CVE-2025-64717 (GCVE-0-2025-64717)

Vulnerability from cvelistv5 – Published: 2025-11-13 15:30 – Updated: 2025-11-13 17:09
VLAI
Title
ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
Summary
ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication. This vulnerability stems from the platform's failure to correctly check or enforce an organization's specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process. This allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker's external identity to an existing internal user account. This may result in a full Account Takeover, bypassing the organization's mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process. Versions 4.6.6, 3.4.4, and 2.71.19 resolve the issue by correctly validating the organization's login policy before auto-linking an external user. No known workarounds are available aside from upgrading.
Severity
7.4 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-13 17:08 UTC
CWE
  • CWE-287 - Improper Authentication
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 8026 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
zitadel zitadel Affected: >= 4.0.0-rc.1, < 4.6.6
Affected: >= 3.0.0-rc.1, < 3.4.4
Affected: >= 2.50.0, < 2.71.19
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-64717",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-13T17:08:48.778483Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-13T17:09:03.838Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zitadel",
          "vendor": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0-rc.1, \u003c 4.6.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0-rc.1, \u003c 3.4.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.50.0, \u003c 2.71.19"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL\u0027s federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication. This vulnerability stems from the platform\u0027s failure to correctly check or enforce an organization\u0027s specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process. This allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker\u0027s external identity to an existing internal user account. This may result in a full Account Takeover, bypassing the organization\u0027s mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process. Versions 4.6.6, 3.4.4, and 2.71.19 resolve the issue by correctly validating the organization\u0027s login policy before auto-linking an external user. No known workarounds are available aside from upgrading."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-13T15:30:51.233Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-j4g7-v4m4-77px",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-j4g7-v4m4-77px"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v2.71.19",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v2.71.19"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.4"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v4.6.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v4.6.6"
        }
      ],
      "source": {
        "advisory": "GHSA-j4g7-v4m4-77px",
        "discovery": "UNKNOWN"
      },
      "title": "ZITADEL vulnerable to Account Takeover with deactivated Instance IdP"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-64717",
    "datePublished": "2025-11-13T15:30:51.233Z",
    "dateReserved": "2025-11-10T14:07:42.922Z",
    "dateUpdated": "2025-11-13T17:09:03.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-64717",
      "date": "2026-11-06",
      "epss": "0.00495",
      "percentile": "0.42706"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "zitadel",
                "vendor": "zitadel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.0-rc.1, \u003c 4.6.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.0.0-rc.1, \u003c 3.4.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.50.0, \u003c 2.71.19"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B3B611AF-52FB-49EF-9042-F4AF8DB7A21B",
                    "versionEndExcluding": "2.71.19",
                    "versionStartIncluding": "2.50.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EC555BCC-5A14-4158-9CCB-569702A49890",
                    "versionEndExcluding": "3.4.4",
                    "versionStartIncluding": "3.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "19721B04-022B-48E8-8B57-52D2805284D6",
                    "versionEndExcluding": "4.6.6",
                    "versionStartIncluding": "4.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL\u0027s federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication. This vulnerability stems from the platform\u0027s failure to correctly check or enforce an organization\u0027s specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process. This allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker\u0027s external identity to an existing internal user account. This may result in a full Account Takeover, bypassing the organization\u0027s mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process. Versions 4.6.6, 3.4.4, and 2.71.19 resolve the issue by correctly validating the organization\u0027s login policy before auto-linking an external user. No known workarounds are available aside from upgrading."
          },
          {
            "lang": "es",
            "value": "ZITADEL es una plataforma de gesti\u00f3n de identidad de c\u00f3digo abierto. A partir de la versi\u00f3n 2.50.0 y antes de las versiones 2.71.19, 3.4.4 y 4.6.6, una vulnerabilidad en el proceso de federaci\u00f3n de ZITADEL permit\u00eda el autoenlace de usuarios de proveedores de identidad externos a usuarios existentes en ZITADEL incluso si el IdP correspondiente no estaba activo o si la organizaci\u00f3n no permit\u00eda la autenticaci\u00f3n federada. Esta vulnerabilidad se deriva de la falla de la plataforma al verificar o aplicar correctamente las configuraciones de seguridad espec\u00edficas de una organizaci\u00f3n durante el flujo de autenticaci\u00f3n. Un Administrador de Organizaci\u00f3n puede deshabilitar expl\u00edcitamente un IdP o denegar la federaci\u00f3n, pero esta configuraci\u00f3n no se respetaba durante el proceso de autoenlace. Esto permit\u00eda a un atacante no autenticado iniciar una sesi\u00f3n utilizando un IdP que deber\u00eda haber estado deshabilitado para esa organizaci\u00f3n. La plataforma validar\u00eda incorrectamente el inicio de sesi\u00f3n y, bas\u00e1ndose en un criterio de coincidencia, vincular\u00eda la identidad externa del atacante a una cuenta de usuario interna existente. Esto puede resultar en una Toma de Control de Cuenta completa, eludiendo los controles de seguridad obligatorios de la organizaci\u00f3n. Tenga en cuenta que las cuentas con MFA habilitado no pueden ser tomadas por este ataque. Tambi\u00e9n tenga en cuenta que solo los IdP creados a nivel de instancia permitir\u00edan que esto funcionara. Los IdP registrados en otra organizaci\u00f3n siempre ser\u00edan denegados en el proceso de (auto)enlace. Las versiones 4.6.6, 3.4.4 y 2.71.19 resuelven el problema al validar correctamente la pol\u00edtica de inicio de sesi\u00f3n de la organizaci\u00f3n antes de autoenlazar a un usuario externo. No hay soluciones alternativas conocidas disponibles aparte de la actualizaci\u00f3n."
          }
        ],
        "id": "CVE-2025-64717",
        "lastModified": "2026-10-19T13:10:00.110",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-64717",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-13T17:08:48.778483Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-11-13T16:15:56.973",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/zitadel/zitadel/releases/tag/v2.71.19"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.4"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/zitadel/zitadel/releases/tag/v4.6.6"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-j4g7-v4m4-77px"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-11-14T16:05:50+00:00",
      "cve": "CVE-2025-64717",
      "id": "CVE-2025-64717",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ZITADEL vulnerable to Account Takeover with deactivated Instance IdP",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-64717.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-64717",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-11-13T17:08:48.778483Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-11-13T17:08:55.027Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "zitadel",
              "vendor": "zitadel",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.0-rc.1, \u003c 4.6.6"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.0.0-rc.1, \u003c 3.4.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.50.0, \u003c 2.71.19"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL\u0027s federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication. This vulnerability stems from the platform\u0027s failure to correctly check or enforce an organization\u0027s specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process. This allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker\u0027s external identity to an existing internal user account. This may result in a full Account Takeover, bypassing the organization\u0027s mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process. Versions 4.6.6, 3.4.4, and 2.71.19 resolve the issue by correctly validating the organization\u0027s login policy before auto-linking an external user. No known workarounds are available aside from upgrading."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "privilegesRequired": "HIGH",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-287",
                  "description": "CWE-287: Improper Authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-11-13T15:30:51.233Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-j4g7-v4m4-77px",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-j4g7-v4m4-77px"
            },
            {
              "name": "https://github.com/zitadel/zitadel/releases/tag/v2.71.19",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/zitadel/zitadel/releases/tag/v2.71.19"
            },
            {
              "name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.4"
            },
            {
              "name": "https://github.com/zitadel/zitadel/releases/tag/v4.6.6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/zitadel/zitadel/releases/tag/v4.6.6"
            }
          ],
          "source": {
            "advisory": "GHSA-j4g7-v4m4-77px",
            "discovery": "UNKNOWN"
          },
          "title": "ZITADEL vulnerable to Account Takeover with deactivated Instance IdP"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-64717",
        "datePublished": "2025-11-13T15:30:51.233Z",
        "dateReserved": "2025-11-10T14:07:42.922Z",
        "dateUpdated": "2025-11-13T17:09:03.838Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.