CASCACascade Atlas

Evidence dossier

CVE-2012-1823

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals…

Exploited in the wild (CISA KEV since Mar 25, 2022). NVD reports CVSS 2.0 7.5. EPSS estimates 100.0% exploit likelihood as of Oct 16, 2026.

88.6–88.9Priority evidence range
Evidence through Oct 22, 2026, 6:07 PM UTC

As of Oct 22, 2026

Normalized restatement

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

State
PUBLISHED
Published
May 11, 2012
Updated
Nov 4, 2025
Evidence coverage
99%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    certcc

    Record text: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

    Inspect raw assertion
    Field
    container
    Value
    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: PHP-CGI Query String Parameter Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    PHP-CGI Query String Parameter Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 100% probability · 99.99th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.999980000000; percentile 0.999910000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Mar 25, 2022 · first observed Sep 1, 2026

Exploit likelihood100.00%

FIRST EPSS · score date Oct 16, 2026 · 100th percentile · first observed Oct 16, 2026

SeverityCVSS 7.5

NVD · CVSS 2.0 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusLast verified source snapshot retained

The last verified source boundary remains in force for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Oct 22, 2026
Resolution
Review source contract
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Oct 22, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Oct 22, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Oct 22, 2026
Resolution
Resolve identity

Source comparison

Who said what

certccOriginal assertion
Record text

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Inspect raw assertion
Field
container
Value
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

PHP-CGI Query String Parameter Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
PHP-CGI Query String Parameter Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

100% probability · 99.99th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.999980000000; percentile 0.999910000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
30Underlying assertions
17Canonical products
30Target assertions
0Constraint assertions

Grouped from 7 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

18 scope groups

certcc · source assertedn/an/aDirect source scope
Affected: n/a
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "n/a"}]
NVD CPE · OPERATING SYSTEMapplemac_os_xVulnerable target · 2 assertions
Any version (unconstrained) (>= 10.6.8, < 10.7.5); Any version (unconstrained) (>= 10.8.0, < 10.8.2)Canonical identity product-94613e1f5039e71a9805f20421d56ac6a61e2707d3f97a08fdf6823a65dc7b76Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    5 · node/0 · match 1
    Logic
    OR
    Version bounds
    from including 10.8.0; through excluding 10.8.2
    Match ID
    283b3df2-dafa-4333-b3cf-181acd635137
  2. cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    5 · node/0 · match 0
    Logic
    OR
    Version bounds
    from including 10.6.8; through excluding 10.7.5
    Match ID
    bf149f33-4d3b-4252-8d96-ab912b2deb43
NVD CPE · OPERATING SYSTEMdebiandebian_linuxVulnerable target · 1 assertions
Version 6.0Canonical identity product-3ccb4bc87dfae98fa2f2a06435fe5b3d9be78572fb958a89f2d7a96b4066447eLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    2 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    036e8a89-7a16-411f-9d31-676313bb7244
NVD CPE · OPERATING SYSTEMfedoraprojectfedoraVulnerable target · 2 assertions
Version 39; Version 40Canonical identity product-c96c7662a6606ed7594747da3d7ba9ee3a9758ab11658f6a3f42616361472e47Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    1 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b8edb836-4e6a-4b71-b9b2-aa3e03e0f646
  2. cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    1 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ca277a6c-83ec-4536-9125-97b84c4faf59
NVD CPE · OPERATING SYSTEMhphp-uxVulnerable target · 2 assertions
Version b.11.23; Version b.11.31Canonical identity product-0e113084e98722ecb2bd0dad810b56a8414556ee39cd5f91cadcaff5e7f19145Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:hp:hp-ux:b.11.23:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    3 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    12c73959-3e02-4847-8962-651d652800ee
  2. cpe:2.3:o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    3 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b64bba96-fb3c-46ac-9a29-50ee02714fe9
NVD CPE · OPERATING SYSTEMopensuseopensuseVulnerable target · 2 assertions
Version 11.4; Version 12.1Canonical identity product-66ca8198d1887ac9754d1aad85d76f1edfc54c873eb2cd9bedf566863f5e07bdLinked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    de554781-1eb9-446e-911f-6c11970c47f4
  2. cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ebb2c482-d2a4-48b3-ace7-e1dfdcc409b5
NVD CPE · APPLICATIONphpphpVulnerable target · 2 assertions
Any version (unconstrained) (< 5.3.12); Any version (unconstrained) (>= 5.4.0, < 5.4.2)Canonical identity product-e6438e3fdd6f4fab833b9e95f3122542080fe89ddf2636dd7eb83d66f8118f15Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 0
    Logic
    OR
    Version bounds
    through excluding 5.3.12
    Match ID
    b7565237-10c7-44c5-bfa0-24c84e7b10c3
  2. cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 1
    Logic
    OR
    Version bounds
    from including 5.4.0; through excluding 5.4.2
    Match ID
    2e2dd924-dbe9-438d-b5d9-60840046ca08
NVD CPE · APPLICATIONredhatapplication_stackVulnerable target · 1 assertions
Version 2.0Canonical identity product-590b17d48a87cd8bd01cf220aa29aee1d87ef9ca8eb9e880efbd8df7bbea4bdbLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:redhat:application_stack:2.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    847a353b-833b-4a2a-8b87-2c6ba88a8cc8
NVD CPE · OPERATING SYSTEMredhatenterprise_linux_desktopVulnerable target · 1 assertions
Version 6.0Canonical identity product-ebce605e64c58caa7df6a30e91702332cd8c0be8f801e44353e6350e913ec5aeLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ee249e1b-a1fd-4e08-aa71-a0e1f10ffe97
NVD CPE · OPERATING SYSTEMredhatenterprise_linux_eusVulnerable target · 3 assertions
Version 5.6; Version 6.1; Version 6.2Canonical identity product-8abf8d7f0342f690712d750b6cf7fbf4068eb0134c40a51c5b57b074f81c6378Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:redhat:enterprise_linux_eus:6.1:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3beec943-452c-4a19-b492-5ec8ade427cd
  2. cpe:2.3:o:redhat:enterprise_linux_eus:5.6:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    903512fc-0017-4564-9b89-7e64ffb14b11
  3. cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    c0554c89-3716-49f3-bfae-e008d5e4e29c
NVD CPE · OPERATING SYSTEMredhatenterprise_linux_serverVulnerable target · 2 assertions
Version 5.0; Version 6.0Canonical identity product-8db20157ede2f731f576213a7e555a24d2424bb17aed8e43ad9b77c3587f9deaLinked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 9
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9bbcd86a-e6c7-4444-9d74-f861084090f0
  2. cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 8
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    54d669d4-6d7e-449d-80c1-28fa44f06ffe
NVD CPE · OPERATING SYSTEMredhatenterprise_linux_server_ausVulnerable target · 2 assertions
Version 5.3; Version 5.6Canonical identity product-7120df83a9b73aae2817084ac2070ecc7d1fbfcada23076a424824e660688aaeLinked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 10
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1f87b994-28e4-4095-8770-6433de9c93ab
  2. cpe:2.3:o:redhat:enterprise_linux_server_aus:5.6:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 11
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    bb6adfb8-210d-4e46-82a2-1c8705928382
NVD CPE · OPERATING SYSTEMredhatenterprise_linux_workstationVulnerable target · 2 assertions
Version 5.0; Version 6.0Canonical identity product-b2aa744c9fb2b4ef0e3b842acbf37879ad4ac43af291292cfb0906170b204ab9Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 12
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d0ac5cd5-6e58-433c-9eb3-6dfe5656463e
  2. cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 13
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    e5ed5807-55b7-47c5-97a6-03233f4fbc3a
NVD CPE · APPLICATIONredhatgluster_storage_server_for_on-premiseVulnerable target · 1 assertions
Version 2.0Canonical identity product-5fb86209cb28a171a615b064839fb8a647f4262a91b6043cb733d29a3026f76eLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    59d47e43-886e-4114-96a2-dbe719ea3a89
NVD CPE · APPLICATIONredhatstorageVulnerable target · 1 assertions
Version 2.0Canonical identity product-c6ae95e309497ada4c1889e6d03b86bd52986c56a51129f0b89bc25e3be2097cLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    52b90a04-dd6d-4ae7-a0e5-6b381127d507
NVD CPE · APPLICATIONredhatstorage_for_public_cloudVulnerable target · 1 assertions
Version 2.0Canonical identity product-f361d0d92654b5e2de70df275614700a64db37e58d08b8dea7fe42bedafa987cLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f0257753-51c3-45f2-baa4-4c1f2deab7a6
NVD CPE · OPERATING SYSTEMsuselinux_enterprise_serverVulnerable target · 3 assertions
Version 10; Version 11Canonical identity product-4f2240e45c4385f8980643ce838561b90551012dc317022ee66a7d71a9db8e28Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d1d7b467-58dd-45f1-9f1f-632620df072a
  2. cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    88d6e858-fd8f-4c55-b7d5-ceeda2bba898
  3. cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    db4d6749-81a1-41d7-bf4f-1c45a7f49a22
NVD CPE · OPERATING SYSTEMsuselinux_enterprise_software_development_kitVulnerable target · 2 assertions
Version 10; Version 11Canonical identity product-bd4950335ff1f3f03b9dd6fa5c596f7c67c9ea6d150272de074ec3767af3532aLinked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5aa37837-3083-4dc7-94f4-54fd5d7cb53c
  2. cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    436ef2ed-fdbb-4b64-8ec4-33c3e4253f06

Affected-product evidence

Accepted scope and product mapping

17 canonical links · 1 source-reported links

Mapping establishedEvidence supported

vendor-70d82f349c5bfe520cb6c54b8ed40a72fd9fe4d55a875ed1d539fb17472e7b24 · product-0e113084e98722ecb2bd0dad810b56a8414556ee39cd5f91cadcaff5e7f19145

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
4bdcf37b-d0ea-4b12-8174-7734411891dc9bb7c01a-0ac3-4b73-9835-796f39946ea3
Mapping establishedEvidence supported

vendor-66ae8c5e06427f7450637d18322b0dc411c0b469d940341cf076a620d444fe3c · product-3ccb4bc87dfae98fa2f2a06435fe5b3d9be78572fb958a89f2d7a96b4066447e

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
826c53db-8fc0-48a8-bf30-62246bfcb30b
Mapping establishedEvidence supported

vendor-6bbcd126779403146e957d68529786b086421e0676d9e90a4d53d03594694fb2 · product-4f2240e45c4385f8980643ce838561b90551012dc317022ee66a7d71a9db8e28

Source class
Nvd cpe vulnerable target
Assertions
3
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
4e695c9b-f3f6-458f-820a-54536498b4867597034c-1bdb-4001-8757-b5d50aa1f1dbb30147b2-8a10-41a6-9fdd-aa9ced80f376
Mapping establishedEvidence supported

vendor-c759fafc60d6abc1277ecbf1ee6294d1f25ae0a4c7d5d0d9355c414b2db182cc · product-590b17d48a87cd8bd01cf220aa29aee1d87ef9ca8eb9e880efbd8df7bbea4bdb

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
9d95a4d5-de87-4438-a239-f1545b8d8144
Mapping establishedEvidence supported

vendor-c759fafc60d6abc1277ecbf1ee6294d1f25ae0a4c7d5d0d9355c414b2db182cc · product-5fb86209cb28a171a615b064839fb8a647f4262a91b6043cb733d29a3026f76e

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
617dd468-0c18-4084-b577-e20130a955f9
Mapping establishedEvidence supported

vendor-f98e1750e4b030e2bb71130d14421ff255427227a8b696c92978cf6c77fc265d · product-66ca8198d1887ac9754d1aad85d76f1edfc54c873eb2cd9bedf566863f5e07bd

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
06bd9d5a-19d0-4086-9ddb-9fdddaf9c536c4dc6997-a515-4970-940b-be4702864953
Mapping establishedEvidence supported

vendor-c759fafc60d6abc1277ecbf1ee6294d1f25ae0a4c7d5d0d9355c414b2db182cc · product-7120df83a9b73aae2817084ac2070ecc7d1fbfcada23076a424824e660688aae

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
3e4adef2-f6dd-4552-a1c1-92779f0950eb8aa69d37-88a7-4069-8380-0b69553a0f65
Mapping establishedEvidence supported

vendor-c759fafc60d6abc1277ecbf1ee6294d1f25ae0a4c7d5d0d9355c414b2db182cc · product-8abf8d7f0342f690712d750b6cf7fbf4068eb0134c40a51c5b57b074f81c6378

Source class
Nvd cpe vulnerable target
Assertions
3
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
34450c47-635a-48f9-9798-805fca0b928875b7f90d-4be8-4432-89f5-41edd3694d73f2b53840-dd45-43d3-96a9-186ff6271910
Mapping establishedEvidence supported

vendor-c759fafc60d6abc1277ecbf1ee6294d1f25ae0a4c7d5d0d9355c414b2db182cc · product-8db20157ede2f731f576213a7e555a24d2424bb17aed8e43ad9b77c3587f9dea

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
71cd3238-3569-44a6-8733-ee891339d87c7fa52dd9-bad6-4aed-ad58-a03b5fa81b8e
Mapping establishedEvidence supported

vendor-d6ed6f1e35de2e16a8a10f2ae364dab009bb2afadd609071b20da24d60ce2829 · product-94613e1f5039e71a9805f20421d56ac6a61e2707d3f97a08fdf6823a65dc7b76

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
0d7f299d-4cb4-4231-a440-0d51226a064c4556eb01-3a29-4907-aa51-cd7bd3e19f16
Mapping establishedEvidence supported

vendor-c759fafc60d6abc1277ecbf1ee6294d1f25ae0a4c7d5d0d9355c414b2db182cc · product-b2aa744c9fb2b4ef0e3b842acbf37879ad4ac43af291292cfb0906170b204ab9

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
49da6710-b869-48f3-83f8-7f9266f37589bf0314a5-da98-48c3-88de-33b9921fab9d
Mapping establishedEvidence supported

vendor-6bbcd126779403146e957d68529786b086421e0676d9e90a4d53d03594694fb2 · product-bd4950335ff1f3f03b9dd6fa5c596f7c67c9ea6d150272de074ec3767af3532a

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
5150cf50-ac66-4048-aaeb-539547a60a4094e7eab9-e3ee-4f63-8fdb-d38815836dc6
Mapping establishedEvidence supported

vendor-c759fafc60d6abc1277ecbf1ee6294d1f25ae0a4c7d5d0d9355c414b2db182cc · product-c6ae95e309497ada4c1889e6d03b86bd52986c56a51129f0b89bc25e3be2097c

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
b7121dc5-2222-4682-ad5a-02cb26a1fb69
Mapping establishedEvidence supported

vendor-2d566b06907460b10e6e48c8544126e19f1d6df137983056edae8d0b51e34e45 · product-c96c7662a6606ed7594747da3d7ba9ee3a9758ab11658f6a3f42616361472e47

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
54577024-e5f2-4546-bf7b-4c4e36ef12fbe0e6dd70-44e9-4480-8c76-76f36ce4b144
Mapping establishedEvidence supported

vendor-1b299fa4275f757dd43e86a66c279822d72332da344f4534dae151dcbb50c610 · product-e6438e3fdd6f4fab833b9e95f3122542080fe89ddf2636dd7eb83d66f8118f15

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
6192ed09-6e8b-473a-8636-ce65c55e5d49fc5d254a-4051-4c0b-a3d0-0e6c265d4095
Mapping establishedEvidence supported

vendor-c759fafc60d6abc1277ecbf1ee6294d1f25ae0a4c7d5d0d9355c414b2db182cc · product-ebce605e64c58caa7df6a30e91702332cd8c0be8f801e44353e6350e913ec5ae

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
7c51cbe9-1da9-46f1-8e60-ec11771ceee4
Mapping establishedEvidence supported

vendor-c759fafc60d6abc1277ecbf1ee6294d1f25ae0a4c7d5d0d9355c414b2db182cc · product-f361d0d92654b5e2de70df275614700a64db37e58d08b8dea7fe42bedafa987c

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
34569745-1e91-494e-a877-88e0fc055459
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
587be5c9-8eeb-432a-a192-937b6c9eea45

Assessments

CVSS by origin

7.5
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:N/AC:L/Au:N/C:P/I:P/A:P
9.8
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8
CISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Direct CVE/CNA normalized decisions

9.8Priority eligible

CISA-ADP

CVSS 3.1 · Secondary · Independent enrichment · rank 2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Validation
Valid match
Recomputed
9.8
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.