GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72464 (GCVE-0-2026-72464)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44
VLAI
Title
xprtrdma: Repost Receive buffers for malformed replies
Summary
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdma_wc_receive() decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdma_reply_handler(). The handler must post a replacement Receive WR before returning unless ownership of the rep has moved elsewhere, as on the backchannel path. Commit 2ae50ad68cd7 ("xprtrdma: Close window between waking RPC senders and posting Receives") moved the Receive refill out of rpcrdma_wc_receive(), where it had run ahead of every reply, into rpcrdma_reply_handler() so that the responder's credit grant could be parsed before reposting. The bad-version and short-reply exits never reach that refill: they recycle the rep and return without calling rpcrdma_post_recvs(). A remote peer can therefore drain the client's posted Receive queue by sending a sustained stream of replies that are shorter than the fixed transport header or that carry an unrecognized RPC/RDMA version. Each such reply consumes one posted Receive without replacing it. Once the queue empties, the peer's next Send finds no posted Receive and the transport stalls until reconnect. Route both malformed-reply exits through the shared repost tail after recycling the rep, refilling against buf->rb_credits, the most recent accepted credit grant. Neither exit updates the congestion window, so RPCs admitted under the previous grant remain in flight awaiting replies. A smaller refill target would let a stream of malformed replies ratchet the posted Receive count down to the batch floor while the congestion window still admits rb_credits RPCs; a burst of valid replies to those RPCs could then overrun the posted Receives, and because the client connects with rnr_retry_count of zero, a single RNR NAK terminates the connection. Refilling against rb_credits also restores the target that applied to malformed replies before commit 2ae50ad68cd7 ("xprtrdma: Close window between waking RPC senders and posting Receives") when rpcrdma_post_recvs() computed it from rb_credits internally. rb_credits is at least one from connection establishment onward, so the repost path always keeps Receives posted.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2ae50ad68cd79224198b525f7bd645c9da98b6ff , < ef6fb8a5c521f1a07f85202d13e8f2898f247362 (git)
Affected: 2ae50ad68cd79224198b525f7bd645c9da98b6ff , < 4322fd9645ee769ad29ce5caea74a1cd9b17269d (git)
Affected: 2ae50ad68cd79224198b525f7bd645c9da98b6ff , < 19fae02b272ee4bcdfb5db57f402d28f1697167a (git)
Affected: 2ae50ad68cd79224198b525f7bd645c9da98b6ff , < 007b4da2f38dcc16a13265416f4ca9f179bab610 (git)
Affected: 2ae50ad68cd79224198b525f7bd645c9da98b6ff , < d7c531ab477ae94fd03771d707fd29c787408039 (git)
Affected: 2ae50ad68cd79224198b525f7bd645c9da98b6ff , < abc011ddaf1617e3e82d8a1e87daa7ddbfb9bac5 (git)
Affected: 3791c5982ba1eebf2900ee7ca7b9a89619c26d54 (git)
Affected: 5.4.13 , < 5.5 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/rpc_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef6fb8a5c521f1a07f85202d13e8f2898f247362",
              "status": "affected",
              "version": "2ae50ad68cd79224198b525f7bd645c9da98b6ff",
              "versionType": "git"
            },
            {
              "lessThan": "4322fd9645ee769ad29ce5caea74a1cd9b17269d",
              "status": "affected",
              "version": "2ae50ad68cd79224198b525f7bd645c9da98b6ff",
              "versionType": "git"
            },
            {
              "lessThan": "19fae02b272ee4bcdfb5db57f402d28f1697167a",
              "status": "affected",
              "version": "2ae50ad68cd79224198b525f7bd645c9da98b6ff",
              "versionType": "git"
            },
            {
              "lessThan": "007b4da2f38dcc16a13265416f4ca9f179bab610",
              "status": "affected",
              "version": "2ae50ad68cd79224198b525f7bd645c9da98b6ff",
              "versionType": "git"
            },
            {
              "lessThan": "d7c531ab477ae94fd03771d707fd29c787408039",
              "status": "affected",
              "version": "2ae50ad68cd79224198b525f7bd645c9da98b6ff",
              "versionType": "git"
            },
            {
              "lessThan": "abc011ddaf1617e3e82d8a1e87daa7ddbfb9bac5",
              "status": "affected",
              "version": "2ae50ad68cd79224198b525f7bd645c9da98b6ff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3791c5982ba1eebf2900ee7ca7b9a89619c26d54",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/rpc_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Repost Receive buffers for malformed replies\n\nrpcrdma_wc_receive() decrements the transport\u0027s Receive count for\nevery completion before it dispatches a successful Receive to\nrpcrdma_reply_handler(). The handler must post a replacement\nReceive WR before returning unless ownership of the rep has moved\nelsewhere, as on the backchannel path.\n\nCommit 2ae50ad68cd7 (\"xprtrdma: Close window between waking RPC\nsenders and posting Receives\") moved the Receive refill out of\nrpcrdma_wc_receive(), where it had run ahead of every reply, into\nrpcrdma_reply_handler() so that the responder\u0027s credit grant could\nbe parsed before reposting. The bad-version and short-reply exits\nnever reach that refill: they recycle the rep and return without\ncalling rpcrdma_post_recvs().\n\nA remote peer can therefore drain the client\u0027s posted Receive\nqueue by sending a sustained stream of replies that are shorter\nthan the fixed transport header or that carry an unrecognized\nRPC/RDMA version. Each such reply consumes one posted Receive\nwithout replacing it. Once the queue empties, the peer\u0027s next\nSend finds no posted Receive and the transport stalls until\nreconnect.\n\nRoute both malformed-reply exits through the shared repost tail\nafter recycling the rep, refilling against buf-\u003erb_credits, the\nmost recent accepted credit grant. Neither exit updates the\ncongestion window, so RPCs admitted under the previous grant\nremain in flight awaiting replies. A smaller refill target would\nlet a stream of malformed replies ratchet the posted Receive count\ndown to the batch floor while the congestion window still admits\nrb_credits RPCs; a burst of valid replies to those RPCs could then\noverrun the posted Receives, and because the client connects with\nrnr_retry_count of zero, a single RNR NAK terminates the\nconnection. Refilling against rb_credits also restores the target\nthat applied to malformed replies before commit 2ae50ad68cd7\n(\"xprtrdma: Close window between waking RPC senders and posting\nReceives\") when rpcrdma_post_recvs() computed it from rb_credits\ninternally. rb_credits is at least one from connection\nestablishment onward, so the repost path always keeps Receives\nposted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Malicious or compromised NFS/RDMA server sends malformed RPC reply messages over an established RDMA connection; the kernel client processes them in rpcrdma_wc_receive()/rpcrdma_reply_handler() without any local access.\nAC:L - Remote server reliably triggers the bug by streaming replies shorter than the fixed RPC/RDMA header or carrying an unrecognized version; each consumes a posted Receive without reposting a replacement.\nPR:N - Attacker needs no credentials on the victim host, only the ability to act as the connected RDMA peer (e.g., a malicious or compromised NFS server the client has mounted).\nUI:N - Exploitation requires only an active NFS-over-RDMA client session; no additional victim action is needed beyond an existing mount/connection used for normal I/O.\nS:U - Impact is confined to SunRPC/RDMA transport availability on the NFS client; it does not cross VM, container, or kernel/user security boundaries.\nC:N - No memory corruption or out-of-bounds access occurs; short or bad-version replies are detected during header decode and the buffer is recycled without disclosing kernel data.\nI:N - The flaw only fails to repost Receive buffers after malformed replies; it does not corrupt memory, alter RPC payloads, or enable arbitrary kernel writes.\nA:H - Sustained malformed replies drain all posted Receives, stalling the transport until reconnect; a burst of valid replies can trigger RNR NAK and disconnect (rnr_retry_count=0), denying NFS/RDMA service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:30.706Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef6fb8a5c521f1a07f85202d13e8f2898f247362"
        },
        {
          "url": "https://git.kernel.org/stable/c/4322fd9645ee769ad29ce5caea74a1cd9b17269d"
        },
        {
          "url": "https://git.kernel.org/stable/c/19fae02b272ee4bcdfb5db57f402d28f1697167a"
        },
        {
          "url": "https://git.kernel.org/stable/c/007b4da2f38dcc16a13265416f4ca9f179bab610"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7c531ab477ae94fd03771d707fd29c787408039"
        },
        {
          "url": "https://git.kernel.org/stable/c/abc011ddaf1617e3e82d8a1e87daa7ddbfb9bac5"
        }
      ],
      "title": "xprtrdma: Repost Receive buffers for malformed replies",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72464",
    "datePublished": "2026-08-15T05:57:08.080Z",
    "dateReserved": "2026-08-09T03:40:39.933Z",
    "dateUpdated": "2026-08-17T05:44:30.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72464",
      "date": "2026-09-05",
      "epss": "0.00675",
      "percentile": "0.49528"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72464\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:20.400\",\"lastModified\":\"2026-08-17T06:19:14.157\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxprtrdma: Repost Receive buffers for malformed replies\\n\\nrpcrdma_wc_receive() decrements the transport\u0027s Receive count for\\nevery completion before it dispatches a successful Receive to\\nrpcrdma_reply_handler(). The handler must post a replacement\\nReceive WR before returning unless ownership of the rep has moved\\nelsewhere, as on the backchannel path.\\n\\nCommit 2ae50ad68cd7 (\\\"xprtrdma: Close window between waking RPC\\nsenders and posting Receives\\\") moved the Receive refill out of\\nrpcrdma_wc_receive(), where it had run ahead of every reply, into\\nrpcrdma_reply_handler() so that the responder\u0027s credit grant could\\nbe parsed before reposting. The bad-version and short-reply exits\\nnever reach that refill: they recycle the rep and return without\\ncalling rpcrdma_post_recvs().\\n\\nA remote peer can therefore drain the client\u0027s posted Receive\\nqueue by sending a sustained stream of replies that are shorter\\nthan the fixed transport header or that carry an unrecognized\\nRPC/RDMA version. Each such reply consumes one posted Receive\\nwithout replacing it. Once the queue empties, the peer\u0027s next\\nSend finds no posted Receive and the transport stalls until\\nreconnect.\\n\\nRoute both malformed-reply exits through the shared repost tail\\nafter recycling the rep, refilling against buf-\u003erb_credits, the\\nmost recent accepted credit grant. Neither exit updates the\\ncongestion window, so RPCs admitted under the previous grant\\nremain in flight awaiting replies. A smaller refill target would\\nlet a stream of malformed replies ratchet the posted Receive count\\ndown to the batch floor while the congestion window still admits\\nrb_credits RPCs; a burst of valid replies to those RPCs could then\\noverrun the posted Receives, and because the client connects with\\nrnr_retry_count of zero, a single RNR NAK terminates the\\nconnection. Refilling against rb_credits also restores the target\\nthat applied to malformed replies before commit 2ae50ad68cd7\\n(\\\"xprtrdma: Close window between waking RPC senders and posting\\nReceives\\\") when rpcrdma_post_recvs() computed it from rb_credits\\ninternally. rb_credits is at least one from connection\\nestablishment onward, so the repost path always keeps Receives\\nposted.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/xprtrdma/rpc_rdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2ae50ad68cd79224198b525f7bd645c9da98b6ff\",\"lessThan\":\"ef6fb8a5c521f1a07f85202d13e8f2898f247362\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ae50ad68cd79224198b525f7bd645c9da98b6ff\",\"lessThan\":\"4322fd9645ee769ad29ce5caea74a1cd9b17269d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ae50ad68cd79224198b525f7bd645c9da98b6ff\",\"lessThan\":\"19fae02b272ee4bcdfb5db57f402d28f1697167a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ae50ad68cd79224198b525f7bd645c9da98b6ff\",\"lessThan\":\"007b4da2f38dcc16a13265416f4ca9f179bab610\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ae50ad68cd79224198b525f7bd645c9da98b6ff\",\"lessThan\":\"d7c531ab477ae94fd03771d707fd29c787408039\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ae50ad68cd79224198b525f7bd645c9da98b6ff\",\"lessThan\":\"abc011ddaf1617e3e82d8a1e87daa7ddbfb9bac5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3791c5982ba1eebf2900ee7ca7b9a89619c26d54\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.13\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/xprtrdma/rpc_rdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/007b4da2f38dcc16a13265416f4ca9f179bab610\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/19fae02b272ee4bcdfb5db57f402d28f1697167a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4322fd9645ee769ad29ce5caea74a1cd9b17269d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/abc011ddaf1617e3e82d8a1e87daa7ddbfb9bac5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d7c531ab477ae94fd03771d707fd29c787408039\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ef6fb8a5c521f1a07f85202d13e8f2898f247362\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:49:40+00:00",
      "cve": "CVE-2026-72464",
      "id": "CVE-2026-72464",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xprtrdma: Repost Receive buffers for malformed replies",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72464.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.