Ghost Assets in Vulnerability Management: How Identification, Merging and Asset History Eliminate Anomalies in MaxPatrol VM
Every asset in an IT infrastructure follows a lifecycle: it appears, operates and is eventually decommissioned. New assets are frequently created from existing templates yet quickly acquire unique characteristics. Constant infrastructure changes generate data anomalies including duplicates, erroneous merges and digital ghosts—assets that no longer exist but remain listed in the vulnerability management system.
To address these issues, Positive Technologies experts Kirill Maslov and Gamzat Shtanchaev describe three non-trivial tasks implemented in MaxPatrol VM: identification that matches data from disparate sources to a specific asset, correct merging of previous and new states, and maintenance of asset history that records the moment an asset disappears.
Assets in MaxPatrol VM are treated as frames on a film reel rather than real-time entities. The first frame records initial discovery via host discovery, hypervisor audit or directory service scan. Subsequent black-box scans reveal operating systems, open ports and services, while white-box audits provide users, groups, installed software and network interfaces. Specialized profiles such as PostgreSQL Audit further enrich data using transports including SSH, WMI and LDAP.
History appears as a timeline in the interface. Between scans, a data-aging mechanism uses policies that define freshness and obsolescence periods. A global 90-day threshold hides inactive assets from lists and vulnerability calculations while preserving them for historical PDQL queries. Assets are never permanently deleted.
Identification relies on type-specific key attributes. Network devices use hostname, IP and system ID; Windows systems add MAC address and FQDN; Linux systems use IP, hostname and MAC. Virtual machines prioritize VM ID. Scans must contain at least one valid key, with stricter requirements for full audits. Failed validation is logged with details of missing attributes.
Merging updates only attributes present in the new scan while leaving absent attributes unchanged. For nested objects the process recurses. An object is removed only when every source that previously supplied it has been executed and returned without it. Partial scanning profiles allow teams to collect vulnerability-relevant classes more frequently while running full audits less often.
Common ghost and duplicate scenarios include cloned machines retaining identical hostnames, virtual-machine clones that alter MAC and VM ID, and partial scans that leave stale collections intact. Recommended actions include enforcing unique hostnames after cloning and adjusting system IDs on virtual machines to prevent incorrect merging.
Related articles
Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild
Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.
Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Sophos UTM Versions, Manual Patch Required After EOL
Sophos has disclosed a critical remote code execution vulnerability in its legacy Sophos UTM security gateway product. The flaw, tracked as CVE-2026-118633, carries a CVSSv4.0 base score of 9.2 and is rated Critical. It allows unauthenticated attackers to execute arbitrary commands as root by triggering a race condition through repeated attacks against the email proxy when scanning is enabled. Although the product reached end-of-life, Sophos released a manual patch that users must apply themselves because automatic updates are no longer available. The company urges immediate patching for any deployments still using the email protection feature and recommends migration to the supported Sophos Firewall. The issue was reported through Sophos’s bug bounty program by an external researcher.
PHP2Shell Campaign Chains PHP and Linux Kernel Flaws to Compromise 25 Servers Including US Government-Linked Network
Israeli security firm Dream disclosed a sophisticated campaign that achieved root access on 25 servers by chaining two remote code execution vulnerabilities in PHP2Shell with a Linux kernel flaw. The attackers targeted 24 perimeter firewalls from a single unnamed vendor plus one internal management server across the United States, Japan, Taiwan, and South Korea. Three of the compromised devices belonged to an environment connected to the US government, where the intrusion led to domain controller access and Active Directory enumeration. The attack chain began with CVE-2026-109618 and CVE-2026-109619, which granted initial web server access, and escalated via CVE-2026-46300 (Fragnesia) to obtain root privileges. Dream observed extensive reconnaissance using the Chinese search engine FOFA, with indicators pointing to Chinese-language tooling and timing, though no specific threat actor was attributed.
Threat Actors Exploit Critical CVE-2026-101767 RCE Flaw in Oracle E-Business Suite
Threat intelligence firm Defused detected active exploitation attempts against CVE-2026-101767 targeting Oracle E-Business Suite honeypots on October 27, 2026. The vulnerability carries a CVSS 3.1 score of 9.8, requires no authentication, and resides in the Thin Client Framework servlet within the Application Object Library component. Oracle released a fix seven days earlier in its October 2026 Critical Patch Update, covering versions 12.2.3 through 12.2.15. Successful exploitation grants SQL execution under the privileged APPS database account, enabling lateral movement to operating system commands and access to financial, payroll, and procurement records. Horizon3.ai privately reported the issue in July 2026, and prior similar flaws in the same product were leveraged by the Cl0p ransomware group. Immediate mitigation includes applying the quarterly patch or restricting access to the GanttDataServer servlet via URL firewall rules.