{"metadata": {"vulnerability": "cve-2025-2776", "count": 100, "kinds": {"milestone": 6, "sighting": 59, "kev": 17, "other": 18}}, "data": [{"timestamp": "2025-02-25T15:15:00Z", "date_only": false, "value": "2025-02-25T15:15:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0144", "record": "NCSC-2025-0144", "field": "document.tracking.generator.date"}, {"timestamp": "2025-03-24T21:52:44.166Z", "date_only": false, "value": "2025-03-24T21:52:44.166Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-2776", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-05-07T09:31:00Z", "date_only": false, "value": "2025-05-07T09:31:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2025/05/sysaid-patches-4-critical-flaws.html", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "7a6a3d64-56fd-4d95-bce6-a8926b6c7214", "url": "https://thehackernews.com/2025/05/sysaid-patches-4-critical-flaws.html"}, {"timestamp": "2025-05-07T14:15:11.519Z", "date_only": false, "value": "2025-05-07T14:15:11.519186Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/shadowserver/statuses/114466967388160257", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "92de5e74-f2b4-4259-a33d-6f8a42c437d6", "url": "https://infosec.exchange/users/shadowserver/statuses/114466967388160257"}, {"timestamp": "2025-05-07T14:16:50.619Z", "date_only": false, "value": "2025-05-07T14:16:50.619196Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll3ln2k2p", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "e2d027a1-3f7a-4a71-9b52-aa7ae1bf218d", "url": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll3ln2k2p"}, {"timestamp": "2025-05-07T14:16:51.947Z", "date_only": false, "value": "2025-05-07T14:16:51.947646Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll4zukc2p", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "4f7c7ae2-3c6e-4d50-847b-aeb7d2a9c6c8", "url": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll4zukc2p"}, {"timestamp": "2025-05-07T14:16:53.298Z", "date_only": false, "value": "2025-05-07T14:16:53.298521Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll4zwis2p", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "b4562d05-2702-4299-b59c-db375be4e6f5", "url": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll4zwis2p"}, {"timestamp": "2025-05-07T14:50:40.717Z", "date_only": false, "value": "2025-05-07T14:50:40.717Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-2776", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-05-07T15:15:57Z", "date_only": false, "value": "2025-05-07T15:15:57Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HVRH-GFRR-FGC9", "record": "GHSA-HVRH-GFRR-FGC9", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-05-07T15:15:57.573Z", "date_only": false, "value": "2025-05-07T15:15:57.573", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2776", "record": "FKIE_CVE-2025-2776", "field": "published"}, {"timestamp": "2025-05-07T15:16:23Z", "date_only": false, "value": "2025-05-07T15:16:23.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/yUbNsI-bWNV2K8tTPh4C-hxM85C-hrLLt_kDH9pSKaydCw", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "d212d2fb-b024-4a32-93ff-b29b780c165d"}, {"timestamp": "2025-05-07T15:21:03Z", "date_only": false, "value": "2025-05-07T15:21:03.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cKure/14634", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "c8d5e129-3a03-4087-90c9-f9e193600f10", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Cybersecurity researchers have disclosed multiple security flaw in the on-premise version of SysAid IT support software that could be exploited to achieve pre-authenticated remote code execution with elevated privileges.\n\nThe vulnerabilities, tracked as CVE-2025-2775, CVE-2025-2776, and CVE-2025-2777, have all been described as XML External Entity (XXE) injections, which occur when an attacker is able to successfully interfere with an application's parsing of XML input.\n\nThis, in turn, could permit attackers to inject unsafe XML entities into the web application, allowing them to carry out a Server-Side Request Forgery (SSRF) attack and in worst cases, remote code execution.\n\nhttps://thehackernews.com/2025/05/sysaid-patches-4-critical-flaws.html", "url": "https://t.me/cKure/14634"}, {"timestamp": "2025-05-07T15:31:41Z", "date_only": false, "value": "2025-05-07T15:31:41Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HVRH-GFRR-FGC9", "record": "GHSA-HVRH-GFRR-FGC9", "field": "published"}, {"timestamp": "2025-05-07T15:47:36.130Z", "date_only": false, "value": "2025-05-07T15:47:36.130173Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114467330819942836", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "d05953d6-e050-4eda-83ee-1237e98e2558", "url": "https://infosec.exchange/users/cR0w/statuses/114467330819942836"}, {"timestamp": "2025-05-07T22:00:00Z", "date_only": false, "value": "2025-05-07T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-07T22:00:00Z", "date_only": false, "value": "2025-05-07T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-05-07T22:00:00Z", "date_only": false, "value": "2025-05-07T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2025-05-08T02:18:11.276Z", "date_only": false, "value": "2025-05-08T02:18:11.276400Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lomtv2durb2w", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "b4456b31-d433-4cb5-a1d1-ae2fbd3e0f0a", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lomtv2durb2w"}, {"timestamp": "2025-05-08T06:56:21.378Z", "date_only": false, "value": "2025-05-08T06:56:21.378830Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2025-0144", "record": "NCSC-2025-0144", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-08T06:56:21.378Z", "date_only": false, "value": "2025-05-08T06:56:21.378830Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2025-0144", "record": "NCSC-2025-0144", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-05-08T06:56:21.378Z", "date_only": false, "value": "2025-05-08T06:56:21.378830Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0144", "record": "NCSC-2025-0144", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-05-08T12:25:23.681Z", "date_only": false, "value": "2025-05-08T12:25:23.681165Z", "kind": "sighting", "label": "Seen", "source": "https://mstdn.ca/users/rfwaveio/statuses/114472197786505302", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "8cd7f091-75f6-4fa3-afc1-42de330a5ebf", "url": "https://mstdn.ca/users/rfwaveio/statuses/114472197786505302"}, {"timestamp": "2025-05-09T14:18:17Z", "date_only": false, "value": "2025-05-09T14:18:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/liwaamohammad/1962", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "7dcce15b-ceb3-46c6-a6d0-1c922674dec8", "content": "https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain\n\nPoC for SysAid PreAuth RCE Chain (CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778)\n#github #exploit", "url": "https://t.me/liwaamohammad/1962"}, {"timestamp": "2025-05-10T00:52:20Z", "date_only": false, "value": "2025-05-10T00:52:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/12025", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "d0bd492f-d812-417c-b27b-eff7ffcba63e", "content": "#exploit\nCVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2025-2778\nSysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain\n]-> https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n\n]-> https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain", "url": "https://t.me/CyberSecurityTechnologies/12025"}, {"timestamp": "2025-05-10T02:44:20Z", "date_only": false, "value": "2025-05-10T02:44:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ton618cyber/3785", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "7d68163f-0c52-44eb-9397-256580ef03ec", "content": "#exploit\nCVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2025-2778\nSysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain\n]-> https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n\n]-> https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain", "url": "https://t.me/ton618cyber/3785"}, {"timestamp": "2025-05-10T02:44:20Z", "date_only": false, "value": "2025-05-10T02:44:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ton618cyber/9219", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "91350d3a-3ba9-458e-928f-e889d1173810", "content": "#exploit\nCVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2025-2778\nSysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain\n]-> https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n\n]-> https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain", "url": "https://t.me/ton618cyber/9219"}, {"timestamp": "2025-05-10T14:15:02Z", "date_only": false, "value": "2025-05-10T14:15:02.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-2776.yaml", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "b2fee7eb-dc8a-4391-80e6-72fd5ab775ee", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-2776.yaml"}, {"timestamp": "2025-05-11T21:02:20.092Z", "date_only": false, "value": "2025-05-11T21:02:20.092538Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lowe3uenfd2r", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "bebdbd6c-4c2c-4556-950e-16cc8d0e2aae", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lowe3uenfd2r"}, {"timestamp": "2025-05-12T17:15:08Z", "date_only": false, "value": "2025-05-12T17:15:08.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/7023", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "8d8f4b2e-fff9-4f66-99aa-d9b348cd7e9c", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 WatchTowr Labs \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0442\u0440\u0438 \u043e\u0448\u0438\u0431\u043a\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u041f\u041e \u0418\u0422-\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 SysAid.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a CVE-2025-2775 \u0438 CVE-2025-2776 (\u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 XXE \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 /mdm/checkin), CVE-2025-2777 (\u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 XXE \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 /lshw).\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c watchTowr Labs, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043b\u0435\u0433\u043a\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430 POST \u043a \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u043c \u0442\u043e\u0447\u043a\u0430\u043c.\n\n\u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0441 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f InitAccount.cmd, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0438 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u044b\u0439 \u043f\u0430\u0440\u043e\u043b\u044c.\n\n\u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0431\u0435\u0437 \u0442\u0440\u0443\u0434\u0430 \u043c\u043e\u0436\u0435\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a SysAid.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c XXE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u041e\u0421, \u043e\u0442\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 CVE-2025-2778, \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0441\u0435 \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b SysAid \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 24.4.60 b16 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u043c\u0430\u0440\u0442\u0430 2025 \u0433\u043e\u0434\u0430.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0434\u0430\u0432\u043d\u044e\u044e \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0443 \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SysAid\u00a0\u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0431\u0430\u043d\u0434 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 (\u0432 \u0447\u0438\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438\u0441\u044c Cl0p) \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 PoC, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0441\u0435 \u0447\u0435\u0442\u044b\u0440\u0435\u00a0\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0430\u043a\u0430\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.", "url": "https://t.me/true_secator/7023"}, {"timestamp": "2025-05-14T16:37:25Z", "date_only": false, "value": "2025-05-14T16:37:25+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2025-2776", "field": "timestamps.asserted_at", "uuid": "fc14a715-965a-4843-a31f-641f077536ce", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-05-14T16:37:25Z", "date_only": false, "value": "2025-05-14T16:37:25+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-2776", "field": "timestamps.first_seen_at", "uuid": "fc14a715-965a-4843-a31f-641f077536ce", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-05-16T21:02:21.524Z", "date_only": false, "value": "2025-05-16T21:02:21.524536Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lpcwgj3mu52r", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "b4aa7455-e326-448a-aeba-24bf01641ffe", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lpcwgj3mu52r"}, {"timestamp": "2025-06-17T00:00:00Z", "date_only": false, "value": "2025-06-17T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-06-17)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "45c45e4a-6b98-4445-af50-1a606b9bb054"}, {"timestamp": "2025-06-24T00:00:00Z", "date_only": false, "value": "2025-06-24T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-24)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "06a7542c-ab32-4fc5-8de2-2a5c72ef1f6b"}, {"timestamp": "2025-07-22T00:00:00Z", "date_only": false, "value": "2025-07-22T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-2776", "field": "timestamps.asserted_at", "uuid": "b632f0fd-487a-45a3-a426-1204ed431000", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-22T00:00:00Z", "date_only": true, "value": "2025-07-22", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-2776", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2025-07-22T00:00:00Z", "date_only": true, "value": "2025-07-22", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2025-2776", "field": "evidence.0.details.date_added", "uuid": "b632f0fd-487a-45a3-a426-1204ed431000", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-22T00:00:00Z", "date_only": false, "value": "2025-07-22T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2025-2776", "field": "timestamps.first_seen_at", "uuid": "b632f0fd-487a-45a3-a426-1204ed431000", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-22T00:00:00Z", "date_only": false, "value": "2025-07-22T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2025-2776", "field": "status.status_updated_at", "uuid": "b632f0fd-487a-45a3-a426-1204ed431000", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-22T00:00:00Z", "date_only": false, "value": "2025-07-22T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-2776", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2025-07-22T03:55:28.273Z", "date_only": false, "value": "2025-07-22T03:55:28.273841Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-2776", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-07-22T03:55:28.273Z", "date_only": false, "value": "2025-07-22T03:55:28.273841Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2776", "record": "FKIE_CVE-2025-2776", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-07-22T19:05:20.703Z", "date_only": false, "value": "2025-07-22T19:05:20.703061Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/4454338", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "4c0a36f1-2573-4887-bda7-d164bfe04f96", "url": "https://feedsin.space/feed/CISAKevBot/items/4454338"}, {"timestamp": "2025-07-22T22:00:00Z", "date_only": false, "value": "2025-07-22T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2025-07-22T22:00:00Z", "date_only": false, "value": "2025-07-22T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-07-23T04:51:55.669Z", "date_only": false, "value": "2025-07-23T04:51:55.669+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "document.tracking.generator.date"}, {"timestamp": "2025-07-23T06:21:51.766Z", "date_only": false, "value": "2025-07-23T06:21:51.766668Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3lumewnetvc2c", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "3d276fe6-1f12-4d0e-a8e9-89ce09680bfc", "url": "https://bsky.app/profile/ytroncal.bsky.social/post/3lumewnetvc2c"}, {"timestamp": "2025-07-23T08:08:28.440Z", "date_only": false, "value": "2025-07-23T08:08:28.440708Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nimblenerd.social/post/3lumkveejko2b", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "5a738583-7578-46dd-a215-69733cdf2f42", "url": "https://bsky.app/profile/nimblenerd.social/post/3lumkveejko2b"}, {"timestamp": "2025-07-23T08:10:39.677Z", "date_only": false, "value": "2025-07-23T08:10:39.677831Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lumkz54mvrw2", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "ebefa274-ac3d-426c-9bac-1c24f96fe60d", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lumkz54mvrw2"}, {"timestamp": "2025-07-23T09:05:52Z", "date_only": false, "value": "2025-07-23T09:05:52.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/information_security_channel/53885", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "d0b6aa88-269c-495e-9c7f-d3f003444456", "content": "CISA Warns of SysAid Vulnerability Exploitation\nhttps://www.securityweek.com/cisa-warns-of-sysaid-vulnerability-exploitation/\n\nCISA has added two recent SysAid vulnerabilities, CVE-2025-2776 and CVE-2025-2775, to its KEV catalog.\nThe post CISA Warns of SysAid Vulnerability Exploitation (https://www.securityweek.com/cisa-warns-of-sysaid-vulnerability-exploitation/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/53885"}, {"timestamp": "2025-07-23T15:59:57.961Z", "date_only": false, "value": "2025-07-23T15:59:57.961970Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3lunfaeuyy222", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "0660c39b-72e5-4fe0-84cf-1bbab1a96bf1", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3lunfaeuyy222"}, {"timestamp": "2025-07-23T21:02:29.460Z", "date_only": false, "value": "2025-07-23T21:02:29.460622Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lunw55xhul2c", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "da9c8f02-7a68-4638-9c8e-fba48192475e", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lunw55xhul2c"}, {"timestamp": "2025-07-23T21:20:37.680Z", "date_only": false, "value": "2025-07-23T21:20:37.680774Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lunx5ubi7s26", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "32fa2f05-3367-49ab-b17d-c7a385841e55", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lunx5ubi7s26"}, {"timestamp": "2025-07-24T00:00:00Z", "date_only": false, "value": "2025-07-24T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-07-24)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "474f4f49-f8df-4621-9483-7918021f1468"}, {"timestamp": "2025-07-24T03:27:35.274Z", "date_only": false, "value": "2025-07-24T03:27:35.274441Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3luolntsbj22v", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "e55d46bb-409f-4ffe-9d3f-7544f0dbd4ce", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3luolntsbj22v"}, {"timestamp": "2025-07-24T13:50:19.928Z", "date_only": false, "value": "2025-07-24T13:50:19.928918Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lupohh4tn22d", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "1f256cbd-2fba-4867-be84-8d5453f30854", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lupohh4tn22d"}, {"timestamp": "2025-07-27T00:00:00Z", "date_only": false, "value": "2025-07-27T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-07-27)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "157449b7-5b75-4c28-8f43-dcca4b0b47b7"}, {"timestamp": "2025-08-11T02:01:29.188Z", "date_only": false, "value": "2025-08-11T02:01:29.188182Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wardenshield.bsky.social/post/3lw3pagelbk2g", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "c57e008c-c34e-4c8e-ba99-a49c065c79e7", "url": "https://bsky.app/profile/wardenshield.bsky.social/post/3lw3pagelbk2g"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": true, "value": "2025-08-12", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2025-2776", "field": "evidence.0.details.due_date", "uuid": "b632f0fd-487a-45a3-a426-1204ed431000", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-08-20T00:00:00Z", "date_only": false, "value": "2025-08-20T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-20)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "792bc92d-5224-4c45-aca5-2b1e563f0244"}, {"timestamp": "2025-08-31T13:24:48Z", "date_only": false, "value": "2025-08-31T13:24:48.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/49741", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "3e437418-017d-4d26-9fbe-fcd7801f6ed3", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-7771: Arbitrary physical memory and I/O port read/write via ThrottleStop driver\nURL\uff1ahttps://github.com/mrk336/From-EternalBlue-to-CVE-2025-2776-The-Evolution-of-an-SMB-Attack\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/49741"}, {"timestamp": "2025-08-31T21:00:04Z", "date_only": false, "value": "2025-08-31T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/8XN8wAMSKexF4HKj61t8L1D_BdecH-IzCKOqVJJvRwF7CEY", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "58e1880c-f989-49bb-b935-561c6da07c6e"}, {"timestamp": "2025-09-02T21:02:37.867Z", "date_only": false, "value": "2025-09-02T21:02:37.867036Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lxuzbd3g4q2o", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "c9ab4a5b-5609-4de5-af01-ff36849875f1", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lxuzbd3g4q2o"}, {"timestamp": "2025-09-09T20:51:36Z", "date_only": false, "value": "2025-09-09T20:51:36.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/e0a0042d-e47b-4875-b781-99d4428af3c2", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "1744a086-d444-4fd6-9b83-687ccf2bd8b9"}, {"timestamp": "2025-09-28T08:23:31Z", "date_only": false, "value": "2025-09-28T08:23:31.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "0a45b2ed-1901-466c-9cf2-df86e8b2f082"}, {"timestamp": "2025-09-29T03:12:16Z", "date_only": false, "value": "2025-09-29T03:12:16.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "edeb2071-604b-44c5-abd0-05162303b199"}, {"timestamp": "2025-10-02T00:00:00Z", "date_only": false, "value": "2025-10-02T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-10-02)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "c5a50516-5f57-4b9b-ae04-48a0bd714939"}, {"timestamp": "2025-10-21T22:55:17.129Z", "date_only": false, "value": "2025-10-21T22:55:17.129Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-2776", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T00:33:18Z", "date_only": false, "value": "2025-10-22T00:33:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HVRH-GFRR-FGC9", "record": "GHSA-HVRH-GFRR-FGC9", "field": "modified"}, {"timestamp": "2025-10-23T17:37:45.755Z", "date_only": false, "value": "2025-10-23T17:37:45.755216Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/115424694369254779", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "5c25ba3a-4c2d-4744-88e9-76527cc85de0", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/115424694369254779"}, {"timestamp": "2025-10-26T04:57:32Z", "date_only": false, "value": "2025-10-26T04:57:32.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/WuywlTA2prep3738D0ZdlY2l1dxkLscKbaCFO22me4a6aig", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "d3bc415e-aecf-4ce1-a1cc-66a010e26d33"}, {"timestamp": "2025-10-26T04:57:35Z", "date_only": false, "value": "2025-10-26T04:57:35.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/DKd2Gqws_szvlbVH567RCL0Q0RIZDQSoU0Q0rK7xOEDSxsg", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "47454894-7564-43fa-bd8c-15462f3e0726"}, {"timestamp": "2025-11-01T00:00:00Z", "date_only": false, "value": "2025-11-01T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-11-01)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "7a0807e8-ec07-4f76-8e5f-9195b5bf1e9f"}, {"timestamp": "2025-11-19T18:33:05.781Z", "date_only": false, "value": "2025-11-19T18:33:05.781Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-2776", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-11-19T18:33:05.781Z", "date_only": false, "value": "2025-11-19T18:33:05.781Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2025-2776", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-02-02T12:25:56.082Z", "date_only": false, "value": "2026-02-02T12:25:56.082848Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d041bbcd-43ab-4c19-a576-e2b7c165aeac", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "afa9a434-e723-41f5-81cf-d7d6cdd1ebe5", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d041bbcd-43ab-4c19-a576-e2b7c165aeac"}, {"timestamp": "2026-02-02T12:25:56.082Z", "date_only": false, "value": "2026-02-02T12:25:56.082848Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d041bbcd-43ab-4c19-a576-e2b7c165aeac", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "561a9bce-4231-4ff4-9853-e949e5d8374f", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d041bbcd-43ab-4c19-a576-e2b7c165aeac"}, {"timestamp": "2026-02-02T13:24:01Z", "date_only": false, "value": "2026-02-02T13:24:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2025-2776", "field": "timestamps.recorded_at", "uuid": "b632f0fd-487a-45a3-a426-1204ed431000", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-14T00:00:00Z", "date_only": false, "value": "2026-03-14T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-14)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "60a572c6-4517-4cfd-873f-2944a709abc3"}, {"timestamp": "2026-04-29T00:00:00Z", "date_only": false, "value": "2026-04-29T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-29)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "f693683b-5707-479c-8bc5-8f515884df35"}, {"timestamp": "2026-05-09T00:00:00Z", "date_only": false, "value": "2026-05-09T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-09)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "4622da24-fd46-4ec5-a0c8-a0607d43cee4"}, {"timestamp": "2026-05-28T00:00:00Z", "date_only": false, "value": "2026-05-28T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-28)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "8512caf8-5edd-4ce5-8202-0aa70f2c5cef"}, {"timestamp": "2026-06-01T10:37:22Z", "date_only": false, "value": "2026-06-01T10:37:22+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-2776", "field": "timestamps.asserted_at", "uuid": "a8d1b275-56b5-49d1-a7c5-b1d5ac00939a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:37:22Z", "date_only": false, "value": "2026-06-01T10:37:22+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-2776", "field": "timestamps.first_seen_at", "uuid": "a8d1b275-56b5-49d1-a7c5-b1d5ac00939a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:37:22Z", "date_only": false, "value": "2026-06-01T10:37:22+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-2776", "field": "status.status_updated_at", "uuid": "a8d1b275-56b5-49d1-a7c5-b1d5ac00939a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:37:22.535Z", "date_only": false, "value": "2026-06-01T10:37:22.535Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-2776", "field": "evidence.0.details.added_date", "uuid": "a8d1b275-56b5-49d1-a7c5-b1d5ac00939a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-08T00:00:00Z", "date_only": false, "value": "2026-06-08T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-08)", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "4224b16d-8d03-4f74-a355-238a6aee4bae"}, {"timestamp": "2026-06-17T09:07:36.360Z", "date_only": false, "value": "2026-06-17T09:07:36.360", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2776", "record": "FKIE_CVE-2025-2776", "field": "lastModified"}, {"timestamp": "2026-06-19T12:41:46Z", "date_only": false, "value": "2026-06-19T12:41:46+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-2776", "field": "timestamps.recorded_at", "uuid": "a8d1b275-56b5-49d1-a7c5-b1d5ac00939a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-19T12:42:18.411Z", "date_only": false, "value": "2026-06-19T12:42:18.411831Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/a8d1b275-56b5-49d1-a7c5-b1d5ac00939a", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "9ee8e560-87f6-451b-b1bf-e8444e4cc44c", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/a8d1b275-56b5-49d1-a7c5-b1d5ac00939a"}, {"timestamp": "2026-06-19T12:45:28.633Z", "date_only": false, "value": "2026-06-19T12:45:28.633582Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4a72afed-9641-443e-b90d-f4f041e5487a", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "36704fe4-e4a2-4903-9b67-31465cbed772", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4a72afed-9641-443e-b90d-f4f041e5487a"}, {"timestamp": "2026-06-23T14:03:53.825Z", "date_only": false, "value": "2026-06-23T14:03:53.825327Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7c8b3945-f6e4-471b-927b-d5d69045d4ef", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "9495ab57-186e-4fff-9dd6-5e1a2170a154", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7c8b3945-f6e4-471b-927b-d5d69045d4ef"}, {"timestamp": "2026-06-30T09:23:49.789Z", "date_only": false, "value": "2026-06-30T09:23:49.789764Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/424c9732-539a-4cc5-98e5-19d219034d63", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "54ade5a7-4459-4827-b578-85a4eddc732a", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/424c9732-539a-4cc5-98e5-19d219034d63"}, {"timestamp": "2026-07-01T07:18:02.915Z", "date_only": false, "value": "2026-07-01T07:18:02.915665Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/fc14a715-965a-4843-a31f-641f077536ce", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "6ca564c2-a6d6-4c41-a848-cfb49ee940b0", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/fc14a715-965a-4843-a31f-641f077536ce"}, {"timestamp": "2026-07-26T02:00:12.863Z", "date_only": false, "value": "2026-07-26T02:00:12.863360Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/812", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "54f7310d-2b7c-463f-8c50-1e4840e762a6", "url": "https://t.me/cyberwarehouse/812"}, {"timestamp": "2026-07-27T00:00:29.746Z", "date_only": false, "value": "2026-07-27T00:00:29.746531Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberwarehouse/812", "record": "CVE-2025-2776", "field": "creation_timestamp", "uuid": "53ada848-a448-465d-bbe0-cdefa7050a28", "url": "https://t.me/cyberwarehouse/812"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2025-2776", "field": "timestamps.last_seen_at", "uuid": "fc14a715-965a-4843-a31f-641f077536ce", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2025-2776", "field": "evidence.0.details.observation_date", "uuid": "fc14a715-965a-4843-a31f-641f077536ce", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2025-2776", "field": "status.status_updated_at", "uuid": "fc14a715-965a-4843-a31f-641f077536ce", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-21T09:03:44Z", "date_only": false, "value": "2026-10-21T09:03:44+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2025-2776", "field": "timestamps.recorded_at", "uuid": "fc14a715-965a-4843-a31f-641f077536ce", "status": {"status_reason": "confirmed", "exploited": true}}]}