CY-GAP-0301OPENHIGH
EXPOSURE_PREVALENCE
جارٍ تحميل البيانات التشغيلية
VEI
CVEs, KEV, active exploitation, zero-days, exploit chains, vendor patches, exposed attack surfaces and defensive forensics
3
36
190
86
12
٠٣/١١/٢٠٢٦، ١:١٣ م
ACRIP-VEI-20261101T143100Z-5E8A14C3 CLOSED/PASS. Siemens CVE-2026-58115 Topic committed and Hot-Start read back; unauthenticated maximum-privilege RCE + late-Oct VulnCheck exploitation delta verified; success/exposure/OT-impact/attribution gaps preserved.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
الإجمالي: 12 Evidence
Public evidence does not establish the current internet-wide population of vulnerable/unpatched Ivanti Connect Secure appliances or a reliable victim count for this exploit chain.
Version-aware asset/internet telemetry, vendor patch-deployment data or multi-victim IR/provider reporting.
The identity, motive, number of operators/victims and breadth of UTA0576 activity remain insufficiently established.
Independent actor-linked infrastructure, authoritative attribution and repeated victim telemetry.
CVE-2026-118527 was added to KEV on 2026-10-30 as chainable with CVE-2026-104935 and CVE-2026-111357, while Volexity's original 2026-10-13 reconstruction described the file-write component without assigning that later identifier in its original text.
Updated vendor/CVE authority mapping each component and affected version with publication timestamps preserved.
No authoritative public denominator establishes widespread exploitation after disclosure; BeyondTrust last named two impacted customers and no observed activity since August.
Independent IR/CERT/provider victim telemetry or updated authoritative denominator.
No public authoritative denominator of successful compromises, attack volume, victims or affected-sector distribution for CVE-2026-58115.
VulnCheck raw telemetry, Siemens/CERT victim reporting or multi-victim IR/provider evidence.
No reliable public denominator of reachable vulnerable SIMATIC IoT2050 Advanced devices with Node-RED enabled and affected versions.
Version/config-aware asset telemetry or authenticated inventory.
No reliable public count of successfully exploited GitLab victims, attack volume or current compromised population for CVE-2026-97229.
CISA raw evidence, multi-victim IR/provider telemetry or authoritative victim reporting.
Exact original private exploit route and whether it removes the content-write prerequisite in Rapid7's public chain remain undisclosed.
Original HackerOne/vendor technical disclosure or independent no-write-precondition reproduction.
No public primary incident evidence recovered for payload behavior, process manipulation, safety effects, persistence or downstream post-exploitation actions on a successfully compromised victim.
Victim/IR artifacts, process telemetry, payload samples or authoritative incident disclosure.
Actor identity, infrastructure, campaign clustering, motives and ransomware relationship remain unproven.
Independent actor-linked infrastructure, repeated incident artifacts or authoritative attribution.
No reliable denominator exists for custom GitLab deployments upgraded at the app layer but still using vulnerable Ruby/Onigmo.
Version-aware GitLab+Ruby telemetry or large-sample authenticated inventory.
Actor identity, infrastructure, victim clustering, campaign breadth and ransomware relationship remain unproven.
Independent actor-linked infrastructure, repeated incident artifacts or authoritative attribution.