https://vulnerability.circl.lu/sightings/feed 2026-09-17T12:07:10.555188+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/853e9c4a-e846-458b-98d3-db50a69f1f84/export 2026-09-17T12:07:10.572219+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "853e9c4a-e846-458b-98d3-db50a69f1f84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-47075", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-15)", "content": "", "creation_timestamp": "2026-09-16T10:00:08.234532Z"} 2026-09-16T10:00:08.234532+00:00 https://vulnerability.circl.lu/sighting/43d5a8fd-0329-4c83-ad0a-8b3fd5a9316e/export 2026-09-17T12:07:10.574537+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "43d5a8fd-0329-4c83-ad0a-8b3fd5a9316e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-47986", "type": "seen", "source": "https://t.me/cissp/6627", "content": "CISA has updated its Known Exploited Vulnerabilities catalog with three new vulnerabilities that are currently being exploited \u2014 IBM Aspera Faspex (CVE-2022-47986) and Mitel MiVoice Connect (CVE-2022-41223 and CVE-2022-40765).\nRead more: https://thehackernews.com/2023/02/us-cybersecurity-agency-cisa-adds-three.html\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.12.03", "creation_timestamp": "2026-09-11T00:00:54.736936Z"} 2026-09-11T00:00:54.736936+00:00 https://vulnerability.circl.lu/sighting/4a1b4f93-51e5-4031-a638-919122b84045/export 2026-09-17T12:07:10.574777+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4a1b4f93-51e5-4031-a638-919122b84045", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-47966", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6526", "content": "Blue Team Techniques\n1. YARA/Sigma rule to detect the exploitation of ManageEngine ServiceDesk CVE-2022-47966\nhttps://github.com/Neo23x0/signature-base/blob/master/yara/expl_manageengine_jan23.yar\nhttps://github.com/SigmaHQ/sigma/pull/3935/files\n\n2. Investigate malicious Windows logon by visualizing and analyzing Windows event log\nhttps://github.com/JPCERTCC/LogonTracer\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.10.30", "creation_timestamp": "2026-09-11T00:00:53.393953Z"} 2026-09-11T00:00:53.393953+00:00 https://vulnerability.circl.lu/sighting/43af0c47-d6ab-49a5-ab92-fd3031566b1b/export 2026-09-17T12:07:10.574976+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "43af0c47-d6ab-49a5-ab92-fd3031566b1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-47966", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6496", "content": "\ud83d\udd25 Don't wait until it's too late!\n\nZoho ManageEngine users, patch your instances now to avoid falling victim to critical CVE-2022-47966 vulnerability.\n\nDetails: https://thehackernews.com/2023/01/zoho-manageengine-poc-exploit-to-be.html\n\nResearchers are about to release PoC exploit code.\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.10.27", "creation_timestamp": "2026-09-11T00:00:52.950032Z"} 2026-09-11T00:00:52.950032+00:00 https://vulnerability.circl.lu/sighting/e8cf86a4-8bc9-459b-bd40-5c100690918b/export 2026-09-17T12:07:10.575144+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "e8cf86a4-8bc9-459b-bd40-5c100690918b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-47966", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6496", "content": "\ud83d\udd25 Don't wait until it's too late!\n\nZoho ManageEngine users, patch your instances now to avoid falling victim to critical CVE-2022-47966 vulnerability.\n\nDetails: https://thehackernews.com/2023/01/zoho-manageengine-poc-exploit-to-be.html\n\nResearchers are about to release PoC exploit code.\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.10.27", "creation_timestamp": "2026-09-10T04:00:04.817682Z"} 2026-09-10T04:00:04.817682+00:00 https://vulnerability.circl.lu/sighting/120065e2-a9b9-44ce-8f7b-72d1b27368e7/export 2026-09-17T12:07:10.575310+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "120065e2-a9b9-44ce-8f7b-72d1b27368e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-47986", "type": "seen", "source": "https://t.me/cissp/6627", "content": "CISA has updated its Known Exploited Vulnerabilities catalog with three new vulnerabilities that are currently being exploited \u2014 IBM Aspera Faspex (CVE-2022-47986) and Mitel MiVoice Connect (CVE-2022-41223 and CVE-2022-40765).\nRead more: https://thehackernews.com/2023/02/us-cybersecurity-agency-cisa-adds-three.html\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.12.03", "creation_timestamp": "2026-09-10T03:00:05.172165Z"} 2026-09-10T03:00:05.172165+00:00 https://vulnerability.circl.lu/sighting/6021af90-39ec-48a8-a7de-ebcf78cfe2d5/export 2026-09-17T12:07:10.575472+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "6021af90-39ec-48a8-a7de-ebcf78cfe2d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-47966", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6526", "content": "Blue Team Techniques\n1. YARA/Sigma rule to detect the exploitation of ManageEngine ServiceDesk CVE-2022-47966\nhttps://github.com/Neo23x0/signature-base/blob/master/yara/expl_manageengine_jan23.yar\nhttps://github.com/SigmaHQ/sigma/pull/3935/files\n\n2. Investigate malicious Windows logon by visualizing and analyzing Windows event log\nhttps://github.com/JPCERTCC/LogonTracer\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.10.30", "creation_timestamp": "2026-09-10T03:00:03.584377Z"} 2026-09-10T03:00:03.584377+00:00 https://vulnerability.circl.lu/sighting/2a5ded5d-aabe-4f5e-bd37-d48fcb9200ad/export 2026-09-17T12:07:10.575649+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "2a5ded5d-aabe-4f5e-bd37-d48fcb9200ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-47075", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:08.636964Z"} 2026-09-09T10:00:08.636964+00:00 https://vulnerability.circl.lu/sighting/29bd65b2-5d58-48dc-8fc3-abba1772be38/export 2026-09-17T12:07:10.575805+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "29bd65b2-5d58-48dc-8fc3-abba1772be38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-47966", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966.rb", "content": "{\"aliases\": [], \"arch\": \"java, x86, x64, cmd\", \"author\": [\"Khoa Dinh\", \"horizon3ai\", \"Christophe De La Fuente\", \"h00die-gr3y \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploits an unauthenticated remote code execution vulnerability\\n that affects Zoho ManageEngine Endpoint Central and MSP versions 10.1.2228.10\\n and below (CVE-2022-47966). Due to a dependency to an outdated library\\n (Apache Santuario version 1.4.1), it is possible to execute arbitrary\\n code by providing a crafted `samlResponse` XML to the Endpoint Central\\n SAML endpoint. Note that the target is only vulnerable if it is\\n configured with SAML-based SSO , and the service should be active.\", \"disclosure_date\": \"2023-01-10\", \"fullname\": \"exploit/windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"ManageEngine Endpoint Central Unauthenticated SAML RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966.rb\", \"platform\": \"Java,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966\", \"references\": [\"CVE-2022-47966\", \"URL-https://blog.viettelcybersecurity.com/saml-show-stopper/\", \"URL-https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/\", \"URL-https://github.com/horizon3ai/CVE-2022-47966\", \"URL-https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis\"], \"rport\": 8020, \"session_types\": false, \"targets\": [\"Java (in-memory)\", \"Windows EXE Dropper\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:54.481976Z"} 2026-09-08T06:51:54.481976+00:00 https://vulnerability.circl.lu/sighting/4f420b1d-b308-45f5-9d42-f07dec84968b/export 2026-09-17T12:07:10.575970+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4f420b1d-b308-45f5-9d42-f07dec84968b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-47966", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966.rb", "content": "{\"aliases\": [], \"arch\": \"java, x86, x64, cmd\", \"author\": [\"Khoa Dinh\", \"horizon3ai\", \"Christophe De La Fuente\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploits an unauthenticated remote code execution vulnerability\\n that affects Zoho ManageEngine ServiceDesk Plus versions 14003 and\\n below (CVE-2022-47966). Due to a dependency to an outdated library\\n (Apache Santuario version 1.4.1), it is possible to execute arbitrary\\n code by providing a crafted `samlResponse` XML to the ServiceDesk Plus\\n SAML endpoint. Note that the target is only vulnerable if it has been\\n configured with SAML-based SSO at least once in the past, regardless of\\n the current SAML-based SSO status.\", \"disclosure_date\": \"2023-01-10\", \"fullname\": \"exploit/multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:58 +0000\", \"name\": \"ManageEngine ServiceDesk Plus Unauthenticated SAML RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966.rb\", \"platform\": \"Java,Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966\", \"references\": [\"CVE-2022-47966\", \"URL-https://blog.viettelcybersecurity.com/saml-show-stopper/\", \"URL-https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/\", \"URL-https://github.com/horizon3ai/CVE-2022-47966\", \"URL-https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis\"], \"rport\": 8080, \"session_types\": false, \"targets\": [\"Java (in-memory)\", \"Windows EXE Dropper\", \"Windows Command\", \"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:01.864187Z"} 2026-09-08T06:50:01.864187+00:00