NVD Disruptions Force Security Teams to Diversify Vulnerability Intelligence Sources
The vulnerability management process begins with reliable information about which vulnerabilities exist. Over the past couple of years the ecosystem of vulnerability data sources has experienced a genuine earthquake. What once seemed permanent and unshakable — a single CVE database carefully enriched by the American NVD — has suddenly become unstable. This article examines where to obtain vulnerability data today and why depending on one source has become risky.
Primary Vulnerability Data Sources for the Russian Market
BDU FSTEC (bdu.fstec.ru) is the Russian national threat database. Its advantages include orientation toward the Russian market and legislation, official state-recognized data, detailed descriptions with remediation recommendations, and coverage of domestic software that may be absent from Western databases. As of August 2026 the database contains more than 92 thousand vulnerabilities. Entries use identifiers in the format BDU:2024-01398. Users can find descriptions, consequences, and mitigation guidance. FSTEC also maintains a separate section on the most dangerous trending vulnerabilities, serving as the Russian analogue of the catalog of exploited vulnerabilities.
NVD (nvd.nist.gov), maintained by NIST, is the American national vulnerability database. It offers broad coverage, detailed descriptions, and mappings to CVSS and CPE. However, NVD has been at the center of the main drama of recent years, which is discussed below.
The CVE database maintained by MITRE is the international registry of vulnerability identifiers. CVE serves as the global identification standard; the same identifier CVE-2021-44228 (Log4Shell) is recognized worldwide. Both NVD and BDU, as well as vendor products, rely on CVE records.
Vendor security bulletins from software manufacturers such as Microsoft, Cisco, Astra Group, Positive Technologies and others frequently provide the earliest and most accurate information.
Related articles
HPE Aruba Networking Fabric Composer Affected by 52 Vulnerabilities Including Five Critical Flaws
HPE disclosed a security advisory on September 1, 2026, revealing 52 vulnerabilities in HPE Aruba Networking Fabric Composer. Five of these issues are rated Critical, including authentication bypass flaws that allow remote code execution and privilege escalation. CVE-2026-76657 permits attackers to bypass API authentication and gain administrator rights remotely. CVE-2026-76658 enables unauthenticated command execution as a privileged user via the SSH daemon. Additional critical issues include CVE-2026-19766 for adjacent network host takeover, CVE-2026-73700 for XSS in the web interface, and CVE-2026-73701 for unauthenticated remote code execution under certain conditions. HPE strongly recommends immediate updates across affected components including the OS, SSH, web management, and API layers.
SonicWall SMA 1000 Series Affected by Critical Vulnerabilities with Evidence of Exploitation
SonicWall has disclosed two serious vulnerabilities in its SMA 1000 series remote access appliances. The issues, tracked as CVE-2026-83548 and CVE-2026-83549, affect the SMA 6210, SMA 7210, and SMA 8200v models. CVE-2026-83548 is a server-side request forgery flaw in the WorkPlace interface that permits unauthenticated remote access to otherwise restricted functions. CVE-2026-83549 is an OS command injection vulnerability in the Appliance Management Console that can lead to remote command execution after authentication under certain conditions. Both vulnerabilities received high CVSS scores, with one reaching the maximum of 10.0. The vendor published the advisory on September 1, 2026, and confirmed cases where the flaws appear to have been exploited in the wild.
Dell Expands PowerStore Advisory with Two Additional Critical Vulnerabilities
Dell has updated its security advisory for the Dell PowerStore storage platform, adding two previously unmentioned vulnerabilities to the list of issues addressed by recent patches. The advisory now covers CVE-2026-58566, an authorization bypass flaw that can lead to privilege escalation, and CVE-2026-79687, an authentication bypass in Dell PowerStore SDNAS that allows unauthenticated remote access to the file system. Both vulnerabilities received high CVSSv3.1 base scores of 8.8 and 9.0 respectively. The company also announced availability of updated PowerStoreT OS builds 5.0.0.2-2761110, 4.3.1.2-2771239, and 4.1.0.6-2771237 that remediate the newly listed issues along with fifteen other CVEs. The advisory was first published on August 10, 2026 and received multiple revisions through the end of the month.
Code Signing Myths: Why a Valid Digital Signature Does Not Equal File Safety
Digital signatures confirm only that a file was issued by a specific publisher at a given time and remained unchanged afterward. They do not verify current safety, the legitimacy of the current holder, or whether the private key was stolen months earlier. Attackers obtain legitimate certificates through build-system leaks, supply-chain compromises such as the 2019 ASUS ShadowHammer incident, or weak reseller validation. Expired certificates remain usable because verification can be performed at the timestamp recorded by an RFC 3161 TSA token rather than the current system clock. Signature hashes in Authenticode deliberately exclude the checksum field, certificate table, and attribute certificate table, allowing limited tampering that older WinVerifyTrust implementations did not fully block. Revocation checks are soft by default, and revocation dates can leave an exploitation window open. Organizations should enforce publisher thumbprint allow-lists in WDAC or AppLocker and store signing keys exclusively in HSMs.