CVE-2026-19429 (GCVE-0-2026-19429)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:07 – Updated: 2026-08-10 18:21
VLAI
Title
Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass (Arbitrary File Read)
Summary
Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not targets. The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target — the path returned by te.getLinkName() and passed directly to symlinkTo() — is never validated and may point to any path on the controller filesystem. An attacker with Item/Configure permission can configure a job to extract a malicious .tar or .tar.gz archive via a tool installer or custom build step. When FilePath.untarFrom() processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths. By targeting the entire $JENKINS_HOME/secrets/ directory — including master.key, hudson.util.Secret, hudson.model.Secrets.xml, and any other files present — an attacker can exfiltrate all Jenkins cryptographic material through the workspace viewer (GET /job/{name}/ws/) or build artifacts. Combined with credentials.xml and per-user config.xml files, this enables offline AES-128 decryption of all {AQA...}-format credential entries, exposing in plaintext every password, API key, cloud provider secret, and SSH private key stored in the Jenkins credential store — compromising all downstream systems those credentials protect.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
8.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Date Public
2026-08-10 12:00
Credits
Jamshed Yergashvoyev (CVE GUY | TuranSec)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T15:34:41.496974Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T18:21:50.651Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jamshed Yergashvoyev (CVE GUY | TuranSec)"
        }
      ],
      "datePublic": "2026-08-10T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eJenkins \u003ccode\u003eFilePath.untarFrom()\u003c/code\u003e in all versions, including those with the CVE-2026-33001 patch applied, validates symlink \u003cstrong\u003edestinations\u003c/strong\u003e but not \u003cstrong\u003etargets\u003c/strong\u003e.\u003c/p\u003e\u003cp\u003eThe CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target \u2014 the path returned by \u003ccode\u003ete.getLinkName()\u003c/code\u003e and passed directly to \u003ccode\u003esymlinkTo()\u003c/code\u003e \u2014 is never validated and may point to any path on the controller filesystem.\u003c/p\u003e\u003cp\u003eAn attacker with \u003cstrong\u003eItem/Configure\u003c/strong\u003e permission can configure a job to extract a malicious \u003ccode\u003e.tar\u003c/code\u003e or \u003ccode\u003e.tar.gz\u003c/code\u003e archive via a tool installer or custom build step. When \u003ccode\u003eFilePath.untarFrom()\u003c/code\u003e processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths.\u003c/p\u003e\u003cp\u003eBy targeting the entire \u003ccode\u003e$JENKINS_HOME/secrets/\u003c/code\u003e directory \u2014 including \u003ccode\u003emaster.key\u003c/code\u003e, \u003ccode\u003ehudson.util.Secret\u003c/code\u003e, \u003ccode\u003ehudson.model.Secrets.xml\u003c/code\u003e, and any other files present \u2014 an attacker can exfiltrate all Jenkins cryptographic material through the workspace viewer (\u003ccode\u003eGET /job/{name}/ws/\u003c/code\u003e) or build artifacts.\u003c/p\u003e\u003cp\u003eCombined with \u003ccode\u003ecredentials.xml\u003c/code\u003e and per-user \u003ccode\u003econfig.xml\u003c/code\u003e files, this enables offline AES-128 decryption of all \u003ccode\u003e{AQA...}\u003c/code\u003e-format credential entries, exposing in plaintext every password, API key, cloud provider secret, and SSH private key stored in the Jenkins credential store \u2014 compromising all downstream systems those credentials protect.\u003c/p\u003e"
            }
          ],
          "value": "Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not targets. The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target \u2014 the path returned by te.getLinkName() and passed directly to symlinkTo() \u2014 is never validated and may point to any path on the controller filesystem. An attacker with Item/Configure permission can configure a job to extract a malicious .tar or .tar.gz archive via a tool installer or custom build step. When FilePath.untarFrom() processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths. By targeting the entire $JENKINS_HOME/secrets/ directory \u2014 including master.key, hudson.util.Secret, hudson.model.Secrets.xml, and any other files present \u2014 an attacker can exfiltrate all Jenkins cryptographic material through the workspace viewer (GET /job/{name}/ws/) or build artifacts. Combined with credentials.xml and per-user config.xml files, this enables offline AES-128 decryption of all {AQA...}-format credential entries, exposing in plaintext every password, API key, cloud provider secret, and SSH private key stored in the Jenkins credential store \u2014 compromising all downstream systems those credentials protect."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T17:01:08.287Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-03-18 (CVE-2026-33001 \u2014 incomplete fix)",
          "tags": [
            "related"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657"
        },
        {
          "name": "Jenkins Source Repository",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/jenkinsci/jenkins"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-04T00:00:00.000Z",
          "value": "Vulnerability discovered via patch-diff analysis of CVE-2026-33001 fix"
        },
        {
          "lang": "en",
          "time": "2026-08-05T00:00:00.000Z",
          "value": "Re-verified against Jenkins 2.557 and LTS 2.555.3 \u2014 still unpatched"
        },
        {
          "lang": "en",
          "time": "2026-08-10T12:00:00.000Z",
          "value": "Public disclosure (90-day window exceeded)"
        }
      ],
      "title": "Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass (Arbitrary File Read)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-19429",
    "datePublished": "2026-08-10T12:07:02.996Z",
    "dateReserved": "2026-08-10T12:06:37.123Z",
    "dateUpdated": "2026-08-10T18:21:50.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-19429\",\"sourceIdentifier\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"published\":\"2026-08-10T13:17:58.940\",\"lastModified\":\"2026-08-10T19:17:29.853\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not targets. The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target \u2014 the path returned by te.getLinkName() and passed directly to symlinkTo() \u2014 is never validated and may point to any path on the controller filesystem. An attacker with Item/Configure permission can configure a job to extract a malicious .tar or .tar.gz archive via a tool installer or custom build step. When FilePath.untarFrom() processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths. By targeting the entire $JENKINS_HOME/secrets/ directory \u2014 including master.key, hudson.util.Secret, hudson.model.Secrets.xml, and any other files present \u2014 an attacker can exfiltrate all Jenkins cryptographic material through the workspace viewer (GET /job/{name}/ws/) or build artifacts. Combined with credentials.xml and per-user config.xml files, this enables offline AES-128 decryption of all {AQA...}-format credential entries, exposing in plaintext every password, API key, cloud provider secret, and SSH private key stored in the Jenkins credential store \u2014 compromising all downstream systems those credentials protect.\"}],\"affected\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"affectedData\":[{\"vendor\":\"Jenkins Project\",\"product\":\"Jenkins\",\"defaultStatus\":\"affected\"}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-10T15:34:41.496974Z\",\"id\":\"CVE-2026-19429\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-59\"}]}],\"references\":[{\"url\":\"https://github.com/jenkinsci/jenkins\",\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\"},{\"url\":\"https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657\",\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-19429\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-10T15:34:41.496974Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-10T15:34:47.081Z\"}}], \"cna\": {\"title\": \"Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass (Arbitrary File Read)\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jamshed Yergashvoyev (CVE GUY | TuranSec)\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Jenkins Project\", \"product\": \"Jenkins\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-04T00:00:00.000Z\", \"value\": \"Vulnerability discovered via patch-diff analysis of CVE-2026-33001 fix\"}, {\"lang\": \"en\", \"time\": \"2026-08-05T00:00:00.000Z\", \"value\": \"Re-verified against Jenkins 2.557 and LTS 2.555.3 \\u2014 still unpatched\"}, {\"lang\": \"en\", \"time\": \"2026-08-10T12:00:00.000Z\", \"value\": \"Public disclosure (90-day window exceeded)\"}], \"datePublic\": \"2026-08-10T12:00:00.000Z\", \"references\": [{\"url\": \"https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657\", \"name\": \"Jenkins Security Advisory 2026-03-18 (CVE-2026-33001 \\u2014 incomplete fix)\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/jenkinsci/jenkins\", \"name\": \"Jenkins Source Repository\", \"tags\": [\"third-party-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not targets. The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target \\u2014 the path returned by te.getLinkName() and passed directly to symlinkTo() \\u2014 is never validated and may point to any path on the controller filesystem. An attacker with Item/Configure permission can configure a job to extract a malicious .tar or .tar.gz archive via a tool installer or custom build step. When FilePath.untarFrom() processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths. By targeting the entire $JENKINS_HOME/secrets/ directory \\u2014 including master.key, hudson.util.Secret, hudson.model.Secrets.xml, and any other files present \\u2014 an attacker can exfiltrate all Jenkins cryptographic material through the workspace viewer (GET /job/{name}/ws/) or build artifacts. Combined with credentials.xml and per-user config.xml files, this enables offline AES-128 decryption of all {AQA...}-format credential entries, exposing in plaintext every password, API key, cloud provider secret, and SSH private key stored in the Jenkins credential store \\u2014 compromising all downstream systems those credentials protect.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eJenkins \u003ccode\u003eFilePath.untarFrom()\u003c/code\u003e in all versions, including those with the CVE-2026-33001 patch applied, validates symlink \u003cstrong\u003edestinations\u003c/strong\u003e but not \u003cstrong\u003etargets\u003c/strong\u003e.\u003c/p\u003e\u003cp\u003eThe CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target \\u2014 the path returned by \u003ccode\u003ete.getLinkName()\u003c/code\u003e and passed directly to \u003ccode\u003esymlinkTo()\u003c/code\u003e \\u2014 is never validated and may point to any path on the controller filesystem.\u003c/p\u003e\u003cp\u003eAn attacker with \u003cstrong\u003eItem/Configure\u003c/strong\u003e permission can configure a job to extract a malicious \u003ccode\u003e.tar\u003c/code\u003e or \u003ccode\u003e.tar.gz\u003c/code\u003e archive via a tool installer or custom build step. When \u003ccode\u003eFilePath.untarFrom()\u003c/code\u003e processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths.\u003c/p\u003e\u003cp\u003eBy targeting the entire \u003ccode\u003e$JENKINS_HOME/secrets/\u003c/code\u003e directory \\u2014 including \u003ccode\u003emaster.key\u003c/code\u003e, \u003ccode\u003ehudson.util.Secret\u003c/code\u003e, \u003ccode\u003ehudson.model.Secrets.xml\u003c/code\u003e, and any other files present \\u2014 an attacker can exfiltrate all Jenkins cryptographic material through the workspace viewer (\u003ccode\u003eGET /job/{name}/ws/\u003c/code\u003e) or build artifacts.\u003c/p\u003e\u003cp\u003eCombined with \u003ccode\u003ecredentials.xml\u003c/code\u003e and per-user \u003ccode\u003econfig.xml\u003c/code\u003e files, this enables offline AES-128 decryption of all \u003ccode\u003e{AQA...}\u003c/code\u003e-format credential entries, exposing in plaintext every password, API key, cloud provider secret, and SSH private key stored in the Jenkins credential store \\u2014 compromising all downstream systems those credentials protect.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-59\", \"description\": \"CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\", \"shortName\": \"TuranSec\", \"dateUpdated\": \"2026-08-10T17:01:08.287Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-19429\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T18:21:50.651Z\", \"dateReserved\": \"2026-08-10T12:06:37.123Z\", \"assignerOrgId\": \"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\", \"datePublished\": \"2026-08-10T12:07:02.996Z\", \"assignerShortName\": \"TuranSec\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.