pattern·published·24 exhibits

Disclosure After Exploitation

Vendor discloses only after active in-wild exploitation. The gap between first-seen and CVE is the story.

The normal disclosure pipeline reads left to right. A researcher finds a bug. The researcher tells the vendor. The vendor patches. A CVE is issued. Defenders patch. Some time later, exploitation begins in the wild.

Disclosure-after-exploitation runs the pipeline in reverse. Attackers find the bug. Attackers use the bug. Incident responders notice a pattern in the breach data. The pattern gets traced back to a specific component. The vendor learns about it from the incident report, or from a customer call, or from a tweet. The CVE, when it finally arrives, is documentation of a thing that has already happened to people.

By the time the public sees the advisory, the defenders are the last to know.

Mechanism

The CVE system was designed for a world where vulnerabilities are found by research and managed through coordinated disclosure. That world still exists, but it shares the landscape with a different one: an attacker economy that discovers its own primitives, uses them for months, and only leaks them when incident-response firms begin recognizing the shape of the intrusions. The second world does not produce CVEs until the first world catches up.

The mechanics of this inversion are unglamorous. A well-resourced attacker finds a vulnerability, usually in an enterprise product with a heavy on-premises footprint (edge devices, managed file transfer, VPN appliances, identity software). They exploit it at a cadence that does not trigger noise: two or three targets at a time, not ten thousand. The targets who notice (if any notice at all) file incidents, and the incident responders deal with one-off intrusions for a while. Eventually someone at a response firm sees two cases with the same entry point and writes the vendor. The vendor, depending on internal urgency and legal posture, starts the clock. Patch. CVE. Advisory.

The defender-visible timeline starts only at the last step. The customers who took the hit during the in-wild window are already in remediation. The customers who did not take the hit are one incident away from finding out that their lucky streak ended last Tuesday. The CVE is the post-hoc label, not the early warning.

Exhibits

CVE-2026-0300: seven PoCs, four defenders, two placeholders, one missing patch. CVE-2026-0300 is the genre at its most naked: the public learned of it because CISA added it to the KEV catalog with a 2026-05-09 federal patch deadline — and Palo Alto Networks' fix does not ship until 2026-05-13. The advisory came after the exploitation, the deadline came before the patch, and the only people who can write a working exploit (the vendor; the in-the-wild operator) are the only people staying quiet. The seven public PoCs — four defensive, two placeholder stubs — are what the ecosystem produces to fill a silence that disclosure-after-exploitation always leaves behind.

CVE-2026-54420: LiteSpeed cPanel's `generateEcCert` Raced With `packageUserSize`. Namecheap Reported From Production.. CVE-2026-54420 is the pattern with the discovery channel sitting between the affected vendor and the impacted users. LiteSpeed did not find the symlink-following race; Namecheap did, because Namecheap's customers are who the bug runs against on a CloudLinux/CageFS shared-hosting box. The report on May 31 closes the same month the NVD record names as the in-wild exploitation window. The vendor patched on June 1, the day after the report; MITRE assigned the CVE on June 14, two weeks later; CISA listed it on KEV on June 15 with a June 18 federal deadline. The exhibit's contribution to the pattern is the disclosure-compression beat: the window between "the CVE exists publicly" and "every BOD 26-04 organization has to be patched" is shorter than the window between "the patch existed" and "the CVE existed." The defender visibility window is the document trail, not the actual exploitation window. Sibling timeline with FortiManager (Mandiant's IR was the channel) and BeyondTrust (Treasury was the channel); here the channel is the hosting provider whose abuse team had the cross-tenant view.

CVE-2025-54309: The AS2 Receiver Authenticated the Admin. CVE-2025-54309 is the disclosure-after-exploitation pattern with the audit trail in the URL. CrushFTP filed the documenting wiki page at Wiki.jsp?page=CompromiseJuly2025 on July 18, 2025, because they had traced customer compromises before the bug had a name. MITRE assigned the CVE four days later. CISA added it to KEV the same week. The first public PoC arrived thirty-six days after that, by watchTowr Labs, who openly described the writeup as "the one where we just steal the vulnerabilities" because they captured the technique from attacker traffic in their Attacker Eye honeypot, replayed it, and confirmed it worked. Neither the vendor nor the security firm was first; both backfilled into a chain that began on production systems with no bound visible from outside. This is the second consecutive CrushFTP exhibit on this pattern, three months after CVE-2025-31161 (the silent-patch instance) hit the same endpoint by a different protocol seam.

CVE-2010-0249: The KEV Deadline for Aurora Is a Census. CVE-2010-0249 is the pattern's founding case at two layers. In late 2009 a state-aligned operator used the bug against Google, Adobe, Juniper Networks, and at least twenty other named companies before any vendor saw it; Google's January 12, 2010 breach disclosure preceded Microsoft Security Advisory 979352 by two days and the emergency MS10-002 patch by nine. The CVE was post-hoc documentation of a thing that had already happened, which is the pattern in its naked form. Sixteen years later, the disclosure tail extends: CISA adds the same CVE to KEV on May 20, 2026, with a June 3 federal deadline, against a product Microsoft retired in 2022. The bug was disclosed by breach in 2010. The footprint of the product the bug lives in is being disclosed by federal mandate in 2026. The pattern compounds at the regulatory layer, the deadline functioning as an inventory event rather than a patch directive.

CrushFTP CVE-2025-31161: MFT Is the Target Now. Pre-auth vulnerabilities in managed file transfer products are a recurring attack vector because MFT sits directly on the public internet with credentials for everyone's file share. The CrushFTP CVE was known in the wild before it was known in public. The advisory went out after several incident response firms were already seeing the same entry point across unrelated customers. The window between first observed exploitation and public disclosure was measured in weeks, not hours.

CVE-2026-22679: Weaver E-cology's Endpoint Was Named `debug`. The Patch Is a Deletion.. CVE-2026-22679 fits the pattern at the build cadence. Build 20260312 ships 2026-03-12 with a security-update label on Weaver's download page and no CVE association. The Shadowserver Foundation observes mass exploitation 2026-03-31, nineteen days after the silent patch. NVD publishes the CVE on 2026-04-07, twenty-six days after patch availability, citing Shadowserver's date as the first observation. The customer-visible signal in the gap was a single changelog entry; the attacker-visible signal was the build diff. The kit Vega documents in the wild names its MSI dropper fanwei0324.msi, dated March 24, six days before Shadowserver's first observation, six days after Weaver published the patch. The kit was assembled from the patch.

CVE-2025-22457: Ivanti's End-of-Life Branch Was UNC5221's Lab. CVE-2025-22457 is disclosure-after-exploitation with the disclosure baked into a binary diff. Ivanti shipped 22.7R2.6 on February 11, 2025, with an advisory rating the bug as a low-risk DoS because the input was constrained to digits and dots. By mid-March, UNC5221 was inside customers running both 22.7R2.5 and end-of-life ICS 9.X. Mandiant publishes April 3, the same day Ivanti updates the rating to CVSS 9.0; CISA adds to KEV April 4. The customer fleet's first signal that the February patch was actually critical was the breach record the responders were piecing together in March. The disclosure ordering ran in reverse: patch, exploit, breach, advisory. Same operator as the Vulnerability Subscription editorial, three months later, on the next bug in the same process.

CVE-2026-32202: The Trust Check Runs at the Click. The Coercion Runs at the Icon.. CVE-2026-32202 was added to CISA KEV with a federal patch deadline of May 12, 2026. The bug was disclosed because Akamai found the bypass in the April patch for CVE-2026-21510, the APT28 zero-day Microsoft had attempted to address. There is no Microsoft fix for the bypass on the KEV deadline. Federal agencies are operating on workarounds (firewall outbound SMB, restrict NTLM destinations, require SMB signing) until a corrected shell32 ships. The disclosure timeline is two CVEs deep with the same operator running on the same primitive and a vendor that has not caught up to the design.

CVE-2024-12356: Treasury Was the Proof of Concept. CVE-2024-12356 is the pattern with public attribution. BeyondTrust observed anomalous activity in their Remote Support SaaS on December 2, 2024, isolated compromised tenants by December 5, notified Treasury on December 8, and published BT24-10 with the cloud-side patch on December 16. CISA added the CVE to KEV three days later. Treasury publicly disclosed the breach on December 30. The first public detection content arrived as a nuclei template on February 21, 2025, sixty-seven days after the advisory and eighty-one days after BeyondTrust's IR began. The defender's first signal was the cloud vendor's incident notification, not the advisory; the advisory was the cloud vendor catching the rest of the world up.

CVE-2024-21182: WebLogic Denied `ForeignOpaqueReference`. `AggregatableOpaqueReference` Reaches The Same JNDI Lookup.. k4it0k1d's PoC has been on GitHub since December 2024 — the month after Oracle's October 2024 CPU shipped the fix. CISA added CVE-2024-21182 to KEV on June 1, 2026, with a 3-day federal remediation deadline. That's roughly 18 months between a fully-weaponized public PoC and the regulatory shove, and the KEV listing is the artifact that "exploitation has been observed" produces — not the artifact that "exploitation is possible" produces. The PoC was the leading indicator the entire time.

CVE-2025-57819: FreePBX's Ajax Dispatcher Asked PHP If The Class Existed. PHP Loaded The File.. The timeline reads in three beats: in-wild exploitation surfaced Aug 21, the endpoint-module sink fix shipped Aug 28, and the framework-level dispatcher regex landed Sep 11 as defense-in-depth. The Sep 11 patch is the admission that the August fix only closed one sink while leaving the include primitive reachable through any other module that takes user input into SQL. Two weeks of "patched" customers were still one bug-class away from the same execution path — the framework regex is what closes the class, and it shipped after the advisory said the class was closed.

CVE-2026-28318: SolarWinds Patched The Path To The Decoder, Not The Decoder. CVE-2026-28318 was published 2026-06-04 and landed on CISA KEV 2026-06-05 with a federal patch deadline of 2026-06-19. The CVE record is a fourteen-day inventory event for a bug that, by KEV's inclusion criterion, was already being used at scale. CISA does not add unauthenticated denial-of-service bugs to KEV on severity alone; the inclusion is documentation that the bug was running against MFT services whose availability is the asset. The disclosure ordering is the pattern: attackers used the deflate-decoder crash on Serv-U before SolarWinds disclosed, and the federal deadline catches the customer fleet up to a thing that has been running.

CVE-2024-47575: FortiManager's get auth Command Does Not Authenticate. Mandiant traced in-wild exploitation of the FortiJump chain to no later than June 2024. Fortinet's advisory FG-IR-24-423 published on October 23, 2024. Four months of unauthorized device registrations against FortiManagers around the world, under serial numbers the advisory eventually listed as indicators of compromise. The CVE was the vendor catching up to a breach record, not the research community's early warning. The advisory credits Mandiant for threat intelligence findings after the fact; it credits no one for finding the bug before it was in use, because nobody did. The bug was found by being used.

Ivanti: The Vulnerability Subscription. Ivanti produces a steady stream of edge-appliance vulnerabilities, many of them first visible through active exploitation rather than responsible disclosure. The pattern is recurring enough that the post title treats it as a subscription: Ivanti customers are paying for a recurring delivery of in-wild CVEs. The advisories arrive after nation-state crews have already moved through the fleet.

CVE-2026-35273: PeopleSoft's Environment Hub Deserializes Anyone Because It Was Built to Deserialize Its Agents. The CVE exists because the intrusions did. Google Threat Intelligence (tracking UNC6240 / ShinyHunters) confirmed exploitation between May 27 and June 9, 2026; Oracle's out-of-band Security Alert landed June 10, and CISA set a June 15 KEV deadline. Two weeks of higher-education breaches (68% of 100+ notified organizations) preceded the advisory. The gap is compounded by the second-stage XMLDecoder sink firing on the next web-tier restart rather than on the inbound request, which left no spawned child process and no required beacon, so the campaign ran quietly until Mandiant's telemetry, not Oracle's, surfaced it.

xrpl.js: The Official Package Was the Threat. The xrpl.js maintainer-account compromise was in the wild (harvesting credentials) before it was understood as a compromise. The community noticed the malicious publish; the takedown came hours later; the formal disclosure came after. Every install that pulled the package during the in-wild window was already a victim by the time the rest of the ecosystem heard about it.

CVE-2026-88771: NetScaler's Audit Log Is the Shell. The Logger Runs as Root.. The CVE was patched 2026-08-26. In-wild exploitation with Sliver C2 (176.94.85.67:80), backdoor local accounts (gw_health), and OOB callbacks to *.ctrxsrv.com, *.dnshook.site, and *.oast.fun was observed before the CISA KEV deadline of 2026-09-30. Public PoCs from watchTowr and craigsblackie followed within days of the patch landing. The KEV catalog documented an exploitation window that was already open when the vendor advisory went out.

Boundaries

Not every CVE with in-wild exploitation is disclosure-after-exploitation. A CVE issued responsibly, patched, and then exploited after patch release is the normal pipeline. In-wild-ness alone is not the pattern; the ORDERING is. Exploitation precedes disclosure in this pattern, and the defender's first signal is a breach, not an advisory.

Not every zero-day is disclosure-after-exploitation. A zero-day that researchers find and report, but the vendor delays patching, may end up exploited during the delay. That is slow-disclosure, a governance problem on the vendor side. Disclosure-after-exploitation assumes the RESEARCHERS were not first at all. The initial discovery happened in the attacker's workbench, not anyone's responsible channel.

Not every embarrassing vendor timeline. Vendors sometimes sit on advisories for business reasons (legal review, PR coordination, patch readiness). A long vendor-side queue is not disclosure-after-exploitation by itself. The pattern requires that the initial discovery and weaponization lived entirely outside the researcher-vendor conversation.

Defender playbook

Track in-wild before you track CVEs. Threat intel feeds that name specific products under active targeting often move days or weeks before the corresponding CVE publishes. For products in your stack that have a history of disclosure-after-exploitation (edge appliances, MFT, identity software), treat in-wild signals as patch-triggering events and figure out the specific CVE later.

Assume a disclosure-after-exploitation product is currently exploited somewhere. If the product has a history of the pattern, the CURRENT state is not "no known CVEs." The current state is "no public CVEs yet for this quarter's attack campaign." Configure incident response and monitoring accordingly.

Segment products that fit the pattern. Disclosure-after-exploitation products tend to be the ones with deep network access (identity brokers, MFT, VPNs, remote management). Segmentation reduces the blast radius when the inevitable advisory arrives. Treat their network privilege as provisional, not architectural.

Watch your revocation gaps on products that fit the pattern. The exploitation window is longer than the disclosure window. Credentials and access earned during in-wild use are still valid when the patch lands. Patching alone does not close the window.

When you see multiple unrelated orgs with the same entry point, say so publicly. The feedback loop that turns attacker-found-bugs into public CVEs depends on defenders comparing notes. Silence serves the vendor's comms timeline, not the ecosystem's security posture.

Kinship

Revocation Gap. Disclosure-after-exploitation is a specific case of revocation gap at the VENDOR level. The gap between first-seen and CVE is the vendor's revocation gap. Credentials and access harvested during that gap have their own revocation gaps at the customer level. The pattern is nested, which is why incidents compound.

Design Debt Driver. Products that keep showing up in the disclosure-after-exploitation pattern usually have design-debt in the substrate. Attackers return to the same products because the same products keep producing the same class of primitives. The two patterns reinforce each other: design debt produces the bugs; attacker-first discovery means customers learn about them the hard way.

Trust Inversion. Disclosure-after-exploitation is often how trust-inversion incidents first become visible. A compromised authorizer is not disclosed through research. It is disclosed through the downstream who notices that something authenticated is doing things it should not.

The CVE is documentation of the breach. The breach is not documentation of the CVE.