https://poc.intelseclab.com/tags/cisa-kev/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2025-61882-oracle-ebs-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2025-61882-oracle-ebs-preauth-rce/Critical severity (CVSS 9.8) — web · CVE-2025-61882 (Oracle Security Alert, out-of-band, October 2025). Status: Patched (Oracle out-of-band Security Alert, October 2025). Affects: Oracle E-Business Suite — Oracle Concurrent Processing product, BI Publisher Integration component (reached via the /OA_HTML/ web tier: configurator/UiServlet and ieshostedsurvey.jsp). Tags: oracle-ebs, oracle-concurrent-processing, bi-publisher-integration, pre-auth, rce, ssrf, crlf-injection, request-smuggling, path-traversal, auth-bypass, xslt, java, cisa-kev, ransomware, cl0p, watchtowr.webCriticaloracle-ebsoracle-concurrent-processingbi-publisher-integrationpre-authrcessrfcrlf-injectionrequest-smugglingpath-traversalauth-bypassxsltjavacisa-kevransomwarecl0pwatchtowrhttps://poc.intelseclab.com/pocs/network/2026-08-09_cve-2023-35078-ivanti-epmm-unauth-api-access/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-09_cve-2023-35078-ivanti-epmm-unauth-api-access/Critical severity (CVSS 9.8) — network · CVE-2023-35078 (Ivanti advisory; CWE-287 per NVD). Status: Patched (Ivanti EPMM 11.8.1.1, 11.9.1.1, 11.10.0.2 and later). Affects: Ivanti Endpoint Manager Mobile (EPMM), previously branded MobileIron Core — the /mifs/aad/api/ administrative API surface. Tags: ivanti, epmm, mobileiron-core, mdm, authentication-bypass, cwe-287, unauthenticated, api, pii-disclosure, cisa-kev, ransomware, scanner.networkCriticalivantiepmmmobileiron-coremdmauthentication-bypasscwe-287unauthenticatedapipii-disclosurecisa-kevransomwarescannerhttps://poc.intelseclab.com/pocs/network/2026-08-09_cve-2025-22457-ivanti-connect-secure-stack-overflow/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-09_cve-2025-22457-ivanti-connect-secure-stack-overflow/Critical severity (CVSS 9) — network · CVE-2025-22457. Status: Patched. Affects: Ivanti Connect Secure, Pulse Connect Secure (end of support), Ivanti Policy Secure, Ivanti ZTA Gateways — the /home/bin/web HTTPS front-end process. Tags: ivanti, connect-secure, pulse-connect-secure, policy-secure, zta-gateway, vpn, stack-overflow, CWE-121, buffer-overflow, rce, unauthenticated, rop, heap-spray, aslr-bruteforce, x-forwarded-for, cisa-kev, ransomware, ruby, edge-device.networkCriticalivanticonnect-securepulse-connect-securepolicy-securezta-gatewayvpnstack-overflowCWE-121buffer-overflowrceunauthenticatedropheap-sprayaslr-bruteforcex-forwarded-forcisa-kevransomwarerubyedge-devicehttps://poc.intelseclab.com/pocs/network/2026-08-09_cve-2026-16232-checkpoint-smartconsole-auth-bypass/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-09_cve-2026-16232-checkpoint-smartconsole-auth-bypass/Critical severity (CVSS 9.1) — network · CVE-2026-16232. Status: Patched. Affects: Check Point Security Management Server and Multi-Domain Security Management Server (MDS) — the legacy FWM/CPMI SIC service on TCP 18190 and the CPM SOAP web services on TCP 19009. Tags: check-point, smartconsole, security-management-server, multi-domain-server, cpmi, sic, fwm, authentication-bypass, CWE-287, improper-authentication, privilege-escalation, sso-token-forgery, soap, dle, cisa-kev, bod-26-04, python, firewall-management.networkCriticalcheck-pointsmartconsolesecurity-management-servermulti-domain-servercpmisicfwmauthentication-bypassCWE-287improper-authenticationprivilege-escalationsso-token-forgerysoapdlecisa-kevbod-26-04pythonfirewall-managementhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48558-simplehelp-oidc-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48558-simplehelp-oidc-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-48558. Status: PoC. Affects: SimpleHelp remote support / remote monitoring & management (RMM) server, OIDC authentication flow. Tags: simplehelp, oidc, jwt, alg-none, auth-bypass, rmm, remote-support, cisa-kev.webCriticalsimplehelpoidcjwtalg-noneauth-bypassrmmremote-supportcisa-kevhttps://poc.intelseclab.com/pocs/web/2026-07-03_cve-2025-3248-langflow-unauth-rce/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_cve-2025-3248-langflow-unauth-rce/Critical severity (CVSS 9.8) — web · CVE-2025-3248. Status: Weaponized. Affects: Langflow (open-source AI/LLM workflow builder). Tags: RCE, unauthenticated, missing-authentication, Langflow, AI-application, python-exec, CISA-KEV, agentic-ransomware, JADEPUFFER.webCriticalRCEunauthenticatedmissing-authenticationLangflowAI-applicationpython-execCISA-KEVagentic-ransomwareJADEPUFFERhttps://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-35616-forticlient-ems-auth-bypass/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-35616-forticlient-ems-auth-bypass/Critical severity (CVSS 9.1) — network · CVE-2026-35616. Status: Weaponized. Affects: Fortinet FortiClient Endpoint Management Server (EMS). Tags: authentication-bypass, header-spoofing, Fortinet, FortiClient-EMS, FortiBleed, credential-theft, CISA-KEV, active-exploitation, ransomware.networkCriticalauthentication-bypassheader-spoofingFortinetFortiClient-EMSFortiBleedcredential-theftCISA-KEVactive-exploitationransomwarehttps://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-45247-mirasvit-magento-cache-warmer-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-45247-mirasvit-magento-cache-warmer-rce/Critical severity (CVSS 9.3) — web · CVE-2026-45247. Status: Weaponized. Affects: Mirasvit Full Page Cache Warmer extension for Magento 2. Tags: php-object-injection, insecure-deserialization, RCE, Magento, Mirasvit, e-commerce, cookie-based, unauthenticated, CISA-KEV, active-exploitation.webCriticalphp-object-injectioninsecure-deserializationRCEMagentoMirasvite-commercecookie-basedunauthenticatedCISA-KEVactive-exploitationhttps://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-48907-joomla-jce-unauth-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-48907-joomla-jce-unauth-rce/Critical severity (CVSS 10) — web · CVE-2026-48907. Status: Weaponized. Affects: Joomla Content Editor (JCE) extension by Widget Factory. Tags: RCE, unauthenticated, Joomla, JCE, CMS, access-control, webshell, php-webshell, file-upload, CISA-KEV, active-exploitation.webCriticalRCEunauthenticatedJoomlaJCECMSaccess-controlwebshellphp-webshellfile-uploadCISA-KEVactive-exploitationhttps://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-20230-cisco-ucm-webdialer-ssrf-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-20230-cisco-ucm-webdialer-ssrf-rce/Critical severity (CVSS 8.6) — network · CVE-2026-20230. Status: Weaponized. Affects: Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). Tags: SSRF, RCE, Cisco, Unified-Communications-Manager, WebDialer, file-write, webshell, jsp-webshell, CISA-KEV, active-exploitation.networkCriticalSSRFRCECiscoUnified-Communications-ManagerWebDialerfile-writewebshelljsp-webshellCISA-KEVactive-exploitationhttps://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-24061-gnu-telnetd-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-24061-gnu-telnetd-rce/Critical severity (CVSS 9.8) — network · CVE-2026-24061. Status: Weaponized. Affects: GNU Inetutils telnetd. Tags: RCE, unauthenticated, authentication-bypass, telnetd, GNU-Inetutils, NEW-ENVIRON, legacy, OT, CISA-KEV, active-exploitation, Python.networkCriticalRCEunauthenticatedauthentication-bypasstelnetdGNU-InetutilsNEW-ENVIRONlegacyOTCISA-KEVactive-exploitationPythonhttps://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-34908-unifi-os-rce-chain/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-34908-unifi-os-rce-chain/Critical severity (CVSS 10) — network · CVE-2026-34908, CVE-2026-34909, CVE-2026-34910. Status: PoC. Affects: Ubiquiti UniFi OS Server. Tags: unauth-rce, nginx-bypass, path-traversal, command-injection, CISA-KEV, Mirai, Gaafgyt, chain, UniFi, Ubiquiti, network.networkCriticalunauth-rcenginx-bypasspath-traversalcommand-injectionCISA-KEVMiraiGaafgytchainUniFiUbiquitinetworkhttps://poc.intelseclab.com/pocs/web/2026-06-28_cve-2026-20253-splunk-preauth-rce/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-06-28_cve-2026-20253-splunk-preauth-rce/Critical severity — web · CVE-2026-20253. Status: PoC. Affects: Splunk Enterprise. Tags: pre-auth, RCE, PostgreSQL, Splunk, CISA-KEV, lo-export, sidecar, unauthenticated, file-write.webCriticalpre-authRCEPostgreSQLSplunkCISA-KEVlo-exportsidecarunauthenticatedfile-writehttps://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-10520-ivanti-sentry-rce/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-10520-ivanti-sentry-rce/Critical severity (CVSS 10) — network · CVE-2026-10520, CVE-2026-10523. Status: PoC. Affects: Ivanti Sentry (formerly MobileIron Sentry). Tags: pre-auth, RCE, OS-command-injection, Ivanti, Sentry, MICS-API, auth-bypass, admin-creation, CISA-KEV.networkCriticalpre-authRCEOS-command-injectionIvantiSentryMICS-APIauth-bypassadmin-creationCISA-KEVhttps://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-20245-cisco-sdwan-priv-esc/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-20245-cisco-sdwan-priv-esc/High severity (CVSS 7.8) — network · CVE-2026-20245. Status: PoC. Affects: Cisco Catalyst SD-WAN Manager (vManage), SD-WAN Controller (vSmart), SD-WAN Validator (vBond). Tags: privilege-escalation, Cisco, SD-WAN, vManage, file-upload, command-injection, root, CISA-KEV, no-patch, Mandiant, nation-state.networkHighprivilege-escalationCiscoSD-WANvManagefile-uploadcommand-injectionrootCISA-KEVno-patchMandiantnation-statehttps://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-50751-checkpoint-ikev1-bypass/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-50751-checkpoint-ikev1-bypass/Critical severity (CVSS 9.3) — network · CVE-2026-50751. Status: PoC. Affects: Check Point Remote Access VPN / Mobile Access / Spark Firewall. Tags: auth-bypass, VPN, IKEv1, Check-Point, Remote-Access, certificate-bypass, Qilin, ransomware, CISA-KEV, unauthenticated.networkCriticalauth-bypassVPNIKEv1Check-PointRemote-Accesscertificate-bypassQilinransomwareCISA-KEVunauthenticatedhttps://poc.intelseclab.com/pocs/binary/2026-05-17_linux-nftables-uaf-lpe/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_linux-nftables-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2024-1086. Status: Weaponized. Affects: Linux kernel (netfilter nf_tables subsystem). Tags: LPE, UAF, Linux kernel, nf_tables, netfilter, CISA KEV, ransomware, x64.binaryHighLPEUAFLinux kernelnf_tablesnetfilterCISA KEVransomwarex64