Vulnerability Search Examples · Example 8 of 9 in Filters › CISA KEV Catalog

KEV CVEs Used by Ransomware

POSThttps://api.deepinfo.com/v1/discovery/vulnerability-search

CVEs that CISA knows are used in ransomware campaigns.

Field: enrichment.cisa_kev.known_ransomware_campaign_use
Operator: eq

enrichment.cisa_kev.known_ransomware_campaign_use is Known when the CVE is known to be used in ransomware campaigns, otherwise Unknown.

eq matches the exact value Known.

In the response, look at results[].enrichment.cisa_kev.known_ransomware_campaign_use.

Request

curl

curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
        "type": "eq",
        "value": "Known"
      }
    ]
  }
}'

Python

import requests

url = "https://api.deepinfo.com/v1/discovery/vulnerability-search"

params = {
    "page_size": "25"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
}

payload = {
    "filters": {
        "must": [
            {
                "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
                "type": "eq",
                "value": "Known"
            }
        ]
    }
}

response = requests.post(url, params=params, headers=headers, json=payload)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    filters: {
      must: [
        {
          name: "enrichment.cisa_kev.known_ransomware_campaign_use",
          type: "eq",
          value: "Known"
        }
      ]
    }
  }),
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	payload := strings.NewReader(`{
  "filters": {
    "must": [
      {
        "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
        "type": "eq",
        "value": "Known"
      }
    ]
  }
}`)

	req, err := http.NewRequest("POST", "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25", payload)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String body = """
            {
              "filters": {
                "must": [
                  {
                    "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
                    "type": "eq",
                    "value": "Known"
                  }
                ]
              }
            }""";

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

var body = """
    {
      "filters": {
        "must": [
          {
            "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
            "type": "eq",
            "value": "Known"
          }
        ]
      }
    }
    """;

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$body = <<<'JSON'
{
  "filters": {
    "must": [
      {
        "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
        "type": "eq",
        "value": "Known"
      }
    ]
  }
}
JSON;

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25')

request = Net::HTTP::Post.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = <<~'JSON'.chomp
  {
    "filters": {
      "must": [
        {
          "name": "enrichment.cisa_kev.known_ransomware_campaign_use",
          "type": "eq",
          "value": "Known"
        }
      ]
    }
  }
JSON

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Shortened for this page: results: 3 of 25 shown; results[].configurations[].nodes[].cpe_match: first 10 items; results[].enrichment.cpe: first 10 items

Response Body

{
  "page": 1,
  "page_size": 25,
  "result_count": 362,
  "results": [
    {
      "id": "CVE-2026-20131",
      "source_identifier": "user@cisco.com",
      "published": "2026-03-04T18:16:27Z",
      "last_modified": "2026-06-17T10:17:10Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": "2026-03-19",
      "cisa_action_due": "2026-03-22",
      "cisa_required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "cisa_vulnerability_name": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root&nbsp;on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.\r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced."
        },
        {
          "lang": "es",
          "value": "Una vulnerabilidad en la interfaz de gestión basada en web del software Cisco Secure Firewall Management Center (FMC) podría permitir a un atacante remoto no autenticado ejecutar código Java arbitrario como root en un dispositivo afectado.\nEsta vulnerabilidad se debe a la deserialización insegura de un flujo de bytes Java proporcionado por el usuario. Un atacante podría explotar esta vulnerabilidad enviando un objeto Java serializado diseñado a la interfaz de gestión basada en web de un dispositivo afectado. Un exploit exitoso podría permitir al atacante ejecutar código arbitrario en el dispositivo y elevar privilegios a root.\nNota: Si la interfaz de gestión de FMC no tiene acceso público a internet, la superficie de ataque asociada con esta vulnerabilidad se reduce."
        }
      ],
      "references": [
        {
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh",
          "source": "user@cisco.com",
          "tags": [
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "Technical Description"
          ]
        },
        {
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "US Government Resource"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@cisco.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@cisco.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-502"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.13:*:*:*:*:*:*:*",
                  "match_criteria_id": "E0780AD6-4F38-4400-AA63-E41879F74B68",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.14:*:*:*:*:*:*:*",
                  "match_criteria_id": "86BA5BA6-1F79-4C89-A3F4-A56E2B664AED",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.15:*:*:*:*:*:*:*",
                  "match_criteria_id": "52C7994F-AA17-467B-919E-A49F0CC9DB47",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.16:*:*:*:*:*:*:*",
                  "match_criteria_id": "9F007F6B-1EAA-468C-8159-78B020DF1E58",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.17:*:*:*:*:*:*:*",
                  "match_criteria_id": "C9053FDE-A6BE-4535-AE36-A323F8B7ACA4",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.18:*:*:*:*:*:*:*",
                  "match_criteria_id": "6E255975-F952-43AB-A577-B8D331DDB3AB",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:*",
                  "match_criteria_id": "DFA94312-376E-4785-888F-3C07612E1DF7",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:*",
                  "match_criteria_id": "29E73FBF-2579-4660-AFFA-7F9607004226",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:*",
                  "match_criteria_id": "87FAAFFB-0589-441B-8289-8B8A6E18F705",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:*",
                  "match_criteria_id": "73B92119-793D-4A43-A056-24DB6826E759",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.13:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.13",
            "affected_versions_last": "6.4.0.13"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.14:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.14",
            "affected_versions_last": "6.4.0.14"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.15:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.15",
            "affected_versions_last": "6.4.0.15"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.16:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.16",
            "affected_versions_last": "6.4.0.16"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.17:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.17",
            "affected_versions_last": "6.4.0.17"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.18:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "6.4.0.18",
            "affected_versions_last": "6.4.0.18"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "7.0.0",
            "affected_versions_last": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "7.0.0.1",
            "affected_versions_last": "7.0.0.1"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "7.0.1",
            "affected_versions_last": "7.0.1"
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:*",
            "vendor": "cisco",
            "product": "secure_firewall_management_center",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "7.0.1.1",
            "affected_versions_last": "7.0.1.1"
          }
        ],
        "cwe": [
          {
            "id": 502,
            "owasptop10_2021": "A08 Software and Data Integrity Failures",
            "name": "Deserialization of Untrusted Data",
            "description": "The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.",
            "capec_id": [
              586
            ],
            "scope": [
              "Availability",
              "Integrity",
              "Other"
            ],
            "impact": [
              "DoS: Resource Consumption (CPU)",
              "Modify Application Data",
              "Unexpected State",
              "Varies by Context"
            ],
            "detection_method": [
              "Automated Static Analysis"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.33379,
          "percentile": 0.98303,
          "date": "2026-09-23"
        },
        "cisa_kev": {
          "vendor_project": "Cisco",
          "product": "Secure Firewall Management Center (FMC)",
          "vulnerability_name": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability",
          "date_added": "2026-03-19",
          "short_description": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.",
          "required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
          "due_date": "2026-03-22",
          "known_ransomware_campaign_use": "Known",
          "notes": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh ; https://nvd.nist.gov/vuln/detail/CVE-2026-20131"
        },
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "user@cisco.com",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2026-15409",
      "source_identifier": "user@sonicwall.com",
      "published": "2026-07-14T20:16:56Z",
      "last_modified": "2026-07-16T05:16:18Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": "2026-07-14",
      "cisa_action_due": "2026-07-17",
      "cisa_required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "cisa_vulnerability_name": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location."
        }
      ],
      "references": [
        {
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008",
          "source": "user@sonicwall.com",
          "tags": [
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "US Government Resource"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@sonicwall.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-918"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": "AND",
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
                  "match_criteria_id": "7F861049-5B88-4E18-A0E7-D1E2BC7A4342",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
                  "match_criteria_id": "E4A6CA48-E2D9-4F18-8FC8-B1EE7F51789C",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
                  "match_criteria_id": "EBCE7761-8416-4942-B0BD-426EFC73B57C",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:*",
                  "match_criteria_id": "CE23BD37-4112-407F-9E34-04CB5A4DA996",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:*",
                  "match_criteria_id": "95E3313E-0647-40ED-9848-5AC01188A84F",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:*",
                  "match_criteria_id": "75F6B9CE-73E4-42BE-9CE1-FD79255CDD0B",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            },
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": false,
                  "criteria": "cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*",
                  "match_criteria_id": "7B24D300-1154-49A1-A1F3-FB0CC717166A",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        },
        {
          "operator": "AND",
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
                  "match_criteria_id": "55CD7766-9F2D-450D-A878-AA1522E8FF68",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
                  "match_criteria_id": "EAF12D10-FA8F-471E-B008-68E0E29089C6",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
                  "match_criteria_id": "79920402-165D-4D81-BFD2-9F679A48671A",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02283:*:*:*:*:*:*:*",
                  "match_criteria_id": "6842E4D7-BEDA-41FB-AEC3-CEB3692374C2",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02624:*:*:*:*:*:*:*",
                  "match_criteria_id": "6AF4557F-ABAF-4795-915A-695383F64EEB",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02800:*:*:*:*:*:*:*",
                  "match_criteria_id": "9459507A-A2C8-400D-8669-E8ADBDE61DE0",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            },
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": false,
                  "criteria": "cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:*",
                  "match_criteria_id": "E9B414C5-C376-4216-A267-ABC0930905CE",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        },
        {
          "operator": "AND",
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03245:*:*:*:*:*:*:*",
                  "match_criteria_id": "571C9CA1-F660-4479-9E91-B3B1714A2090",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03387:*:*:*:*:*:*:*",
                  "match_criteria_id": "58706C99-B77F-4AE5-BD45-EBA65DEE2485",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03434:*:*:*:*:*:*:*",
                  "match_criteria_id": "9E698DFA-1684-43E3-9964-0E207A7A2CC1",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02283:*:*:*:*:*:*:*",
                  "match_criteria_id": "F2F44543-2404-4CDF-9D2F-1B851660F5D5",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02624:*:*:*:*:*:*:*",
                  "match_criteria_id": "1E14F40F-4AA1-42B4-998E-AC965FBBE519",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02800:*:*:*:*:*:*:*",
                  "match_criteria_id": "43197E99-0500-4971-8A66-4E70F8138289",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            },
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": false,
                  "criteria": "cpe:2.3:a:sonicwall:sma8200v:-:*:*:*:*:*:*:*",
                  "match_criteria_id": "653B5F4D-7417-4A85-B385-46157A1540A6",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03245",
            "affected_versions_last": "12.4.3-03245"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03387",
            "affected_versions_last": "12.4.3-03387"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03434",
            "affected_versions_last": "12.4.3-03434"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.5.0-02283",
            "affected_versions_last": "12.5.0-02283"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.5.0-02624",
            "affected_versions_last": "12.5.0-02624"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.5.0-02800",
            "affected_versions_last": "12.5.0-02800"
          },
          {
            "criteria": "cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma6210",
            "product_type": "h",
            "vulnerable": false,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": null,
            "affected_versions_last": null
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma7210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03245",
            "affected_versions_last": "12.4.3-03245"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma7210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03387",
            "affected_versions_last": "12.4.3-03387"
          },
          {
            "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
            "vendor": "sonicwall",
            "product": "sma7210_firmware",
            "product_type": "o",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "12.4.3-03434",
            "affected_versions_last": "12.4.3-03434"
          }
        ],
        "cwe": [
          {
            "id": 918,
            "owasptop10_2021": "A10 Server-Side Request Forgery (SSRF)",
            "name": "Server-Side Request Forgery (SSRF)",
            "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.",
            "capec_id": [
              664
            ],
            "scope": [
              "Access Control",
              "Confidentiality",
              "Integrity"
            ],
            "impact": [
              "Bypass Protection Mechanism",
              "Execute Unauthorized Code or Commands",
              "Read Application Data"
            ],
            "detection_method": [
              "Automated Static Analysis"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.84535,
          "percentile": 0.99691,
          "date": "2026-09-23"
        },
        "cisa_kev": {
          "vendor_project": "SonicWall",
          "product": "SMA1000 Appliances",
          "vulnerability_name": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
          "date_added": "2026-07-14",
          "short_description": "SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.",
          "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
          "due_date": "2026-07-17",
          "known_ransomware_campaign_use": "Known",
          "notes": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15409"
        },
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2025-55182",
      "source_identifier": "user@fb.com",
      "published": "2025-12-03T16:15:56Z",
      "last_modified": "2026-08-04T05:16:35Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": "2025-12-05",
      "cisa_action_due": "2025-12-12",
      "cisa_required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "cisa_vulnerability_name": "Meta React Server Components Remote Code Execution Vulnerability",
      "descriptions": [
        {
          "lang": "en",
          "value": "A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints."
        }
      ],
      "references": [
        {
          "url": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components",
          "source": "user@fb.com",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://www.facebook.com/security/advisories/cve-2025-55182",
          "source": "user@fb.com",
          "tags": [
            "Vendor Advisory"
          ]
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/12/03/4",
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Patch",
            "Third Party Advisory"
          ]
        },
        {
          "url": "https://news.ycombinator.com/item?id=46136026",
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Issue Tracking"
          ]
        },
        {
          "url": "https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "Third Party Advisory"
          ]
        },
        {
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "US Government Resource"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@fb.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@nist.gov",
          "type": "Primary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-502"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*",
                  "match_criteria_id": "C66E1B0F-8C3F-4D27-9F46-B6EC78D8C60B",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*",
                  "match_criteria_id": "C6C1C3E2-542D-4001-BFA9-6CF5A038971D",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*",
                  "match_criteria_id": "A0907E1C-E2D2-44A4-AA46-CE80BCA4E015",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*",
                  "match_criteria_id": "0030B5E1-E79E-4C48-B500-91747FE2751D",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        },
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
                  "match_criteria_id": "FC2BCD83-CC87-4CDC-AD9B-2055912A8463",
                  "version_start_including": "15.0.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "15.0.5"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
                  "match_criteria_id": "C5E767D4-E46F-4CA6-A22F-4D0671B9B102",
                  "version_start_including": "15.1.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "15.1.9"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
                  "match_criteria_id": "5EFB6CB7-4A4F-464A-A1D8-62B50DF0B4BA",
                  "version_start_including": "15.2.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "15.2.6"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
                  "match_criteria_id": "83AF54D7-410D-42B4-853A-8A1973636542",
                  "version_start_including": "15.3.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "15.3.6"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
                  "match_criteria_id": "3D666EA7-BDAE-4E67-A331-B7403C3AA482",
                  "version_start_including": "15.4.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "15.4.8"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
                  "match_criteria_id": "E666ECDA-7A29-4D3D-AC40-357F044AD595",
                  "version_start_including": "15.5.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "15.5.7"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
                  "match_criteria_id": "CF65554E-4BF0-4344-AE7F-9E09E34E084F",
                  "version_start_including": "16.0.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "16.0.7"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:*",
                  "match_criteria_id": "B209A306-CE1A-448D-8653-7627302399B7",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:*",
                  "match_criteria_id": "D1DCAC23-7ED0-456B-8AE2-57689199F708",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:*",
                  "match_criteria_id": "8B35D612-AC2A-4697-934F-372E4D5EE3F4",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": null
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*",
            "vendor": "facebook",
            "product": "react",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "19.0.0",
            "affected_versions_last": "19.0.0"
          },
          {
            "criteria": "cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*",
            "vendor": "facebook",
            "product": "react",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "19.1.0",
            "affected_versions_last": "19.1.0"
          },
          {
            "criteria": "cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*",
            "vendor": "facebook",
            "product": "react",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "19.1.1",
            "affected_versions_last": "19.1.1"
          },
          {
            "criteria": "cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*",
            "vendor": "facebook",
            "product": "react",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": null,
            "affected_versions_first": "19.2.0",
            "affected_versions_last": "19.2.0"
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "vendor": "vercel",
            "product": "next.js",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "15.0.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "15.0.5",
            "affected_versions_first": "15.0.0",
            "affected_versions_last": "15.0.4"
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "vendor": "vercel",
            "product": "next.js",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "15.1.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "15.1.9",
            "affected_versions_first": "15.1.0",
            "affected_versions_last": "15.1.8"
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "vendor": "vercel",
            "product": "next.js",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "15.2.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "15.2.6",
            "affected_versions_first": "15.2.0",
            "affected_versions_last": "15.2.5"
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "vendor": "vercel",
            "product": "next.js",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "15.3.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "15.3.6",
            "affected_versions_first": "15.3.0",
            "affected_versions_last": "15.3.5"
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "vendor": "vercel",
            "product": "next.js",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "15.4.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "15.4.8",
            "affected_versions_first": "15.4.0",
            "affected_versions_last": "15.4.7"
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "vendor": "vercel",
            "product": "next.js",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "15.5.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "15.5.7",
            "affected_versions_first": "15.5.0",
            "affected_versions_last": "15.5.6"
          }
        ],
        "cwe": [
          {
            "id": 502,
            "owasptop10_2021": "A08 Software and Data Integrity Failures",
            "name": "Deserialization of Untrusted Data",
            "description": "The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.",
            "capec_id": [
              586
            ],
            "scope": [
              "Availability",
              "Integrity",
              "Other"
            ],
            "impact": [
              "DoS: Resource Consumption (CPU)",
              "Modify Application Data",
              "Unexpected State",
              "Varies by Context"
            ],
            "detection_method": [
              "Automated Static Analysis"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.99802,
          "percentile": 0.99958,
          "date": "2026-09-23"
        },
        "cisa_kev": {
          "vendor_project": "Meta",
          "product": "React Server Components",
          "vulnerability_name": "Meta React Server Components Remote Code Execution Vulnerability",
          "date_added": "2025-12-05",
          "short_description": "Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.",
          "required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
          "due_date": "2025-12-12",
          "known_ransomware_campaign_use": "Known",
          "notes": "Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182"
        },
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "user@fb.com",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    }
  ]
}

Content-Type: application/json
ratelimit-limit: 1
ratelimit-remaining: 0
ratelimit-reset: 1
x-ratelimit-limit-second: 1
x-ratelimit-remaining-second: 0
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a

Request

What this example sends. Every parameter is documented on Search; the exact request is in the code panel.

Parameter	Value
`page_size`query	`25`
`filters.must[0].name`body	`enrichment.cisa_kev.known_ransomware_campaign_use`
`filters.must[0].type`body	`eq`
`filters.must[0].value`body	`Known`

Reference updated September 26, 2026

Request

Related Examples