Vulnaware Bridges Vulnerability Scanners and ITSM Systems to Improve Critical Flaw Prioritization
A Russian security engineer has released Vulnaware, an open-source prioritization engine designed to solve one of the most persistent problems in vulnerability management: ensuring that genuinely dangerous flaws reach remediation teams before they become incidents.
The project was created after the author observed that vulnerabilities rarely compete successfully for attention inside IT service desks because they lack an associated ticket, SLA, or downtime impact. According to Verizon DBIR 2026, exploitation of vulnerabilities overtook credential theft for the first time in the report’s 19-year history, accounting for 31 percent of breaches compared with 20 percent the previous year.
Vulnaware is not a vulnerability scanner or a full VM platform. Instead, it functions as an independent layer that sits between existing scanners and ITSM systems. It currently accepts data from MaxPatrol VM, Nessus Pro, and Greenbone/OpenVAS. Scope is limited at ingestion using asset groups, scan folders, or host tags so that only relevant assets are processed.
Prioritization relies on three concrete signals: presence in the CISA KEV catalog, availability of exploits in community feeds from Vulncheck, and trend indicators when available from MaxPatrol. The goal is to surface only those vulnerabilities that have at least one working exploit, dramatically reducing noise for security and IT teams.
Once an issue is prioritized, Vulnaware can automatically create tickets in Jira Service Management, GLPI, Znuny, and osTicket. It also sends notifications through a Telegram bot (with optional asset obfuscation) and email templates built with Jinja. A lightweight web interface allows manual review and one-click dispatch when automatic routing is not desired.
The tool’s design follows the five-stage lifecycle described in NIST SP 800-40 Rev. 4 and the risk-based timelines introduced by CISA BOD 26-04, which replaced rigid deadlines with a matrix considering asset exposure, KEV listing, exploit automation, and technical impact. By converting prioritized vulnerabilities into properly classified service requests or changes, the solution gives organizations measurable MTTR data for the flaws that actually matter.
Related articles
PKCE Becomes Mandatory for OAuth Public Clients as RFC 9700 and OAuth 2.1 Close Authorization Code Interception Risks
PKCE, or Proof Key for Code Exchange, was introduced in RFC 7636 to prevent code interception attacks in OAuth 2.0 flows used by mobile and single-page applications. The mechanism generates a code_verifier and derives a code_challenge using S256 hashing to bind the authorization code to the original client session. Without PKCE, malicious apps on the same device can hijack custom URI schemes like myapp://callback and exchange stolen codes for access tokens. RFC 9700, published in January 2025, now mandates PKCE for public clients and recommends it for confidential ones while requiring S256 over the weaker plain method. The upcoming OAuth 2.1 draft further embeds PKCE into the core authorization code flow and removes implicit and resource owner password credentials grants. Major providers including Auth0, Okta, and Microsoft Entra ID show varying default support, highlighting the need for explicit S256 implementation. The standard also protects against code injection attacks even when client secrets are present.
Attackers Chain JFrog Artifactory CVEs for Rapid Admin Takeover and Backdoor Deployment
Real-world attacks against self-hosted JFrog Artifactory have chained multiple CVEs to escalate from unauthenticated requests to full administrative control. Attackers achieved persistence by installing malicious Groovy plugins, executing shell commands, and deploying Rust-based backdoors within minutes. The primary chain relies on CVE-2026-42018 and CVE-2026-42016, allowing anonymous token acquisition and privilege escalation without proper scope validation. A separate critical flaw, CVE-2026-82329 with CVSS 9.8, enables direct authentication bypass and admin token creation on default configurations. Patches are available across multiple 7.x branches, and defenders are urged to audit logs for anonymous admin actions and inspect for unauthorized plugins and binaries. The incidents highlight risks to software supply chains when artifact repositories are compromised.
Check Point Patches Two Critical VPN Vulnerabilities Allowing Unauthenticated Remote Code Execution
Check Point has released fixes for two critical vulnerabilities affecting its Security Gateway, Security Management Server, and locally managed Spark Firewall products. Both flaws received a CVSS score of 9.8 and enable remote code execution without requiring authentication. CVE-2026-85102 resides in certificate trust validation during VPN negotiation, allowing an unauthenticated attacker to force the process and execute arbitrary code. CVE-2026-85103 is a heap buffer overflow triggered while parsing the ASN.1 structure of VPN certificates. Affected versions include R81.20, R82, and R82.10 before the listed hotfixes, as well as unsupported R80.40 and R81 releases. R82.20 remains unaffected. The issues were discovered internally by Check Point researchers, with no active exploitation or public proof-of-concept observed as of the September 10 disclosure.
Positive Technologies Acquires Stake in CyberOK to Advance EASM and PentOps Technologies
Positive Technologies has acquired a stake in cybersecurity developer CyberOK, with the size of the investment and deal terms remaining undisclosed. The partnership will focus on developing External Attack Surface Management (EASM) solutions and PentOps technologies that identify overlooked external assets and validate whether attackers can exploit them. Collaboration between the companies began in 2026, with CyberOK technologies already integrated into PT EASM and the PT X cloud platform. In less than six months, pilot projects for PT EASM exceeded 70, and Positive Technologies expects 80 percent of successful trials to convert into deals by late 2026 or early 2027. The Russian EASM market is projected at 2-2.5 billion rubles by the end of 2026, potentially reaching 8 billion rubles by 2031 when combined with continuous security validation solutions. PentOps will provide continuous cloud-based penetration testing that automatically verifies exploitability of discovered issues, moving beyond simple vulnerability lists. In 96 percent of pilots, unaccounted IT assets with critical vulnerabilities were identified, and CyberOK continues to develop the Vulnum knowledge base along with AI agents and Offensive SOC capabilities.