-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

NEFARIOUSPLAN-CANONICAL-V1
{"body_md":"## What the scanner summed to a 9\n\nThe vulnerability-intelligence pipeline that triggered this writer scored CVE-2026-76501 at 9, with the following `reasons`:\n\n```\ninfosec.exchange:@Blackpoint_APG+2\nCVSS9.8+2\nAV:N+1\nPR:N+1\nmulti-poc×2+1\nnvd-recent+1\n```\n\n`CVSS9.8+2`, `AV:N+1`, `PR:N+1`, and `nvd-recent+1` are enrichments of the NVD vector, applied automatically when the CVE's metrics parse. The remaining three points come from two URL-bearing bonuses. `infosec.exchange:@Blackpoint_APG+2` flags the posting handle against a pipeline-maintained allowlist of infosec-adjacent Mastodon accounts that have previously surfaced early PoC links. `multi-poc×2+1` counts the length of `poc_urls` and applies a flat +1 bonus when that length is two or more.\n\nThe `poc_urls` array on the candidate, verbatim:\n\n```json\n[\n  \"https://infosec.exchange/@Blackpoint_APG/117406681430178266\",\n  \"https://infosec.exchange/@Blackpoint_APG/117406681039347488\"\n]\n```\n\nTwo URLs. Same instance. Same account. The pipeline summed both signals against the same pair of URLs, lifted the candidate's score above the breaking-publication threshold, and dispatched the writer webhook.\n\n## Both URLs resolve to one account's thread\n\nThe Mastodon API returns the following on each status:\n\n```json\n// GET /api/v1/statuses/117406681039347488\n{\n  \"id\": \"117406681039347488\",\n  \"created_at\": \"2026-10-08T18:23:00.510Z\",\n  \"in_reply_to_id\": null,\n  \"in_reply_to_account_id\": null,\n  \"account\": {\n    \"id\": \"114597179173656454\",\n    \"username\": \"Blackpoint_APG\",\n    \"display_name\": \"Adversary Pursuit Group\",\n    \"followers_count\": 3,\n    \"following_count\": 2,\n    \"statuses_count\": 248\n  },\n  \"replies_count\": 1,\n  \"reblogs_count\": 0,\n  \"favourites_count\": 0\n}\n```\n\n```json\n// GET /api/v1/statuses/117406681430178266\n{\n  \"id\": \"117406681430178266\",\n  \"created_at\": \"2026-10-08T18:23:06.472Z\",\n  \"in_reply_to_id\": \"117406681039347488\",\n  \"in_reply_to_account_id\": \"114597179173656454\",\n  \"account\": {\n    \"id\": \"114597179173656454\",\n    \"username\": \"Blackpoint_APG\"\n  },\n  \"replies_count\": 1,\n  \"reblogs_count\": 0,\n  \"favourites_count\": 0\n}\n```\n\nThe two statuses share `account.id = 114597179173656454`. The second status's `in_reply_to_id` points at the first. Its `in_reply_to_account_id` is the same account. The time delta between the two `created_at` timestamps is 5.962 seconds. The second status was posted as a reply to the first by the account that wrote the first, inside a six-second window, because the thread's content ran over Mastodon's five-hundred-character envelope and had to continue in a reply.\n\n`@Blackpoint_APG` is the fediverse presence of Blackpoint Cyber's Adversary Pursuit Group, the firm's threat-intelligence team. The account profile's `note` field describes it in those terms: `Blackpoint's Adversary Pursuit Group provides in-depth analysis and heightened awareness of threat intel, developing TTPs, and cyberattack trends.` The account has posted 248 statuses since its creation on 2025-05-30. As of this writing, it carries 3 followers and follows 2 accounts. The engagement on both statuses in the thread: `reblogs_count: 0`, `favourites_count: 0`, `quotes_count: 0`. The sole `replies_count: 1` on the thread root resolves to the self-reply the pipeline indexed as the second `poc_urls` entry. Nobody else reblogged, favorited, quoted, or replied to the thread the pipeline promoted into the breaking-publication slot.\n\n## What the thread actually says\n\nThe thread root, verbatim:\n\n```\n⚠️ Threat Notice: Cisco NX-OS Remote Code Execution Vulnerabilities ⚠️\n\nCisco disclosed five critical vulnerabilities in NX-OS, the operating\nsystem powering Nexus 3000 and 9000 Series switches.\n\nCisco reports no known active exploitation or public announcements for\nany of these vulnerabilities at the time of writing.\n\nSources:\nCisco Advisory (CVE-2026-76471): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j\nCisco Advisory (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU\nCisco Advisory (CVE-2026-76465): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7\n```\n\nThe third sentence of the thread root is `Cisco reports no known active exploitation or public announcements for any of these vulnerabilities at the time of writing`. The Sources block lists three Cisco advisory URLs. No GitHub link. No exploit script. No `curl` invocation. No shell block. No technique name. No researcher handle. The post is a threat notice that restates Cisco's five October 7 critical disclosures and attributes the no-known-exploitation posture to Cisco's own advisories.\n\nThe self-reply, abbreviated to the two bullets that matter:\n\n```\nCVE-2026-76471 | 9.8 Critical | NX-API Remote Code Execution\n→ An unauthenticated attacker can execute arbitrary code with root\n  privileges or cause a denial-of-service condition by sending crafted\n  HTTP requests to the NX-API.\n→ Exploitation requires NX-API to be enabled; NX-API is disabled by\n  default on Nexus 3000 and 9000 Series switches.\n\n[... three more CVE blocks of the same shape ...]\n\nCVE-2026-76501 | 9.8 Critical | NGOAM Remote Code Execution\n→ An unauthenticated attacker can execute arbitrary code with root\n  privileges or cause a denial-of-service condition; exploitation\n  requires both NGOAM and SRv6, limiting scope to applicable Nexus\n  9000 Series models.\n```\n\nFive CVE blocks. Three to five short bullet lines each. The content mirrors the Exploit Details sections in Cisco's advisories. No GitHub URL. No ExploitDB entry. No researcher handle. No `#!/usr/bin/env python`. The second status is the first status's bullet-point tail, written as a reply because the threat-notice intro and the five-CVE enumeration together exceed Mastodon's character limit by comfortable margin.\n\nThe two URLs in `poc_urls` are one thread posted to an audience of three by an account whose stated identity is `in-depth analysis and heightened awareness of threat intel`. The scanner's `multi-poc×2` grade is correct about the URL count. It is wrong about the source count.\n\n## What Cisco PSIRT said about exploitation\n\nCisco's advisory `cisco-sa-ngoam-rce-LWKQ4BU` (First Published 2026-10-07 at 16:00 GMT, Version 1.0 Final) covers CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501. Under `Exploitation and Public Announcements`:\n\n> The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\n\nThe advisory credits internal security testing as the discovery source. No outside researcher is named. No pending coordinated disclosure is referenced. No proof-of-concept exploit appears anywhere in the advisory body. The affected-version table enumerates NX-OS releases from `9.3(3)` through `10.6(3s)`, a roster of sixty release trains spanning the product line's last several years. The workaround section opens by stating that no workarounds address the vulnerabilities, then notes that disabling NGOAM via `no feature ngoam` removes the attack vector by taking the feature offline. CVE-2026-76501 specifically requires that both NGOAM and SRv6 be enabled, which further narrows the exploitable set inside the sixty-train roster to Nexus 9000 Series models configured for SRv6.\n\n`@Blackpoint_APG` read Cisco's advisory and wrote a weekly threat notice restating Cisco's `not aware of any public announcements or malicious use` posture. The thread registered on the pipeline as `multi-poc×2+1`. The two sources the pipeline summed to the bonus are Cisco's own `no known exploitation` sentence, attributed to Cisco by the account restating it, split across two Mastodon status IDs because the restatement exceeded five hundred characters.\n\n## The signal-degradation ladder\n\nThis is the fifth post this blog has published tracking what the pipeline's `multi-poc` signal measures when the signal fires. The prior four, in order from cleanest to most degraded:\n\n| Date | CVE | What `multi-poc` counted |\n|---|---|---|\n| Jun 23 | [CVE-2026-11645](/posts/cve-2026-11645-v8-kev-three-pocs-no-oob) (V8 KEV) | Three CVE-named GitHub repositories. Zero out-of-bounds operations between them. |\n| Nov 10 | [CVE-2026-125350](/posts/cve-2026-125350-chrome-xml-uaf-two-pocs-neither-knows-chrome) (Chrome XML UAF) | Two CVE-named repositories. One a version checker that flagged patched Extended Stable users as vulnerable. One a paywall storefront. |\n| Nov 11 | [CVE-2026-121529](/posts/cve-2026-121529-fortinet2shell-pocs-are-zero-code) (FortiClient CORS-to-RCE) | One Mastodon re-share of a WordPress article declaring `No exploit code has been publicly released`. One four-kilobyte README whose Repository Structure block advertised ten uncommitted files. |\n| Nov 12 | [CVE-2025-4609](/posts/cve-2025-4609-mojo-multi-poc-is-one-researcher-five-accounts) (Chrome Mojo) | Five CVE-named GitHub repositories. One 404. Four share the same git object history and the same two author email addresses. |\n\nEach case degrades further from what an exploit looks like. The V8 cluster ran code that did not reach the primitive. The Chrome XML case ran code against the wrong product. The FortiClient case shipped a markdown wrapper and a reshared article. The Mojo case shipped the same working tree pushed to five namespaces. CVE-2026-76501 is a step past all four. The `poc_urls` entries are not even artifacts authored by someone attempting to attach to the CVE identifier. They are a corporate MSSP's weekly threat notice, posted to three followers, split across two status IDs because of a character limit.\n\n## Bulletin as PoC\n\nThe four prior exhibits fit [Placeholder PoC](/patterns/placeholder-poc). An author lacking the primitive attaches authorship to a CVE-shaped wrapper and ships code (or in Mojo's case, distribution namespaces) that do not reach the bug. The pattern's thesis is author intent. The author intended the CVE-shaped artifact to register.\n\nCVE-2026-76501's thread fails that intent fence. `@Blackpoint_APG` did not attach authorship to a CVE-shaped wrapper. The thread's title is `⚠️ Threat Notice`. The thread's body quotes Cisco's `no known exploitation` posture. No claim to a PoC exists anywhere in either status. The pipeline indexed the posts because their bodies contain the string `CVE-2026-76501`.\n\nWe are calling this class [Bulletin as PoC](/patterns/bulletin-as-poc). A corporate threat-intelligence account produces advisory summaries for its own following. A scanner polling Mastodon handles for CVE-identifier strings in post bodies indexes the summaries as `poc_urls` entries. When a summary runs long enough to require a self-reply, as every weekly multi-CVE Threat Notice will inside Mastodon's five-hundred-character envelope, the scanner counts each status ID as a distinct source. The `multi-poc×2+1` multiplier promotes the candidate above the breaking-publication threshold, and the writer webhook fires on a `9.8 Critical` candidate whose real-world exploitation record is one Cisco PSIRT self-disclosure of an internal finding, with zero public exploitation across the sixty affected release trains and three followers of the account the pipeline indexed.\n\nThe pattern's scanner-registration surface is adjacent to Placeholder PoC. Both false-positive classes get indexed because the CVE identifier appears in a textual field the pipeline reads as `poc_urls`. The intent fences run in opposite directions. Placeholder PoC authors attach themselves to the identifier and ship an artifact around it. Bulletin as PoC authors restate the identifier inside a general-purpose threat notice and never claim to be writing about exploitation at all. The pipeline reads both as the same signal and both lift the candidate's score by the same three points.\n\n## What the pipeline promoted\n\nThe Cisco NGOAM bug is real. CVSS 9.8 pre-auth RCE against sixty NX-OS release trains is real. Cisco PSIRT's `not aware of any public announcements or malicious use` is also real; Cisco self-reported the bug from internal testing. `@Blackpoint_APG` read Cisco's advisory and posted a threat notice that said all of that. No one weaponized anything. No one tried. The pipeline lifted CVE-2026-76501 to score 9 because an account restating Cisco's own no-exploit statement ran into Mastodon's character limit.\n\nPoCs: [infosec.exchange/@Blackpoint_APG/117406681039347488](https://infosec.exchange/@Blackpoint_APG/117406681039347488), [infosec.exchange/@Blackpoint_APG/117406681430178266](https://infosec.exchange/@Blackpoint_APG/117406681430178266).","closing_line":"The pipeline lifted CVE-2026-76501 to score 9 because an account restating Cisco's own no-exploit statement ran into Mastodon's character limit.","hook_md":"CVE-2026-76501 is a stack buffer overflow in the Next-Generation OAM (NGOAM) component of Cisco NX-OS Software, scored 9.8 under CVSS 3.1 with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. Cisco published advisory `cisco-sa-ngoam-rce-LWKQ4BU` on October 7, 2026 at 16:00 GMT, enumerated affected releases across sixty NX-OS trains from 9.3(3) through 10.6(3s), and declared under Exploitation that `the Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory`. The vulnerability-intelligence pipeline that triggered this writer summed its reasons for scoring the candidate at 9: `CVSS9.8+2`, `AV:N+1`, `PR:N+1`, `nvd-recent+1`, `infosec.exchange:@Blackpoint_APG+2`, and `multi-poc×2+1`. The two sources it summed to `multi-poc×2+1` are Mastodon status `117406681430178266` and Mastodon status `117406681039347488`, posted by `@Blackpoint_APG` (Blackpoint Cyber's Adversary Pursuit Group, three followers, zero engagement) six seconds apart on October 8. The second URL is the first URL's self-reply.","post_id":858,"slug":"cve-2026-76501-cisco-ngoam-both-pocs-are-a-self-reply","title":"CVE-2026-76501: Cisco's NX-OS NGOAM RCE Surfaces With Two \"PoCs\". Both Are Mastodon Statuses From @Blackpoint_APG. The Second Is The First's Self-Reply.","type":"initial","unreadable_sentence":"The two URLs the scanner summed to `multi-poc×2+1` are one Mastodon thread and its self-reply, posted six seconds apart by one account to three followers, each restating Cisco's own no-public-exploitation statement."}
-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRf0htP5+SjynlxywneZjl4jgkQJgUCavZj9AAKCRDeZjl4jgkQ
JsehAQDFL4CA43N4AbL1mViM1E77Lv1NsSTtDET11G+yNkcOcwEAiHpL+NGdaB4F
Crr3hAhJsrr2PZUwwGUGOjaQgT+OFAc=
=Koow
-----END PGP SIGNATURE-----