWE-306"], "euvd": "EUVD-2017-1918", "notes": "https://github.com/c0mmand3rOpSec/CVE-2017-10271", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "WebLogic Server", "dateReported": "2026/08/10", "originSource": "NCSC HU", "patchedSince": "2017/10/17", "vendorProject": "Oracle Corporation", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2017-10271", "url": "https://www.cve.org/CVERecord?id=CVE-2017-10271"}, {"id": "EUVD-2017-1918", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1918"}, {"id": "source", "url": "https://github.com/c0mmand3rOpSec/CVE-2017-10271"}]}, {"uuid": "f5151252-ec31-4743-aa69-cd990d9efe66", "vulnerability": {"vulnId": "CVE-2022-26134", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "f5151252-ec31-4743-aa69-cd990d9efe66"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-31T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-07-31T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-07-31T00:00:00+00:00"}, "scope": {"notes": "Affected: Atlassian / Confluence Server, Confluence Data Center | Description: OGNL injection vulnerability allows an unauthenticated attacker to execute arbitrary code on an instance. | Patched since: 2022/06/02 | Exploitation type: APT | Threat actors: UNC6586 | CWEs: CWE-917 | Origin source: CNW | Notes: https://socradar.io/blog/snowlight-government-chinese-campaign/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-917"], "euvd": "EUVD-2022-30701", "notes": "https://socradar.io/blog/snowlight-government-chinese-campaign/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Confluence Server, Confluence Data Center", "dateReported": "2026/07/31", "originSource": "CNW", "patchedSince": "2022/06/02", "vendorProject": "Atlassian", "exploitationType": ["APT"], "vulnerabilityName": "", "threatActorsExploiting": ["UNC6586"]}}], "references": [{"id": "CVE-2022-26134", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26134"}, {"id": "EUVD-2022-30701", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-30701"}, {"id": "source", "url": "https://socradar.io/blog/snowlight-government-chinese-campaign/"}]}, {"uuid": "d4a301bd-44c1-48d4-a6b7-a726dfa8a72a", "vulnerability": {"vulnId": "CVE-2026-49049", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "d4a301bd-44c1-48d4-a6b7-a726dfa8a72a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-07-10T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-07-10T00:00:00+00:00"}, "scope": {"notes": "Affected: JoomShaper / Helix3 extension for Joomla | Description: Helix3 plugin for Joomla exposes an ajax handler task that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters. | Patched since: 2026/06/29 | Exploitation type: unknown | CWEs: CWE-284 | Origin source: CNW | Notes: https://www.joomshaper.com/forum/question/45671"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-284"], "euvd": "EUVD-2026-40122", "notes": "https://www.joomshaper.com/forum/question/45671", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Helix3 extension for Joomla", "dateReported": "2026/07/10", "originSource": "CNW", "patchedSince": "2026/06/29", "vendorProject": "JoomShaper", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-49049", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49049"}, {"id": "EUVD-2026-40122", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40122"}, {"id": "source", "url": "https://www.joomshaper.com/forum/question/45671"}]}, {"uuid": "c0d333e5-6075-4338-9067-18866595d8b9", "vulnerability": {"vulnId": "CVE-2026-48907", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "c0d333e5-6075-4338-9067-18866595d8b9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-06T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-07-06T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-07-06T00:00:00+00:00"}, "scope": {"notes": "Affected: Widget Factory (Pty) Ltd / Joomla Content Editor (JCE) | Description: Critical vulnerability in JCE editor extension. | Patched since: 2026/06/03 | Exploitation type: unknown | CWEs: CWE-284 | Origin source: CERT-PL | Notes: https://www.joomlacontenteditor.net/news/jce-pro-2-9-99-5-released"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-284"], "euvd": "EUVD-2026-34789", "notes": "https://www.joomlacontenteditor.net/news/jce-pro-2-9-99-5-released", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Joomla Content Editor (JCE)", "dateReported": "2026/07/06", "originSource": "CERT-PL", "patchedSince": "2026/06/03", "vendorProject": "Widget Factory (Pty) Ltd", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-48907", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48907"}, {"id": "EUVD-2026-34789", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-34789"}, {"id": "source", "url": "https://www.joomlacontenteditor.net/news/jce-pro-2-9-99-5-released"}]}, {"uuid": "4bf2b8b5-b4ab-4400-a754-32aaaf9eaa84", "vulnerability": {"vulnId": "CVE-2026-48908", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "4bf2b8b5-b4ab-4400-a754-32aaaf9eaa84"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-06T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-07-06T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-07-06T00:00:00+00:00"}, "scope": {"notes": "Affected: JoomShaper / SP Page Builder extension for Joomla | Description: Critical vulnerability that allows unauthenticated users to upload arbitrary files. | Patched since: 2026/06/20 | Exploitation type: unknown | CWEs: CWE-434 | Origin source: CERT-PL | Notes: https://www.joomshaper.com/forum/question/45152"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-434"], "euvd": "EUVD-2026-38110", "notes": "https://www.joomshaper.com/forum/question/45152", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "SP Page Builder extension for Joomla", "dateReported": "2026/07/06", "originSource": "CERT-PL", "patchedSince": "2026/06/20", "vendorProject": "JoomShaper", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-48908", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48908"}, {"id": "EUVD-2026-38110", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38110"}, {"id": "source", "url": "https://www.joomshaper.com/forum/question/45152"}]}, {"uuid": "77956da0-b49d-40be-a535-2672aa2fddf0", "vulnerability": {"vulnId": "CVE-2026-1731", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "77956da0-b49d-40be-a535-2672aa2fddf0"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-04T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-06-04T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-06-04T00:00:00+00:00"}, "scope": {"notes": "Affected: BeyondTrust / Remote Support (RS), Privileged Remote Access (PRA) | Description: Critical pre-authentication RCE vulnerability. | Patched since: 2026/02/26 | Exploitation type: unknown | CWEs: CWE-78 | Origin source: NCSC-FI | Notes: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-78"], "euvd": "EUVD-2026-5559", "notes": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Remote Support (RS), Privileged Remote Access (PRA)", "dateReported": "2026/06/04", "originSource": "NCSC-FI", "patchedSince": "2026/02/26", "vendorProject": "BeyondTrust", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-1731", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1731"}, {"id": "EUVD-2026-5559", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5559"}, {"id": "source", "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"}]}, {"uuid": "5f80298b-a3f6-4691-af7d-16426dc1e985", "vulnerability": {"vulnId": "CVE-2026-41940", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "5f80298b-a3f6-4691-af7d-16426dc1e985"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-05-08T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-05-08T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-05-08T00:00:00+00:00"}, "scope": {"notes": "Affected: WebPros / cPanel | Description: cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. | Patched since: 2026/04/28 | Exploitation type: ransomware | CWEs: CWE-306 | Origin source: CERT-PL | Notes: https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": ["CWE-306"], "euvd": "EUVD-2026-26246", "notes": "https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "cPanel", "dateReported": "2026/05/08", "originSource": "CERT-PL", "patchedSince": "2026/04/28", "vendorProject": "WebPros", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-41940", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41940"}, {"id": "EUVD-2026-26246", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26246"}, {"id": "source", "url": "https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026"}]}, {"uuid": "4b291c14-6f61-46f5-bc4a-1f39d74c8ac4", "vulnerability": {"vulnId": "CVE-2024-42009", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "4b291c14-6f61-46f5-bc4a-1f39d74c8ac4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-27T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-04-27T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-04-27T00:00:00+00:00"}, "scope": {"notes": "Affected: RoundCube / Webmail | Description: A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php. | Patched since: 2024/08/04 | Exploitation type: APT | Threat actors: UNC1151 | CWEs: CWE-79 | Origin source: CERT-PL | Notes: https://cert.pl/en/posts/2025/06/unc1151-campaign-roundcube/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-79"], "euvd": "EUVD-2024-39391", "notes": "https://cert.pl/en/posts/2025/06/unc1151-campaign-roundcube/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Webmail", "dateReported": "2026/04/27", "originSource": "CERT-PL", "patchedSince": "2024/08/04", "vendorProject": "RoundCube", "exploitationType": ["APT"], "vulnerabilityName": "", "threatActorsExploiting": ["UNC1151"]}}], "references": [{"id": "CVE-2024-42009", "url": "https://www.cve.org/CVERecord?id=CVE-2024-42009"}, {"id": "EUVD-2024-39391", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-39391"}, {"id": "source", "url": "https://cert.pl/en/posts/2025/06/unc1151-campaign-roundcube/"}]}, {"uuid": "9ff9468e-0b57-49d6-86a7-5a7bb0d29137", "vulnerability": {"vulnId": "CVE-2025-22457", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "9ff9468e-0b57-49d6-86a7-5a7bb0d29137"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-08T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-04-08T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-04-08T00:00:00+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti Connect Secure | Description: Evidence of active exploitation in the wild against ICS 9.X (end of life) and 22.7R2.5 and earlier versions since April 2025. | Patched since: 2025/02/11 | Exploitation type: unknown | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2025-9646", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Ivanti Connect Secure", "dateReported": "2026/04/08", "originSource": "CNW", "patchedSince": "2025/02/11", "vendorProject": "Ivanti", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2025-22457", "url": "https://www.cve.org/CVERecord?id=CVE-2025-22457"}, {"id": "EUVD-2025-9646", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-9646"}]}, {"uuid": "7f1c3976-3d4f-40ed-bfa5-57d6638f0fc5", "vulnerability": {"vulnId": "CVE-2025-4428", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "7f1c3976-3d4f-40ed-bfa5-57d6638f0fc5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-08T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-04-08T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-04-08T00:00:00+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM) | Description: High severity vulnerability. Successful exploitation may lead to unauthenticated remote code execution when chained together with CVE-2025-4427. | Patched since: 2026/05/13 | Exploitation type: APT | CWEs: CWE-94 | Origin source: CNW | Notes: https://ccb.belgium.be/advisories/warning-actively-exploited-zero-day-vulnerabilities-ivanti-endpoint-manager-mobile-epmm"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-94"], "euvd": "EUVD-2025-14387", "notes": "https://ccb.belgium.be/advisories/warning-actively-exploited-zero-day-vulnerabilities-ivanti-endpoint-manager-mobile-epmm", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Endpoint Manager Mobile (EPMM)", "dateReported": "2026/04/08", "originSource": "CNW", "patchedSince": "2026/05/13", "vendorProject": "Ivanti", "exploitationType": ["APT"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2025-4428", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4428"}, {"id": "EUVD-2025-14387", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-14387"}, {"id": "source", "url": "https://ccb.belgium.be/advisories/warning-actively-exploited-zero-day-vulnerabilities-ivanti-endpoint-manager-mobile-epmm"}]}, {"uuid": "39dba2c1-c8b7-481d-bca2-d32ff41dc1c8", "vulnerability": {"vulnId": "CVE-2025-53770", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "39dba2c1-c8b7-481d-bca2-d32ff41dc1c8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-08T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-04-08T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-04-08T00:00:00+00:00"}, "scope": {"notes": "Affected: Microsoft / SharePoint | Description: Microsoft confirmation of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update. | Patched since: 2025/07/19 | Exploitation type: APT | CWEs: CWE-502 | Origin source: CNW | Notes: https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-502"], "euvd": "EUVD-2025-23309", "notes": "https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "SharePoint", "dateReported": "2026/04/08", "originSource": "CNW", "patchedSince": "2025/07/19", "vendorProject": "Microsoft", "exploitationType": ["APT"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2025-53770", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53770"}, {"id": "EUVD-2025-23309", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23309"}, {"id": "source", "url": "https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770"}]}, {"uuid": "38ac1199-3029-45c5-a206-b268578a4ac6", "vulnerability": {"vulnId": "CVE-2025-55182", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "38ac1199-3029-45c5-a206-b268578a4ac6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-08T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-04-08T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-04-08T00:00:00+00:00"}, "scope": {"notes": "Affected: Meta / React Server Components | Description: Flaw in how React decodes payloads sent to React Server Function endpoints enabled unauthenticated remote code execution. Apps supporting React Server Components may still be vulnerable even if not implementing any React Server Function endpoints. | Patched since: 2025/12/03 | Exploitation type: APT | Origin source: CNW | Notes: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2025-2009839", "notes": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "React Server Components", "dateReported": "2026/04/08", "originSource": "CNW", "patchedSince": "2025/12/03", "vendorProject": "Meta", "exploitationType": ["APT"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2025-55182", "url": "https://www.cve.org/CVERecord?id=CVE-2025-55182"}, {"id": "EUVD-2025-2009839", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-2009839"}, {"id": "source", "url": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions"}]}, {"uuid": "2cdba6f3-9f8e-4ced-91f0-122077bea9ba", "vulnerability": {"vulnId": "CVE-2025-4427", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "2cdba6f3-9f8e-4ced-91f0-122077bea9ba"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-08T02:00:00+02:00"}, "timestamps": {"asserted_at": "2026-04-08T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-04-08T00:00:00+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM) | Description: Medium severity vulnerability. Successful exploitation may lead to unauthenticated remote code execution when chained together with CVE-2025-4428. | Patched since: 2026/05/13 | Exploitation type: APT | CWEs: CWE-288 | Origin source: CNW | Notes: https://ccb.belgium.be/advisories/warning-actively-exploited-zero-day-vulnerabilities-ivanti-endpoint-manager-mobile-epmm"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-288"], "euvd": "EUVD-2025-14388", "notes": "https://ccb.belgium.be/advisories/warning-actively-exploited-zero-day-vulnerabilities-ivanti-endpoint-manager-mobile-epmm", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Endpoint Manager Mobile (EPMM)", "dateReported": "2026/04/08", "originSource": "CNW", "patchedSince": "2026/05/13", "vendorProject": "Ivanti", "exploitationType": ["APT"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2025-4427", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4427"}, {"id": "EUVD-2025-14388", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-14388"}, {"id": "source", "url": "https://ccb.belgium.be/advisories/warning-actively-exploited-zero-day-vulnerabilities-ivanti-endpoint-manager-mobile-epmm"}]}, {"uuid": "2518d78e-983b-45d0-bd52-e3e3a22f3283", "vulnerability": {"vulnId": "CVE-2026-20963", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "2518d78e-983b-45d0-bd52-e3e3a22f3283"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-03-12T01:00:00+01:00"}, "timestamps": {"asserted_at": "2026-03-12T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-03-12T00:00:00+00:00"}, "scope": {"notes": "Affected: Microsoft / Microsoft SharePoint | Description: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Patched since: 2026/02/13 | Exploitation type: unknown | CWEs: CWE-502 | Origin source: CNW | Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-502"], "euvd": "EUVD-2026-2114", "notes": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Microsoft SharePoint", "dateReported": "2026/03/12", "originSource": "CNW", "patchedSince": "2026/02/13", "vendorProject": "Microsoft", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-20963", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20963"}, {"id": "EUVD-2026-2114", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2114"}, {"id": "source", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963"}]}, {"uuid": "b0632a22-8f8a-44f3-96f7-0cc09deaba81", "vulnerability": {"vulnId": "CVE-2026-1281", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "b0632a22-8f8a-44f3-96f7-0cc09deaba81"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-01-29T01:00:00+01:00"}, "timestamps": {"asserted_at": "2026-01-29T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-01-29T00:00:00+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM) | Description: A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | Patched since: 2026/05/07 | Exploitation type: unknown | Origin source: CNW | Notes: https://www.ncsc.nl/alert/casus-kwetsbaarheden-ivanti-epmm-systemen"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2026-4940", "notes": "https://www.ncsc.nl/alert/casus-kwetsbaarheden-ivanti-epmm-systemen", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Endpoint Manager Mobile (EPMM)", "dateReported": "2026/01/29", "originSource": "CNW", "patchedSince": "2026/05/07", "vendorProject": "Ivanti", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-1281", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1281"}, {"id": "EUVD-2026-4940", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4940"}, {"id": "source", "url": "https://www.ncsc.nl/alert/casus-kwetsbaarheden-ivanti-epmm-systemen"}]}, {"uuid": "09cb6afa-3642-4c48-848b-8866fbfad721", "vulnerability": {"vulnId": "CVE-2026-1340", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "09cb6afa-3642-4c48-848b-8866fbfad721"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-01-29T01:00:00+01:00"}, "timestamps": {"asserted_at": "2026-01-29T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-01-29T00:00:00+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM) | Description: A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | Patched since: 2026/05/07 | Exploitation type: unknown | Origin source: cnw | Notes: https://www.ncsc.nl/alert/casus-kwetsbaarheden-ivanti-epmm-systemen"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2026-4936", "notes": "https://www.ncsc.nl/alert/casus-kwetsbaarheden-ivanti-epmm-systemen", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Endpoint Manager Mobile (EPMM)", "dateReported": "2026/01/29", "originSource": "cnw", "patchedSince": "2026/05/07", "vendorProject": "Ivanti", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-1340", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1340"}, {"id": "EUVD-2026-4936", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4936"}, {"id": "source", "url": "https://www.ncsc.nl/alert/casus-kwetsbaarheden-ivanti-epmm-systemen"}]}, {"uuid": "a7c828c6-b71f-4e69-8544-32e15f2542a5", "vulnerability": {"vulnId": "CVE-2025-59718", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "a7c828c6-b71f-4e69-8544-32e15f2542a5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-01-27T01:00:00+01:00"}, "timestamps": {"asserted_at": "2026-01-27T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-01-27T00:00:00+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiOS,FortiProxy,FortiSwitchManager | Description: A improper verification of cryptographic signature vulnerability in Fortinet FortiOS, FortiProxy, FortiSwitchManager allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message. | Patched since: 2025/12/09 | Exploitation type: unknown | Origin source: CERT-AT | Notes: https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords, https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2025-202198", "notes": "https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords, https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "FortiOS,FortiProxy,FortiSwitchManager", "dateReported": "2026/01/27", "originSource": "CERT-AT", "patchedSince": "2025/12/09", "vendorProject": "Fortinet", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2025-59718", "url": "https://www.cve.org/CVERecord?id=CVE-2025-59718"}, {"id": "EUVD-2025-202198", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202198"}, {"id": "source", "url": "https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords"}, {"id": "source", "url": "https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation"}]}, {"uuid": "97e98a86-8dd6-4d30-a7e7-157eae96aca7", "vulnerability": {"vulnId": "CVE-2025-59719", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "97e98a86-8dd6-4d30-a7e7-157eae96aca7"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-01-27T01:00:00+01:00"}, "timestamps": {"asserted_at": "2026-01-27T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2026-01-27T00:00:00+00:00"}, "scope": {"notes": "Affected: Fortinet / Fortiweb | Description: An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message. | Patched since: 2025/12/09 | Exploitation type: unknown | Origin source: CERT-AT | Notes: https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords, https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2025-202191", "notes": "https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords, https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Fortiweb", "dateReported": "2026/01/27", "originSource": "CERT-AT", "patchedSince": "2025/12/09", "vendorProject": "Fortinet", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2025-59719", "url": "https://www.cve.org/CVERecord?id=CVE-2025-59719"}, {"id": "EUVD-2025-202191", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202191"}, {"id": "source", "url": "https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords"}, {"id": "source", "url": "https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation"}]}, {"uuid": "01c3adee-d1c3-479c-877d-c5053711777a", "vulnerability": {"vulnId": "CVE-2025-25231", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "01c3adee-d1c3-479c-877d-c5053711777a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-09-09T02:00:00+02:00"}, "timestamps": {"asserted_at": "2025-09-09T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-09-09T00:00:00+00:00"}, "scope": {"notes": "Affected: Omnissa / Omnissa Workspace ONE UEM | Description: Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints. | Patched since: 2025/08/11 | Exploitation type: unknown | CWEs: CWE-22 | Origin source: CERT-PL | Notes: https://moje.cert.pl/komunikaty/2025/29/aktywnie-wykorzystywana-krytyczna-podatnosc-w-narzedziu-omnissa-workspace-one-uem-airwatch-mdm/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-22"], "euvd": "EUVD-2025-24160", "notes": "https://moje.cert.pl/komunikaty/2025/29/aktywnie-wykorzystywana-krytyczna-podatnosc-w-narzedziu-omnissa-workspace-one-uem-airwatch-mdm/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Omnissa Workspace ONE UEM", "dateReported": "2025/09/09", "originSource": "CERT-PL", "patchedSince": "2025/08/11", "vendorProject": "Omnissa", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2025-25231", "url": "https://www.cve.org/CVERecord?id=CVE-2025-25231"}, {"id": "EUVD-2025-24160", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24160"}, {"id": "source", "url": "https://moje.cert.pl/komunikaty/2025/29/aktywnie-wykorzystywana-krytyczna-podatnosc-w-narzedziu-omnissa-workspace-one-uem-airwatch-mdm/"}]}, {"uuid": "ffa1e340-1807-47eb-8cd0-bbc3b5821992", "vulnerability": {"vulnId": "CVE-2025-6543", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "ffa1e340-1807-47eb-8cd0-bbc3b5821992"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-18T02:00:00+02:00"}, "timestamps": {"asserted_at": "2025-07-18T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-07-18T00:00:00+00:00"}, "scope": {"notes": "Affected: Citrix / NetScaler ADC and NetScaler Gateway | Description: Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. | Patched since: 2025/06/25 | Exploitation type: unknown | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2025-19085", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "NetScaler ADC and NetScaler Gateway", "dateReported": "2025/07/18", "originSource": "CNW", "patchedSince": "2025/06/25", "vendorProject": "Citrix", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2025-6543", "url": "https://www.cve.org/CVERecord?id=CVE-2025-6543"}, {"id": "EUVD-2025-19085", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19085"}]}, {"uuid": "c57b0c40-ade6-4df8-8002-28e882199a35", "vulnerability": {"vulnId": "CVE-2011-4085", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "c57b0c40-ade6-4df8-8002-28e882199a35"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-14T02:00:00+02:00"}, "timestamps": {"asserted_at": "2025-07-14T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-07-14T00:00:00+00:00"}, "scope": {"notes": "Affected: Red Hat / JBoss Application Server | Description: Some management interfaces remain accessible and lack effective access control mechanisms | Patched since: 2011/12/08 | Exploitation type: unknown | Origin source: CERT Italia | Notes: https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2011-4036", "notes": "https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "JBoss Application Server", "dateReported": "2025/07/14", "originSource": "CERT Italia", "patchedSince": "2011/12/08", "vendorProject": "Red Hat", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2011-4085", "url": "https://www.cve.org/CVERecord?id=CVE-2011-4085"}, {"id": "EUVD-2011-4036", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2011-4036"}, {"id": "source", "url": "https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note"}]}, {"uuid": "bbe97ec7-3c63-4db5-a70b-14e3fa67893b", "vulnerability": {"vulnId": "CVE-2015-7501", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "bbe97ec7-3c63-4db5-a70b-14e3fa67893b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-14T02:00:00+02:00"}, "timestamps": {"asserted_at": "2025-07-14T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-07-14T00:00:00+00:00"}, "scope": {"notes": "Affected: Apache / Commons Collections library | Description: the system accepts serialized objects without verifying their origin or reliability allowing an attacker to send specially crafted payloads that are then deserialized and executed | Patched since: 2015/11/12 | Exploitation type: unknown | Origin source: CERT Italia | Notes: https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2022-3799", "notes": "https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Commons Collections library", "dateReported": "2025/07/14", "originSource": "CERT Italia", "patchedSince": "2015/11/12", "vendorProject": "Apache", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2015-7501", "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"}, {"id": "EUVD-2022-3799", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3799"}, {"id": "source", "url": "https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note"}]}, {"uuid": "8b800f60-4909-45c7-a4e4-ab1d4cec9feb", "vulnerability": {"vulnId": "CVE-2017-12149", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "8b800f60-4909-45c7-a4e4-ab1d4cec9feb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-14T02:00:00+02:00"}, "timestamps": {"asserted_at": "2025-07-14T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-07-14T00:00:00+00:00"}, "scope": {"notes": "Affected: Red Hat / JBoss Application Server | Description: Servlet exposes an endpoint that allows you to invoke Java Management Extensions (JMX) operations without any authentication or access control | Patched since: 2018/05/17 | Exploitation type: unknown | Origin source: CERT Italia | Notes: https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2017-3733", "notes": "https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "JBoss Application Server", "dateReported": "2025/07/14", "originSource": "CERT Italia", "patchedSince": "2018/05/17", "vendorProject": "Red Hat", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2017-12149", "url": "https://www.cve.org/CVERecord?id=CVE-2017-12149"}, {"id": "EUVD-2017-3733", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3733"}, {"id": "source", "url": "https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note"}]}, {"uuid": "404c3bd9-8d27-4832-9225-56c8e200165c", "vulnerability": {"vulnId": "CVE-2010-0738", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "404c3bd9-8d27-4832-9225-56c8e200165c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-14T02:00:00+02:00"}, "timestamps": {"asserted_at": "2025-07-14T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-07-14T00:00:00+00:00"}, "scope": {"notes": "Affected: Red Hat / JBoss Application Server | Description: This management interface allows administrative operations to be performed without adequate access controls allowing a remote attacker to interact with the system in an unauthorized manner | Patched since: 2010/10/12 | Exploitation type: unknown | Origin source: CERT Italia | Notes: https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2010-0764", "notes": "https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "JBoss Application Server", "dateReported": "2025/07/14", "originSource": "CERT Italia", "patchedSince": "2010/10/12", "vendorProject": "Red Hat", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2010-0738", "url": "https://www.cve.org/CVERecord?id=CVE-2010-0738"}, {"id": "EUVD-2010-0764", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-0764"}, {"id": "source", "url": "https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note"}]}, {"uuid": "22118bc0-ae1f-4284-8a3a-6d6260cee977", "vulnerability": {"vulnId": "CVE-2024-55591", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "22118bc0-ae1f-4284-8a3a-6d6260cee977"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-13T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-02-13T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-02-13T00:00:00+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiOS/FortiProxy | Description: Authentication bypass using an alternate path or channel vulnerability | Patched since: 2025/01/14 | Exploitation type: ransomware | CWEs: CWE-288 | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": ["CWE-288"], "euvd": "EUVD-2024-52819", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "FortiOS/FortiProxy", "dateReported": "2025/02/13", "originSource": "CNW", "patchedSince": "2025/01/14", "vendorProject": "Fortinet", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2024-55591", "url": "https://www.cve.org/CVERecord?id=CVE-2024-55591"}, {"id": "EUVD-2024-52819", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52819"}]}, {"uuid": "ea0b40df-9827-4983-ad50-c780435b0570", "vulnerability": {"vulnId": "CVE-2017-0144", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "ea0b40df-9827-4983-ad50-c780435b0570"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-23T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-23T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-23T00:00:00+00:00"}, "scope": {"notes": "EternalBlue | Affected: Microsoft / Windows (SMBv1) | Description: The SMBv1 server in multiple Microsoft Windows SMBv1 allows remote attackers to execute arbitrary code via crafted packets. | Patched since: 2017/03/14 | Exploitation type: ransomware | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2017-0511", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Windows (SMBv1)", "dateReported": "2025/01/23", "originSource": "CNW", "patchedSince": "2017/03/14", "vendorProject": "Microsoft", "exploitationType": ["ransomware"], "vulnerabilityName": "EternalBlue", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2017-0144", "url": "https://www.cve.org/CVERecord?id=CVE-2017-0144"}, {"id": "EUVD-2017-0511", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0511"}]}, {"uuid": "e426a073-a535-49e3-bcb4-7fdf2069dc70", "vulnerability": {"vulnId": "CVE-2020-0787", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "e426a073-a535-49e3-bcb4-7fdf2069dc70"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-23T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-23T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-23T00:00:00+00:00"}, "scope": {"notes": "Affected: Microsoft / Windows BITS26 | Description: Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability. | Patched since: 2020/03/10 | Exploitation type: ransomware | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2020-2274", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Windows BITS26", "dateReported": "2025/01/23", "originSource": "CNW", "patchedSince": "2020/03/10", "vendorProject": "Microsoft", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2020-0787", "url": "https://www.cve.org/CVERecord?id=CVE-2020-0787"}, {"id": "EUVD-2020-2274", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-2274"}]}, {"uuid": "e1e2f3f2-567a-40a9-ba82-acfdb8aa60f6", "vulnerability": {"vulnId": "CVE-2023-3519", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "e1e2f3f2-567a-40a9-ba82-acfdb8aa60f6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-23T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-23T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-23T00:00:00+00:00"}, "scope": {"notes": "Affected: Citrix / NetScaler ADC and NetScaler Gateway | Description: Unauthenticated remote code execution | Patched since: 2023/07/18 | Exploitation type: ransomware | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2023-44176", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "NetScaler ADC and NetScaler Gateway", "dateReported": "2025/01/23", "originSource": "CNW", "patchedSince": "2023/07/18", "vendorProject": "Citrix", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2023-3519", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3519"}, {"id": "EUVD-2023-44176", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44176"}]}, {"uuid": "ddc41a81-f149-4ab7-92bb-25c77073d71c", "vulnerability": {"vulnId": "CVE-2020-1472", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "ddc41a81-f149-4ab7-92bb-25c77073d71c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-23T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-23T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-23T00:00:00+00:00"}, "scope": {"notes": "Affected: Microsoft / Netlogon (ZeroLogon) | Description: Elevation of privilege vulnerability that exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). | Patched since: 2020/08/11 | Exploitation type: ransomware | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2020-12346", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Netlogon (ZeroLogon)", "dateReported": "2025/01/23", "originSource": "CNW", "patchedSince": "2020/08/11", "vendorProject": "Microsoft", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2020-1472", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1472"}, {"id": "EUVD-2020-12346", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12346"}]}, {"uuid": "8d074859-a2fb-4174-a2e0-e9d2f191f8d3", "vulnerability": {"vulnId": "CVE-2023-22515", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "8d074859-a2fb-4174-a2e0-e9d2f191f8d3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-23T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-23T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-23T00:00:00+00:00"}, "scope": {"notes": "Affected: Atlassian / Confluence Server and Data Server | Description: Vulnerability in publicly accessible Confluence Data Center and Server instances that enables the creation of unauthorized Confluence administrator accounts and access to a Confluence instance | Patched since: 2023/10/04 | Exploitation type: ransomware | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2023-26655", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Confluence Server and Data Server", "dateReported": "2025/01/23", "originSource": "CNW", "patchedSince": "2023/10/04", "vendorProject": "Atlassian", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2023-22515", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22515"}, {"id": "EUVD-2023-26655", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26655"}]}, {"uuid": "86d3b651-d7b5-411f-bf8c-3ff51b4b31c9", "vulnerability": {"vulnId": "CVE-2023-46747", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "86d3b651-d7b5-411f-bf8c-3ff51b4b31c9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-23T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-23T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-23T00:00:00+00:00"}, "scope": {"notes": "Affected: F5 / BIG-IP | Description: Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands | Patched since: 2023/10/26 | Exploitation type: ransomware | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2023-50916", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "BIG-IP", "dateReported": "2025/01/23", "originSource": "CNW", "patchedSince": "2023/10/26", "vendorProject": "F5", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2023-46747", "url": "https://www.cve.org/CVERecord?id=CVE-2023-46747"}, {"id": "EUVD-2023-50916", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50916"}]}, {"uuid": "7f8450ce-7987-4c4d-af9a-4ef0c5569ac4", "vulnerability": {"vulnId": "CVE-2023-46604", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "7f8450ce-7987-4c4d-af9a-4ef0c5569ac4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-23T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-23T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-23T00:00:00+00:00"}, "scope": {"notes": "Affected: Apache / ActiveMQ | Description: RCE vulnerability that allows remote attackers with network access to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath | Patched since: 2023/10/27 | Exploitation type: ransomware | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2023-2719", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "ActiveMQ", "dateReported": "2025/01/23", "originSource": "CNW", "patchedSince": "2023/10/27", "vendorProject": "Apache", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2023-46604", "url": "https://www.cve.org/CVERecord?id=CVE-2023-46604"}, {"id": "EUVD-2023-2719", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2719"}]}, {"uuid": "7c4b5c90-5f55-489b-a6ed-6e2d31bf0ecc", "vulnerability": {"vulnId": "CVE-2023-48788", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "7c4b5c90-5f55-489b-a6ed-6e2d31bf0ecc"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-23T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-23T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-23T00:00:00+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiClientEMS | Description: SQLi vulnerability in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attackers to execute unauthorized code or commands. | Patched since: 2024/03/12 | Exploitation type: ransomware | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2023-52821", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "FortiClientEMS", "dateReported": "2025/01/23", "originSource": "CNW", "patchedSince": "2024/03/12", "vendorProject": "Fortinet", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2023-48788", "url": "https://www.cve.org/CVERecord?id=CVE-2023-48788"}, {"id": "EUVD-2023-52821", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-52821"}]}, {"uuid": "438a5184-79b8-4bb7-b934-459e2b7e19d1", "vulnerability": {"vulnId": "CVE-2023-27997", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "438a5184-79b8-4bb7-b934-459e2b7e19d1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-23T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-23T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-23T00:00:00+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiOS and FortiProxy | Description: Heap-based buffer overflow vulnerability may allow remote attackers to execute arbitrary code or commands | Patched since: 2023/06/09 | Exploitation type: ransomware | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2023-31722", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "FortiOS and FortiProxy", "dateReported": "2025/01/23", "originSource": "CNW", "patchedSince": "2023/06/09", "vendorProject": "Fortinet", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2023-27997", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27997"}, {"id": "EUVD-2023-31722", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-31722"}]}, {"uuid": "ddf9b7a1-9e78-459f-bb38-2da2b70ae91c", "vulnerability": {"vulnId": "CVE-2024-8190", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "ddf9b7a1-9e78-459f-bb38-2da2b70ae91c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-17T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-17T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-17T00:00:00+00:00"}, "scope": {"notes": "Affected: Ivanti / Cloud Services Appliance (CSA) | Description: OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker with admin privileges to obtain RCE. | Patched since: 2024/09/10 | Exploitation type: unknown | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2024-49004", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Cloud Services Appliance (CSA)", "dateReported": "2025/01/17", "originSource": "CNW", "patchedSince": "2024/09/10", "vendorProject": "Ivanti", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2024-8190", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8190"}, {"id": "EUVD-2024-49004", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49004"}]}, {"uuid": "46a3763c-c128-4203-ab44-530af9c7da1e", "vulnerability": {"vulnId": "CVE-2024-9380", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "46a3763c-c128-4203-ab44-530af9c7da1e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-17T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-17T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-17T00:00:00+00:00"}, "scope": {"notes": "Affected: Ivanti / Cloud Services Appliance (CSA) | Description: OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution. | Patched since: 2024/10/08 | Exploitation type: unknown | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2024-49898", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Cloud Services Appliance (CSA)", "dateReported": "2025/01/17", "originSource": "CNW", "patchedSince": "2024/10/08", "vendorProject": "Ivanti", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2024-9380", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9380"}, {"id": "EUVD-2024-49898", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49898"}]}, {"uuid": "0dc2945f-b7c8-41fd-9b6f-885aad3ae2ba", "vulnerability": {"vulnId": "CVE-2024-8963", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "object_uuid": "0dc2945f-b7c8-41fd-9b6f-885aad3ae2ba"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-17T01:00:00+01:00"}, "timestamps": {"asserted_at": "2025-01-17T00:00:00+00:00", "recorded_at": "2026-10-02T06:52:36+00:00", "first_seen_at": "2025-01-17T00:00:00+00:00"}, "scope": {"notes": "Affected: Ivanti / Cloud Services Appliance (CSA) | Description: Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. | Patched since: 2024/09/10 | Exploitation type: unknown | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": [], "euvd": "EUVD-2024-49510", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Cloud Services Appliance (CSA)", "dateReported": "2025/01/17", "originSource": "CNW", "patchedSince": "2024/09/10", "vendorProject": "Ivanti", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2024-8963", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8963"}, {"id": "EUVD-2024-49510", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49510"}]}]}