CYBRARY VMware vCenter
CVE-2026-59310
Management-plane syslog path model
Open the labForge vs. CISA KEV 2026
The reference setup behind our 2026 CISA labs
Every lab is simulated: no exploit code or payload runs. A CVE counts as covered only when its lab recreates the documented behavior, exposes evidence in normal Forge tools, supports containment and recovery, validates the fixed state, and has an automated test. Source: CISA Known Exploited Vulnerabilities catalog, version 2026.10.02.
V19
Evidence-validated
P18
Provisional telemetry lab
D2
Draft, not coverage
New simulation modules
V · Evidence-validated
JetBrains TeamCity
CVE-2026-63077
CI controller and agent-poll model
Open the labMicrosoft SharePoint
CVE-2026-45659
Enterprise web-app deserialization model
Open the labRansomware stage · reviewed: Storm-2603 / Warlock
SonicWall SMA1000
CVE-2026-15409 · CVE-2026-15410
Remote-access SSRF-to-admin chain model
Open the labRansomware stage · reviewed: INC Ransomware
PAN-OS / Check Point VPN
CVE-2026-0257 · CVE-2026-50751
IKE/VPN identity state machine
Open the labRansomware stage · reviewed: Qilin (PAN-OS) and a Qilin affiliate (Check Point VPN)
SolarWinds Web Help Desk
CVE-2025-26399
Help-desk Java object-handling model
Open the labRansomware stage · hypothetical (no named operation reviewed)
Oracle PeopleSoft
CVE-2026-35273
ERP session and admin-function model
Open the labRansomware stage · reviewed: ShinyHunters
PTC Windchill/FlexPLM
CVE-2026-12569
PLM repository and document access trail
Open the labRansomware stage · reviewed: Cl0p affiliate
cPanel/WHM
CVE-2026-41940
Hosting control plane tenant and login model
Open the labRansomware stage · reviewed: "Sorry" campaign
Microsoft Defender
CVE-2026-33825
Endpoint-protection tamper lifecycle
Open the labRansomware stage · hypothetical (no named operation reviewed)
Microsoft Windows
CVE-2025-60710
Deterministic reparse-point race scheduler
Open the labMicrosoft Exchange
CVE-2023-21529
Exchange mailbox and admin audit model
Open the labRansomware stage · reviewed: Rhysida
Cisco FMC
CVE-2026-20131 · CVE-2026-20316
Appliance write + crash-recovery model
Open the labPaperCut NG/MF
CVE-2023-27351
Request-path normalization filter model
Open the labNx Console
CVE-2026-48027
Trusted-release provenance model
Open the labTanStack
CVE-2026-45321
Trusted-release provenance model
Open the lab| CVE | Product | Coverage | Ransomware claim | Open |
|---|---|---|---|---|
| CVE-2026-102490 | Zammad Zammad Improper privilege management | D · Draft, not coverage | What-if lab · automated (CISA: Unknown) | Draft |
| CVE-2026-104286 | Fortinet FortiMail Path traversal and file write | V · Evidence-validated | What-if lab · automated (CISA: Unknown) | Validated labDraft |
| CVE-2026-42016 | JFrog Artifactory Incorrect authorization | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-53266 | Linux Kernel Out-of-bounds write | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-5430 | WSO2 Multiple products Path traversal and file upload | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-58704 | Google Pixel Improper authorization | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-60004 | Gitea Gitea Code injection | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-65660 | Microsoft SharePoint Code injection | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-67277 | MikroTik RouterOS Missing authentication | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-67279 | MikroTik RouterOS Workflow bypass | P · Provisional telemetry lab | None | Telemetry lab |
| CVE-2026-71362 | Adobe Commerce / Magento Incorrect authorization | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-7273 | Zyxel GS1900 switches Stack buffer overflow | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-76460 | Cisco Identity Services Engine Privileged API misuse | D · Draft, not coverage | What-if lab · automated (CISA: Unknown) | Draft |
| CVE-2026-84869 | ConnectWise ScreenConnect Privilege management | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-85706 | GitLab CE / EE Path traversal | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-86060 | MikroTik RouterOS Argument delimiter injection | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-86950 | Apple Multiple products Out-of-bounds write | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-87886 | Acronis Backup Incorrect default permissions | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-87902 | WordPress Core Remote file inclusion | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-88771 | Citrix NetScaler Alternate-path authentication | V · Evidence-validated | What-if lab · automated (CISA: Unknown) | Validated labTelemetry lab |
| CVE-2026-88772 | Citrix NetScaler Memory restriction / crash | V · Evidence-validated | None | Validated labTelemetry lab |
| CVE-2026-93616 | Check Point Multiple products Path traversal | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
| CVE-2026-93952 | Arista VeloCloud Orchestrator Input validation | P · Provisional telemetry lab | What-if lab · automated (CISA: Unknown) | Telemetry lab |
Framework coverage and gaps
57 of 77 CVE labs carry a reviewed skills claim (validated, what-if and CSF practice labs). Telemetry-only labs are counted but add no coverage until validated.
Work roles × capabilities a CVE lab proves. Only capabilities each role owns are shown.
Defensive Cybersecurity
3/5
- Telemetry querying5
- Detection engineering2
- Response automation1
- AI and agent security—
- Adversary emulation—
Digital Forensics
1/2
- Evidence handling7
- Protocol analysis—
Incident Response
5/6
- Incident triage49
- Response automation1
- Evidence handling7
- Recovery operations29
- Continuity planning—
- Incident communication2
Threat Analysis
2/5
- Telemetry querying5
- Threat hunting5
- AI and agent security—
- Adversary emulation—
- Protocol analysis—
Vulnerability Analysis
4/5
- Control assurance2
- Vulnerability and patch assurance42
- Offensive testing—
- Asset management1
- Supply chain risk3
Security Control Assessment
8/9
- Detection engineering2
- Control assurance2
- Vulnerability and patch assurance42
- Recovery operations29
- Audit and control evidence1
- Offensive testing—
- Identity and access control2
- Data protection3
- Resilient architecture1
Cybersecurity Policy and Planning
4/5
- Continuity planning—
- Risk and policy governance1
- Supply chain risk3
- Security governance1
- Security awareness1
Systems Authorization
1/1
- Audit and control evidence1
Systems Security Management
8/8
- Risk and policy governance1
- Asset management1
- Identity and access control2
- Data protection3
- Resilient architecture1
- Incident communication2
- Security governance1
- Security awareness1
Labs per cell:gap → most
NIST NICE gaps (5)
Continuity planning · AI and agent security · Offensive testing · Adversary emulation · Protocol analysis
See every ATLAS technique and the labs that teach it
Ransomware claims we cannot cover yet (8)
A ransomware outcome is shown only when a named, reviewed report ties the CVE to a specific operation. Until then the claim stays flagged here. The 21 generated labs that claimed ransomware now each have a labeled what-if lab with its own objectives and pass/fail gates; those are hypothetical exercises, not confirmed coverage.
- CVE-2026-59310 VMware vCenter
Exploit is covered; ransomware stage waits on a named, reviewed operation.
- CVE-2026-63077 JetBrains TeamCity
Exploit is covered; ransomware stage waits on a named, reviewed operation.
- CVE-2025-26399 SolarWinds Web Help Desk
Exploit is covered; ransomware stage waits on a named, reviewed operation.
- CVE-2026-33825 Microsoft Defender
Exploit is covered; ransomware stage waits on a named, reviewed operation.
- CVE-2025-60710 Microsoft Windows
Exploit is covered; ransomware stage waits on a named, reviewed operation.
- CVE-2023-27351 PaperCut NG/MF
Exploit is covered; ransomware stage waits on a named, reviewed operation.
- CVE-2026-48027 Nx Console
Exploit is covered; ransomware stage waits on a named, reviewed operation.
- CVE-2026-45321 TanStack
Exploit is covered; ransomware stage waits on a named, reviewed operation.