GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68432 (GCVE-0-2026-68432)

Vulnerability from cvelistv5 – Published: 2026-08-12 00:07 – Updated: 2026-08-19 16:35
VLAI
Title
vxlan: require CAP_NET_ADMIN in the device netns for changelink
Summary
In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in vxlan->net can rewrite a vxlan device whose underlay lives in vxlan->net. vxlan_changelink() validates and applies the new configuration against vxlan->net (vxlan_config_validate(vxlan->net, ...)) and can reopen the underlay socket in that netns, so the same reasoning as the tunnel changelink series applies here. Gate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of the op before any attribute is parsed, matching ipgre_changelink() and the rest of the "require CAP_NET_ADMIN in the device netns for changelink" series. Found by 0sec automated security-research tooling (https://0sec.ai).
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 , < b95a8743e58f7efed5ddc4cb73829b66f17feab0 (git)
Affected: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 , < 7465ade989ba84adc2bfa58bad3ca25d249f0f7a (git)
Affected: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 , < 0aa580a8bbbed2507b4582a1f0ef581d480d06ed (git)
Affected: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 , < b3793d7dccb192ffff29894d11824db6251acdd5 (git)
Affected: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 , < 32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f (git)
Affected: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 , < 730c7e5fea7f06e0cdf21c547222ec93234fd1d6 (git)
Affected: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 , < e8ad0d311e225939a9a6c745d6cc384c7364ec87 (git)
Affected: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 , < 3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b95a8743e58f7efed5ddc4cb73829b66f17feab0",
              "status": "affected",
              "version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
              "versionType": "git"
            },
            {
              "lessThan": "7465ade989ba84adc2bfa58bad3ca25d249f0f7a",
              "status": "affected",
              "version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
              "versionType": "git"
            },
            {
              "lessThan": "0aa580a8bbbed2507b4582a1f0ef581d480d06ed",
              "status": "affected",
              "version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
              "versionType": "git"
            },
            {
              "lessThan": "b3793d7dccb192ffff29894d11824db6251acdd5",
              "status": "affected",
              "version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
              "versionType": "git"
            },
            {
              "lessThan": "32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f",
              "status": "affected",
              "version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
              "versionType": "git"
            },
            {
              "lessThan": "730c7e5fea7f06e0cdf21c547222ec93234fd1d6",
              "status": "affected",
              "version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
              "versionType": "git"
            },
            {
              "lessThan": "e8ad0d311e225939a9a6c745d6cc384c7364ec87",
              "status": "affected",
              "version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
              "versionType": "git"
            },
            {
              "lessThan": "3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e",
              "status": "affected",
              "version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe sticky underlay netns vxlan-\u003enet. They differ once the device is\ncreated in or moved to a netns other than the one the request runs in.\nThe rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),\nso a caller privileged there but not in vxlan-\u003enet can rewrite a vxlan\ndevice whose underlay lives in vxlan-\u003enet.\n\nvxlan_changelink() validates and applies the new configuration against\nvxlan-\u003enet (vxlan_config_validate(vxlan-\u003enet, ...)) and can reopen the\nunderlay socket in that netns, so the same reasoning as the tunnel\nchangelink series applies here.\n\nGate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of\nthe op before any attribute is parsed, matching ipgre_changelink() and\nthe rest of the \"require CAP_NET_ADMIN in the device netns for\nchangelink\" series.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires issuing an RTM_NEWLINK changelink request over an rtnetlink socket on the local system, matching the kernel guidance that netlink configuration paths are Local.\nAC:L - Once a cross-namespace vxlan device is present in the caller\u0027s netns, the missing check is bypassed by a single deterministic netlink changelink call with no race, timing, or memory-layout dependency.\nPR:L - The rtnl entry path only requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user obtains inside a user namespace via unshare --user --map-root-user --net; no privilege in the underlay netns vxlan-\u003enet is needed.\nUI:N - The attack is fully programmatic through netlink from the attacker\u0027s own process; no victim action such as mounting, opening a file, or clicking is required.\nS:C - Authorization is evaluated against dev_net(dev) while the configuration is validated and applied against vxlan-\u003enet, so the impact crosses from the attacker\u0027s net/user namespace into another tenant\u0027s or the host\u0027s network namespace.\nC:H - The attacker can rewrite IFLA_VXLAN_GROUP/LOCAL and the underlay IFLA_VXLAN_LINK so encapsulated overlay traffic in the victim netns is sent to an attacker-controlled endpoint, exposing tunneled payloads.\nI:H - Unauthorized changelink mutates live tunnel state in the victim underlay netns (remote/local addresses, lower device, TOS/TTL/label, learning and proxy/RSC flags, default-remote FDB entries), enabling redirection and injection of overlay traffic.\nA:H - Rewriting the remote group, source address, or lower device tears down and re-establishes multicast group membership and forwarding state, causing sustained loss of connectivity for every service riding the affected VXLAN overlay."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:30.743Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b95a8743e58f7efed5ddc4cb73829b66f17feab0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7465ade989ba84adc2bfa58bad3ca25d249f0f7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aa580a8bbbed2507b4582a1f0ef581d480d06ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3793d7dccb192ffff29894d11824db6251acdd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f"
        },
        {
          "url": "https://git.kernel.org/stable/c/730c7e5fea7f06e0cdf21c547222ec93234fd1d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8ad0d311e225939a9a6c745d6cc384c7364ec87"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e"
        }
      ],
      "title": "vxlan: require CAP_NET_ADMIN in the device netns for changelink",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68432",
    "datePublished": "2026-08-12T00:07:18.806Z",
    "dateReserved": "2026-07-30T09:28:09.393Z",
    "dateUpdated": "2026-08-19T16:35:30.743Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68432",
      "date": "2026-09-16",
      "epss": "0.0013",
      "percentile": "0.02978"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68432\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-12T00:17:43.290\",\"lastModified\":\"2026-08-19T17:20:50.010\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvxlan: require CAP_NET_ADMIN in the device netns for changelink\\n\\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\\nthe sticky underlay netns vxlan-\u003enet. They differ once the device is\\ncreated in or moved to a netns other than the one the request runs in.\\nThe rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),\\nso a caller privileged there but not in vxlan-\u003enet can rewrite a vxlan\\ndevice whose underlay lives in vxlan-\u003enet.\\n\\nvxlan_changelink() validates and applies the new configuration against\\nvxlan-\u003enet (vxlan_config_validate(vxlan-\u003enet, ...)) and can reopen the\\nunderlay socket in that netns, so the same reasoning as the tunnel\\nchangelink series applies here.\\n\\nGate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of\\nthe op before any attribute is parsed, matching ipgre_changelink() and\\nthe rest of the \\\"require CAP_NET_ADMIN in the device netns for\\nchangelink\\\" series.\\n\\nFound by 0sec automated security-research tooling (https://0sec.ai).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/vxlan/vxlan_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\"lessThan\":\"b95a8743e58f7efed5ddc4cb73829b66f17feab0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\"lessThan\":\"7465ade989ba84adc2bfa58bad3ca25d249f0f7a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\"lessThan\":\"0aa580a8bbbed2507b4582a1f0ef581d480d06ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\"lessThan\":\"b3793d7dccb192ffff29894d11824db6251acdd5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\"lessThan\":\"32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\"lessThan\":\"730c7e5fea7f06e0cdf21c547222ec93234fd1d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\"lessThan\":\"e8ad0d311e225939a9a6c745d6cc384c7364ec87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\"lessThan\":\"3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/vxlan/vxlan_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0aa580a8bbbed2507b4582a1f0ef581d480d06ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/730c7e5fea7f06e0cdf21c547222ec93234fd1d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7465ade989ba84adc2bfa58bad3ca25d249f0f7a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b3793d7dccb192ffff29894d11824db6251acdd5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b95a8743e58f7efed5ddc4cb73829b66f17feab0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e8ad0d311e225939a9a6c745d6cc384c7364ec87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-26T13:32:29+00:00",
      "cve": "CVE-2026-68432",
      "id": "CVE-2026-68432",
      "initial_release_date": "2026-08-12T00:00:00+00:00",
      "product_status:known_affected": "245",
      "product_status:known_not_affected": "30",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68432.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:33:54Z",
      "cve": "CVE-2026-68432",
      "id": "CVE-2026-68432",
      "initial_release_date": "2026-08-12T16:22:08Z",
      "product_status:first_fixed": "88",
      "product_status:known_affected": "741",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68432",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68432.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.