Identifying Exploited and Likely-to-Be-Exploited Vulnerabilities

Identifying Exploited and Likely-to-Be-Exploited Vulnerabilities

Speakers: Patrick Garrity (Security Researcher, VulnCheck); Wade Sparks (Vulnerability Analyst, VulnCheck)

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=YGl19THCXmE

Overview

In this insightful VulnCon talk, Patrick Garrity and Wade Sparks from VulnCheck delve into their comprehensive strategies for identifying vulnerabilities that are actively exploited in the wild or are highly likely to be weaponized. The presentation outlines VulnCheck's multifaceted approach as a CVE Numbering Authority (CNA), detailing how their research team leverages various data sources – from honeypot detections and exploit frameworks to product advisories and community intelligence – to proactively assign CVEs and track exploitation. This work is critical in an era where the speed of exploitation is accelerating, driven by factors like AI and readily available exploit modules, making timely identification and disclosure paramount for effective defense.

The speakers emphasize the importance of visibility into exploited vulnerabilities, particularly in light of emerging regulations like the European Cyber Resilience Act (CRA) and established government initiatives such as CISA's Known Exploited Vulnerabilities (KEV) catalog. VulnCheck's mission is to rapidly get this crucial information into the cybersecurity ecosystem, prioritizing vulnerabilities that pose immediate threats due to active exploitation or the existence of weaponized code. Their methodology combines automated analysis with expert human triage, fostering collaboration across the security community to ensure accurate and timely vulnerability identification.

This article dissects VulnCheck's operational framework, providing a detailed look at the examples and processes they employ. It highlights their contributions to the broader vulnerability landscape, not only by assigning CVEs but also by correlating existing ones and advocating for researchers. The talk serves as a call to action for defenders, urging them to prioritize a specific subset of vulnerabilities that represent the most immediate and significant risks to their environments.

Background

▶ Watch: Introduction to VulnCheck's research and services (0:00)

The landscape of cybersecurity is continually challenged by the rapid pace at which new vulnerabilities are discovered and subsequently exploited. A critical aspect of this challenge is the shrinking window between a vulnerability's public disclosure and its active exploitation. Patrick Garrity highlights that, based on 2025 data, approximately 28% of exploited vulnerabilities showed evidence of exploitation on or before their disclosure day. This statistic underscores the urgency for security professionals to gain early visibility into active threats and prioritize their defensive efforts accordingly.

This problem is exacerbated by several factors. Firstly, the sheer volume of new vulnerabilities reported annually makes it impossible for organizations to patch everything immediately. Secondly, the increasing sophistication of threat actors and the commoditization of exploit tools mean that even moderately skilled attackers can leverage vulnerabilities quickly. Wade Sparks further notes the growing concern that advancements in Artificial Intelligence (AI) could further accelerate these timelines, enabling faster vulnerability discovery and exploit development, although the full impact is still being evaluated.

Regulatory and governmental bodies have recognized this imperative. The European Cyber Resilience Act (CRA), for instance, mandates quick reporting and notification of exploited vulnerabilities. Similarly, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) maintains its Known Exploited Vulnerabilities (KEV) catalog (CISA Bot 22-01), requiring federal agencies to patch these specific vulnerabilities within strict deadlines. VulnCheck contributes to this ecosystem by maintaining its own free KEV list, which includes any vulnerability publicly reported as exploited in the wild or detected by their internal research.

The evidence of exploitation itself comes from a diverse array of sources, which can change year to year. These include independent security researchers, product security organizations, threat intelligence teams, cloud providers, vendor advisories, and government agencies like CISA and the FBI, as well as coordinated disclosures from international bodies like the NCSC in the UK. VulnCheck's work involves meticulously tracking and analyzing these varied sources to identify and classify exploited vulnerabilities, providing a crucial service to the wider security community.

Key Findings

▶ Watch: Using Shadow Server to find unassigned CVEs (5:00)

VulnCheck's extensive research over the past year has yielded significant findings regarding the identification and classification of exploited and likely-to-be-exploited vulnerabilities. By meticulously tracking various intelligence sources and leveraging their role as a CVE Numbering Authority (CNA), VulnCheck has made substantial contributions to the public understanding of active threats.

A primary finding is the sheer volume of previously un-CVE'd or un-correlated exploited vulnerabilities. Since approximately June of the previous year, VulnCheck has identified and assigned or correlated 151 CVEs specifically categorized as known exploited vulnerabilities. To put this in perspective, this represents a substantial chunk of the roughly 800 exploited vulnerabilities identified in the previous year's data.

Beyond mere identification, VulnCheck's analysis reveals critical threat intelligence:

• 29 of these identified CVEs are actively targeted by botnets, indicating widespread, opportunistic exploitation.
• 15 of the identified CVEs have been added to the CISA KEV catalog, signifying their critical status and the immediate need for federal agencies (and by extension, all organizations) to address them.
• 4 of the vulnerabilities are directly associated with ransomware campaigns, highlighting their severe impact potential.

The methodologies employed by VulnCheck are themselves a key finding, demonstrating effective strategies for proactive vulnerability management:

1. Shadow Server Analysis: By collaborating with Shadow Server, a non-profit organization that runs honeypots and other detection mechanisms, VulnCheck identified numerous exploited vulnerabilities that lacked CVE identifiers. This led to the assignment or correlation of approximately 50 CVEs that were being actively detected in the wild but were previously uncataloged.
2. Metasploit Module Prioritization: Recognizing that the presence of a Metasploit module significantly increases the likelihood of exploitation, VulnCheck audited the framework. They found hundreds of modules lacking CVEs, with about 200 falling within VulnCheck's CNA scope. This proactive assignment has proven critical, as evidenced by a vulnerability identified through this process later being linked to the Rondo botnet.
3. Product Security Advisory Analysis: VulnCheck systematically reviews product security advisories, particularly those from vendors that disclose exploitation indicators (e.g., Microsoft MSRC). This led to the identification of vulnerabilities like the Notepad++ supply chain compromise, where VulnCheck's "DIBs" process facilitated rapid consensus and CVE assignment.
4. Security Researcher Collaboration: Building strong relationships with independent security researchers, such as those from Project Discovery, allows VulnCheck to quickly triage and assign CVEs for newly disclosed vulnerabilities, often before or immediately upon public disclosure. This agility is crucial given the speed at which researchers operate and the subsequent rapid exploitation.
5. Internal Research and Validation: VulnCheck's own initial access team actively discovers vulnerabilities, develops exploits, and creates detection artifacts. By deploying vulnerable instances on the internet, they validate exploitation and generate high-fidelity threat intelligence, as demonstrated by an instance of "researcher collision" where multiple teams independently found the same critical bug.
6. Community Forum Monitoring: Engaging with online communities and forums, such as Discord groups, provides early alerts for emerging compromises or vulnerabilities, enabling VulnCheck to investigate and assign CVEs for issues like the FreeBSD forums compromise.

These findings collectively underscore VulnCheck's commitment to bridging the gap between vulnerability disclosure and actionable threat intelligence, ensuring that critical exploitation data is rapidly disseminated to defenders.

Technical Deep Dive

▶ Watch: The 'Dibs' process for coordinating critical CVE assignments (14:00)

VulnCheck's methodology for identifying exploited and likely-to-be-exploited vulnerabilities is a multi-pronged technical approach, integrating external intelligence with internal research capabilities. This deep dive explores the specific technical processes and examples discussed in the presentation.

Shadow Server Integration

VulnCheck established a crucial partnership with Shadow Server, a non-profit organization that operates extensive networks of honeypots and detection systems. These systems identify network activity indicative of exploitation attempts based on known exploits or public references (e.g., Exploit-DB entries, CNVD identifiers).

The technical process involves:

1. Data Ingestion: VulnCheck ingests Shadow Server's detection data, which includes observed exploit activity.
2. CVE Correlation: The first step is to check if observed exploitation activity is already tied to an existing CVE. For instances where a public exploit reference (like an Exploit-DB entry) exists but no CVE is assigned, VulnCheck attempts to correlate it with any existing CVEs in the ecosystem.
3. New CVE Assignment: If no CVE exists, and the vulnerability is confirmed to be exploited, VulnCheck, acting as a CNA, assigns a new CVE.

An illustrative example was a D-Link DSL modem vulnerability. Shadow Server had been detecting exploitation of this vulnerability since February 2025 (using the talk's generic year for examples), despite the underlying issue being public since 2016. It was an unidentified vulnerability without a CVE. VulnCheck assigned a CVE (e.g., CVE-2025-XXXX), bringing it into the catalog. This particular case also highlighted the issue of End-of-Life (EOL) technology, which often lacks patches but remains in use, becoming a persistent target for exploitation.

Metasploit Module Prioritization

The presence of a Metasploit module is a strong indicator of a vulnerability's exploitability and its potential for widespread use by casual attackers. Patrick Garrity referenced "HTML's law" (Joshua Corman), which posits that casual attacker power grows at the speed of Metasploit. VulnCheck extends this to include the impact of AI.

The technical workflow for Metasploit modules is:

1. Module Audit: VulnCheck systematically audits the Metasploit framework, which includes a vast collection of exploit modules published over many years.
2. CVE Gap Analysis: The primary goal is to identify Metasploit modules that do not have a correlated CVE identifier. Wade Sparks reported finding hundreds of such modules, with approximately 200 falling within VulnCheck's CNA scope.
3. Coordination and Assignment: For modules without existing CVEs, VulnCheck first attempts to correlate them with any obscure existing CVEs. If none are found, and the module is tied to a public reference, VulnCheck assigns a new CVE.

A recent success story involves a vulnerability identified through this Metasploit audit. Weeks after VulnCheck assigned its CVE, Bitsight published research in March 2026, confirming its active exploitation by the Rondo botnet, validating VulnCheck's proactive prioritization strategy.

Product Security Advisories and "DIBs" Process

Product security advisories from vendors are a direct source of information, though not all vendors consistently disclose exploitation status.

1. Exploitation Indicator Monitoring: VulnCheck focuses on advisories that explicitly include exploit indicators, such as Microsoft MSRC's machine-readable format, which provides clear signals of active exploitation.
2. "DIBs" Process: For critical or highly visible vulnerabilities, especially those with suspected exploitation, VulnCheck participates in or initiates a "DIBs" process (an acronym for a process within the research working group aimed at reducing duplicate CVE assignments). This involves rapid coordination with other CNAs and bug bounty programs to achieve consensus on who will assign a CVE, preventing duplication.

An example involved a Notepad++ supply chain compromise. After Notepad++ patched the underlying vulnerability in 2025 and notified customers of exploitation in February 2026, VulnCheck utilized the DIBs process to assign a CVE (e.g., CVE-2026-XXXX). This CVE was subsequently added to the CISA KEV, underscoring its critical nature.

Security Researcher Collaboration

VulnCheck actively builds relationships with security researchers and groups to streamline the vulnerability disclosure process.

1. Direct Reporting: Researchers are encouraged to report findings directly to VulnCheck's "report of vulnerability" service, which offers a low barrier to entry without strict formatting requirements.
2. Rapid Triage and Assignment: Upon receiving a report, VulnCheck's team quickly triages the vulnerability, confirms coordination with the vendor (ensuring a patch is available or planned), and then assigns a CVE, often within hours.

A case in point was an authentication bypass in a VersaConnect actuator endpoint. A researcher from Project Discovery contacted VulnCheck after discovering the vulnerability and confirming a patch. VulnCheck assigned the CVE that same evening. Subsequently, exploitation was reported by multiple threat intelligence entities including CrowdSec, Cyble, and Shadow Server, leading to its inclusion in the CISA KEV.

Internal Research and Validation

VulnCheck's internal Initial Access Team conducts dedicated vulnerability research, generating high-fidelity exploitation intelligence.

1. Vulnerability Discovery & Exploit Development: The team actively discovers new vulnerabilities and develops proof-of-concept exploits.
2. Detection Rule Creation: Concurrently, they build robust detection rules based on these exploits.
3. Canary Deployment: To confirm exploitation in the wild, VulnCheck spins up real, vulnerable hosts or containers and places them on the internet as "canaries."
4. Exploitation Confirmation: They monitor for TAC (Threat Actor Command and Control) traffic, confirming active exploitation against their deployed vulnerable systems.

A notable example involved a critical vulnerability discovered by VulnCheck's Kale. Interestingly, this was a "researcher collision" event, where WatchTower and Code White, along with potentially other researchers, independently discovered and reported the same vulnerability to the vendor around the same time. VulnCheck's ability to assign the CVE ensured all credited researchers received proper acknowledgment, and the vulnerability was rapidly moved through the detection pipeline, leading to canary detection and CISA KEV inclusion.

Community Forum Monitoring

Community forums and online groups serve as early warning systems for emerging threats.

1. Proactive Engagement: VulnCheck team members, like Patrick Garrity (who served as a Discord mod), actively monitor relevant community channels.
2. Investigation and Coordination: When a compromise or vulnerability is reported (e.g., Jerico's post about the FreeBSD forums being compromised), VulnCheck investigates. This often requires coordination with multiple parties, such as XenForo (the forum software vendor) and FreeBSD, to identify the specific exploited vulnerability (e.g., an RCE vulnerability).

This deep integration into various technical and community channels allows VulnCheck to maintain a comprehensive and agile approach to identifying and cataloging exploited vulnerabilities, providing critical intelligence to the broader security community.

Demo / Proof of Concept

▶ Watch: Internal research and managing researcher collision (19:00)

While the talk did not feature a live, interactive demo, the speakers provided numerous real-world examples that serve as proofs of concept for their methods and the effectiveness of their vulnerability identification processes. Each case study presented demonstrated how VulnCheck's approach successfully identified an exploited or highly exploitable vulnerability and ensured its proper cataloging within the CVE system.

For instance, the discussion around Shadow Server detections and the D-Link DSL modem vulnerability acts as a proof of concept for identifying long-standing, un-CVE'd exploited vulnerabilities. Similarly, the Metasploit module audit, which led to the identification of hundreds of un-CVE'd modules and subsequently linked a prioritized CVE to the Rondo botnet, is a powerful demonstration of how prioritizing exploit frameworks yields actionable intelligence.

Perhaps the most direct "proof of concept" of VulnCheck's internal capabilities comes from their Initial Access Team. This team's process of spinning up vulnerable containers, developing detection rules, and deploying "canaries" on the internet to confirm TAC traffic and exploitation directly demonstrates their ability to validate and generate high-fidelity exploitation evidence. This internal validation mechanism, as highlighted in the "researcher collision" example, underpins the credibility of their findings and their ability to quickly move vulnerabilities into critical lists like the CISA KEV.

In essence, the entire presentation is structured as a series of successful case studies, each illustrating a different facet of VulnCheck's robust and proactive approach to tracking and identifying the most dangerous vulnerabilities.

Defensive Implications

▶ Watch: Q&A: Analyzing AI's impact on exploitation (27:00)

The insights shared by Patrick Garrity and Wade Sparks offer critical guidance for defenders grappling with the relentless pace of cyber threats. Their research underscores the need for a highly prioritized and proactive defense strategy, moving beyond simply patching everything to focusing on what truly matters.

1. Prioritize Known Exploited Vulnerabilities (KEVs): The most direct implication is to rigorously prioritize patching and mitigating vulnerabilities on the CISA KEV catalog and similar lists, including VulnCheck's own free KEV. These are not theoretical risks; they are actively being used by threat actors right now. Organizations should integrate these lists into their vulnerability management programs, ensuring that EOL devices associated with KEVs are either immediately decommissioned or isolated if removal is not feasible, as seen with the D-Link DSL modem example.

1. Monitor Exploit Frameworks and POCs: Defenders should consider any vulnerability with a publicly available Metasploit module or robust Proof of Concept (POC) code as highly likely to be exploited. The ease with which casual attackers can leverage these tools significantly shortens the time to exploitation. Security teams should scan their environments for systems vulnerable to Metasploit modules and prioritize these patches, even if they aren't yet on a KEV list. This proactive stance aligns with "HTML's law" and the evolving threat landscape.

1. Leverage Machine-Readable Advisories: Organizations should seek out and integrate vendor advisories that provide machine-readable exploit indicators, such as those from Microsoft MSRC. Automating the ingestion and analysis of this data can significantly speed up the identification of exploited vulnerabilities relevant to their specific asset base, allowing for quicker response times.

1. Embrace Community and Researcher Intelligence: Building relationships with security researchers and monitoring active community forums (like Discord channels) can provide early warnings of emerging threats or compromises, as demonstrated by the FreeBSD forums incident. These informal channels often surface intelligence before it's formally published, offering a critical head start for defenders.

1. Understand the Impact of AI: While the full impact of AI on exploitation timelines is still developing, defenders should anticipate an acceleration in vulnerability discovery and exploit development. This means traditional patch cycles may become increasingly insufficient. Organizations should invest in more agile vulnerability management processes, advanced threat intelligence, and potentially AI-driven detection capabilities to keep pace.

1. Focus on Detection and Response: Beyond patching, organizations must strengthen their detection and response capabilities. VulnCheck's internal research, which includes building detection rules alongside exploits, highlights the importance of having robust monitoring in place to identify active exploitation attempts, especially for zero-day or N-day vulnerabilities that may not yet have patches.

1. Advocate for Proper CVE Assignment and Credit: For organizations engaging with researchers or contributing to vulnerability disclosure, advocating for clear and timely CVE assignment, along with proper researcher credit, fosters a healthier ecosystem. This transparency helps ensure that all relevant information about a vulnerability is available to defenders.

By adopting these defensive implications, organizations can move from a reactive posture to a more proactive and intelligence-driven approach, focusing their limited resources on the threats that pose the most immediate and significant risk.

Key Takeaways

• Prioritize Exploited Vulnerabilities: Actively exploited vulnerabilities, particularly those on CISA KEV and VulnCheck's free KEV, represent the most immediate threats and must be prioritized for patching and mitigation above all others.
• Metasploit Modules Signal Imminent Exploitation: The existence of a Metasploit module or robust POC code for a vulnerability significantly increases its likelihood of being exploited by a wider range of threat actors; these should be treated with high urgency.
• Vulnerability Disclosure Timelines are Shrinking: With 28% of exploited vulnerabilities having evidence of exploitation on or before disclosure, rapid ingestion of threat intelligence and agile response mechanisms are crucial.
• Diverse Intelligence Sources are Essential: Effective identification of exploited vulnerabilities requires monitoring a wide array of sources, including honeypot detections (Shadow Server), product advisories (Microsoft MSRC), security researcher collaborations, and community forums.
• AI Will Accelerate the Threat Landscape: While the full extent is still emerging, AI is expected to accelerate exploit development and vulnerability discovery, necessitating more adaptive and intelligence-driven defensive strategies.
• End-of-Life (EOL) Technology Poses Persistent Risk: Vulnerabilities in EOL products continue to be exploited due to lack of patches and prolonged use, highlighting the importance of inventorying and decommissioning such assets.

About the Speaker(s)

Patrick Garrity is a Security Researcher at VulnCheck, bringing years of experience from various cybersecurity companies. He works closely with Wade Sparks and plays a key role in VulnCheck's vulnerability research efforts, particularly in tracking and identifying exploited vulnerabilities. His work involves analyzing diverse sources of exploitation evidence and driving the team's strategies for proactive CVE assignment.

Wade Sparks serves as a Vulnerability Analyst on Patrick Garrity's team at VulnCheck. He is responsible for managing VulnCheck's "report of vulnerability" service, a free community service that enables external researchers to submit their findings for CVE assignment and coordination. Wade also conducts Coordinated Vulnerability Disclosure (CVD) work. Prior to joining VulnCheck, he worked at CISA on their Known Exploited Vulnerabilities (KEV) catalog, bringing valuable expertise in identifying and prioritizing critical threats.