# First Affected Release 2023.4 CVEs whose affected range begins with the known release 2023.4. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/enrichment-cpe-affected-versions-first/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs whose affected range begins with the known release 2023.4. Example 10 of 14 in **Filters › Affected Products (CPE)** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `enrichment.cpe.affected_versions_first` · `operator` `eq` `enrichment.cpe.affected_versions_first` is the first known release inside the affected range. `eq` matches the exact value `2023.4`. In the response, look at `results[].enrichment.cpe[].affected_versions_first`: the range of N-able N-central in CVE-2026-86218 has no lower bound, and 2023.4 is the first release Deepinfo knows inside it. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `enrichment.cpe.affected_versions_first` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `2023.4` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "enrichment.cpe.affected_versions_first", "type": "eq", "value": "2023.4" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 13 shown `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 13, "results": [ { "id": "CVE-2026-86218", "source_identifier": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "published": "2026-09-06T03:17:17Z", "last_modified": "2026-09-09T05:18:19Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2026-09-08", "cisa_action_due": "2026-09-11", "cisa_required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "cisa_vulnerability_name": "N-able N-central Static Code Injection Vulnerability", "descriptions": [ { "lang": "en", "value": "N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14." } ], "references": [ { "url": "https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution", "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "metrics": { "cvss_metric_v40": [ { "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-96" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*", "match_criteria_id": "6CEC2750-AFFB-40A4-97E0-88BDAC106F5E", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2026.3" }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:-:*:*:*:*:*:*", "match_criteria_id": "EB21160B-DDC4-4F70-A703-E313DED8CAF2", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix1:*:*:*:*:*:*", "match_criteria_id": "B28786B6-1DFC-4088-B3CC-C099719EDA17", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix2:*:*:*:*:*:*", "match_criteria_id": "24B69FFD-40FD-4DE2-AC51-A2101AD28EB3", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix3:*:*:*:*:*:*", "match_criteria_id": "BFA703C2-2F80-4FAC-9DA8-EE33A0F0646F", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*", "vendor": "n-able", "product": "n-central", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2026.3", "affected_versions_first": "2023.4", "affected_versions_last": "2026.2" }, { "criteria": "cpe:2.3:a:n-able:n-central:2026.3:-:*:*:*:*:*:*", "vendor": "n-able", "product": "n-central", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2026.3", "affected_versions_last": "2026.3" }, { "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix1:*:*:*:*:*:*", "vendor": "n-able", "product": "n-central", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2026.3", "affected_versions_last": "2026.3" }, { "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix2:*:*:*:*:*:*", "vendor": "n-able", "product": "n-central", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2026.3", "affected_versions_last": "2026.3" }, { "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix3:*:*:*:*:*:*", "vendor": "n-able", "product": "n-central", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2026.3", "affected_versions_last": "2026.3" } ], "cwe": [ { "id": 96, "owasptop10_2021": "A03 Injection", "name": "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", "description": "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.", "capec_id": [ 35, 73, 77, 81, 85 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Non-Repudiation", "Other" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Hide Activities", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.07494, "percentile": 0.94295, "date": "2026-09-21" }, "cisa_kev": { "vendor_project": "N-able", "product": "N-central", "vulnerability_name": "N-able N-central Static Code Injection Vulnerability", "date_added": "2026-09-08", "short_description": "N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.", "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "due_date": "2026-09-11", "known_ransomware_campaign_use": "Unknown", "notes": "https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/ ; https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86218" }, "vdeep_metric": { "available_versions": [ "4.0", "3.1" ], "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2025-11367", "source_identifier": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "published": "2025-11-12T16:15:35Z", "last_modified": "2026-06-17T08:30:19Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization" } ], "references": [ { "url": "https://me.n-able.com/s/security-advisory/aArVy0000000rfRKAQ/cve202511367-ncentral-windows-software-probe-remote-code-execution", "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "tags": [ "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": [ { "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-502" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*", "match_criteria_id": "02C3E2C7-F1EC-419A-988C-586E7DDF6685", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2025.4" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*", "vendor": "n-able", "product": "n-central", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2025.4", "affected_versions_first": "2023.4", "affected_versions_last": "2025.3.1" } ], "cwe": [ { "id": 502, "owasptop10_2021": "A08 Software and Data Integrity Failures", "name": "Deserialization of Untrusted Data", "description": "The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.", "capec_id": [ 586 ], "scope": [ "Availability", "Integrity", "Other" ], "impact": [ "DoS: Resource Consumption (CPU)", "Modify Application Data", "Unexpected State", "Varies by Context" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.0058, "percentile": 0.4643, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0", "3.1" ], "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2024-7569", "source_identifier": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "published": "2024-08-13T19:15:16Z", "last_modified": "2026-06-17T08:20:27Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret via debug information." }, { "lang": "es", "value": "Una vulnerabilidad de divulgación de información en Ivanti ITSM on-premise y Neurons for ITSM versiones 2023.4 y anteriores permite a un atacante no autenticado obtener el secreto del cliente OIDC a través de información de depuración." } ], "references": [ { "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2024-7569-CVE-2024-7570", "source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "tags": [ "Patch", "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "REQUIRED", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.6, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.8, "impact_score": 6.0 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-215" }, { "lang": "en", "value": "CWE-922" } ] }, { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "NVD-CWE-Other" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:ivanti:neurons_for_itsm:2023.2:*:*:*:*:*:*:*", "match_criteria_id": "F39EF220-4A92-42D0-88DD-172D077D3735", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:ivanti:neurons_for_itsm:2023.3:*:*:*:*:*:*:*", "match_criteria_id": "AB23010B-58A3-4D77-A73B-98FA987D37AC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:ivanti:neurons_for_itsm:2023.4:*:*:*:*:*:*:*", "match_criteria_id": "61711984-5033-4DB6-9EE9-E4694E877698", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:ivanti:neurons_for_itsm:2023.2:*:*:*:*:*:*:*", "vendor": "ivanti", "product": "neurons_for_itsm", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2023.2", "affected_versions_last": "2023.2" }, { "criteria": "cpe:2.3:a:ivanti:neurons_for_itsm:2023.3:*:*:*:*:*:*:*", "vendor": "ivanti", "product": "neurons_for_itsm", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2023.3", "affected_versions_last": "2023.3" }, { "criteria": "cpe:2.3:a:ivanti:neurons_for_itsm:2023.4:*:*:*:*:*:*:*", "vendor": "ivanti", "product": "neurons_for_itsm", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2023.4", "affected_versions_last": "2023.4" } ], "cwe": [ { "id": 922, "owasptop10_2021": "A01 Broken Access Control", "name": "Insecure Storage of Sensitive Information", "description": "The product stores sensitive information without properly limiting read or write access by unauthorized actors.", "capec_id": null, "scope": [ "Confidentiality", "Integrity" ], "impact": [ "Modify Application Data", "Modify Files or Directories", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Automated Static Analysis" ] }, { "id": 215, "owasptop10_2021": null, "name": "Insertion of Sensitive Information Into Debugging Code", "description": "The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.", "capec_id": null, "scope": [ "Confidentiality" ], "impact": [ "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.01737, "percentile": 0.76716, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [Affected Range Fixed in 19.1.8](/reference/vulnerability/search/examples/enrichment-cpe-version-end-excluding/) - [Last Affected Release 2026.2](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions-last/) - [Affected Range Ending at 2.4.2](/reference/vulnerability/search/examples/enrichment-cpe-version-end-including/) - [One Release Inside the Affected Range](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions/) - [Affected Range Starting After 6.3](/reference/vulnerability/search/examples/enrichment-cpe-version-start-excluding/) - [One Concrete CPE Name](/reference/vulnerability/search/examples/enrichment-cpe-cpe-names-cpe-name/)