Our Own Ledger Says We Missed Eight of Eleven. Here Are the Eight — Including Two Red Hat Bugs From 2015 That Somebody Successfully Attacked This Month.
- Patrick Duggan
- 1 hour ago
- 6 min read
We keep a ledger that scores our own timeliness against CISA. It works like this: every time CISA adds a vulnerability to the Known Exploited Vulnerabilities catalog, the ledger goes looking through everything we have ever published, plus every indicator our exploit harvester has ever collected, for a dated artifact that names that CVE before CISA listed it. If it finds one, the gap between our timestamp and CISA's is the lead. If it finds nothing, the entry is marked no receipt.
For the week ending August 30, the ledger read eleven additions, three receipts, eight blanks.
That is a 27 percent hit rate, and we are publishing it because a number you only quote when it flatters you is not a measurement, it is an advertisement.
The three we caught
The receipts held up when we checked them, which is not something to assume.
[CVE-2026-21962](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-21962), the Oracle HTTP Server WebLogic Proxy Plug-in flaw, CISA-listed August 26. We named it on April 2, in a post about Iran designating eighteen American companies as military targets, in a sentence that reads: Oracle WebLogic Server has an active CVSS 10.0 vulnerability being mass-exploited since January. That is a 143-day lead, and it is real — not a passing mention but part of the argument, which was that the people who would patch it had just been laid off to fund a data center.
[CVE-2026-60004](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-60004), the Gitea git-hook injection, CISA-listed August 25. We published on July 31 that the login wall was not a wall, because Gitea ships with open registration on and the bug only requires an account. Twenty-six days.
[CVE-2026-8452](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-8452), the Citrix NetScaler pre-authentication remote code execution, CISA-listed August 26. Our harvester caught the watchTowr proof-of-concept eleven days earlier.
Two of those three came from machines, not from us. The harvester watches public repositories for exploit code appearing against known CVEs and does not need anyone to be awake. That is worth being honest about too.
The eight we did not
Here they are, with what CISA says about them and when the federal patch deadline falls.
[CVE-2015-3246](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2015-3246) — Red Hat libuser, race condition. Added August 26, due September 9.
[CVE-2015-5287](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2015-5287) — Red Hat Automatic Bug Reporting Tool, privilege escalation. Added August 26, due September 9.
Those two are eleven years old. Both were patched in 2015. Somebody successfully attacked them in 2026, which is the only criterion CISA uses for inclusion.
[CVE-2019-1068](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2019-1068) — Microsoft SQL Server, remote code execution. Added August 26, due August 29. A three-day deadline, which is CISA's way of saying this one is on fire.
[CVE-2021-23758](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2021-23758) — Ajax.NET Professional. Added August 26, due September 9.
[CVE-2022-0995](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2022-0995) — Linux kernel, out-of-bounds memory write. Added August 26, due September 9.
[CVE-2023-49105](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2023-49105) — ownCloud. Added August 27, due August 30. Another three-day deadline.
[CVE-2026-53362](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-53362) — Linux kernel. Added August 27, due August 30.
[CVE-2026-66384](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-66384) — JFrog Artifactory. Added August 27, due September 10.
The shape, which is the actual story
Look at what is in that batch and what is not.
There is one perimeter appliance in the whole set, and it is the one we caught. The rest are local privilege escalation, an application framework nobody has thought about since the Obama administration, a database engine, a file-sync server, and an artifact repository. Two Linux kernel entries. Two Red Hat local-privesc entries from 2015.
This is not the shape of a zero-day week. It is the shape of attackers being efficient. Every one of these bugs is patched. Every one has been patched for years. The exploitation is not happening because the code is broken — it is happening because the code is broken on your hosts, and it has been for a decade, and somebody finally found it worth their time to walk through a door that has been unlocked since 2015.
Local privilege escalation is where this lives, and we have been saying so all year. In May we wrote up Copy Fail, CVE-2026-31431, a 732-byte Python path from any unprivileged user to root through the kernel's AF_ALG crypto socket, present in shipped kernels since 2017. In June, CVE-2026-46331, which rewrites /bin/su in the page cache and hands you root — the second universal Linux LPE of the quarter. In July, GhostLock, CVE-2026-43499, root in about five seconds from ordinary threading calls, and the third fifteen-year-old Linux kernel bug in a single week.
We filed the first two of those before the field caught up. We did not catch these eight. Both of those things are true and they are the same beat.
The eight are old. The three are new. That is not a coincidence.
Sort the eleven by age and the ledger separates itself cleanly.
Every vulnerability we had a receipt for was assigned in 2026. Every vulnerability older than three years was a blank. There is no overlap and no ambiguity in the middle.
That is a description of our instrument, not of the threat. Our exploit harvester watches public repositories for proof-of-concept code appearing against known CVEs — it fires on new activity. A privilege escalation from 2015 whose exploit has sat in the same repository since 2015 produces no new activity, so it produces no signal. We are tuned for novelty and structurally blind to vulnerability debt.
Which is a problem, because vulnerability debt is what half of this batch was.
Why the miss happened, which is not what you would guess
The instinct is to say we missed these because we did not detect them. That is not what happened.
A lead in our ledger requires a published, dated artifact that names the CVE. Not a hunch, not a note, not a conversation — a written thing with a timestamp on it. Our harvester had material. Our corpus covers this exact class of bug three times over. What did not exist was the sentence naming CVE-2022-0995 on a page with a date attached.
The written word is the correlation event. Without it there is nothing to hold against CISA's timestamp, and the lead does not exist — not unpublicized, not unrecognized. It does not exist. Eight blanks in a ledger is not eight things we failed to see. It is eight things we failed to write down.
That distinction matters because the two problems have completely different fixes, and only one of them is hard.
What to actually do
If you run Red Hat Enterprise Linux or a derivative and you have hosts that have not had a full package update since the last time you were told to, libuser and ABRT are sitting on them. These are not exotic components. ABRT is the crash reporter. libuser is account management. They are on the box because somebody installed the default group.
If you run SQL Server 2019-era builds, CVE-2019-1068 had a three-day federal deadline that has already passed. Treat that urgency as information regardless of whether you are federal.
If you run ownCloud, Artifactory, or anything still carrying Ajax.NET Professional, patch on the published schedule and then go find out why a 2021 component was still in a build in 2026.
And if you have a scanner that reports these as low priority because of their age, the scanner is wrong and CISA just said so in writing. Age is not risk. Reachability is risk. An eleven-year-old privilege escalation on a host an attacker already has a shell on is worth exactly as much to them as a fresh one, and it costs them nothing because the exploit was published a decade ago and has been sitting in the same repository ever since.
The number we are keeping
Three of eleven. Mean lead 60 days on the three we caught, median 26, best 143.
We would rather publish 27 percent with the denominator attached than a bigger number with the denominator missing. The eight blanks are now eight entries in the corpus, which means the next time any of these CVEs comes up in a search, in an audit, or in somebody's compliance question, there is a page with a date on it.
That does not turn them into leads. Nothing written today is early on something listed last week, and we are not going to pretend otherwise. It closes a coverage gap honestly, which is a smaller and more useful thing.
The ledger runs again next week.
Was this useful? Rate this post — the widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=our-own-ledger-says-we-missed-eight-of-eleven-here-are-the-eight-including-two-red-hat-bugs-from
Comments