Threat operations/Case file
AL
Analyst accessPublic view · sign in

Vulnerability threat dossier

CVE-2019-3396

AtlassianConfluence Server and Data Server

Metadata pending authoritative retrieval.

VTP deterministic threat50.0of 100 · CVSS excluded

VTP analyst assessment

No AI candidate assessment for this subject

AI-assisted analytical recommendationDoes not set factual exploitation state
AI classificationNO ALERT
AI priorityNONE
AI confidenceUnknown
Public exploitation · VTP factKEV

Assessment

The latest persisted AI review did not propose this CVE for analyst escalation. Deterministic monitoring remains authoritative for the factual states below.

Why it matters

Unknown from persisted AI analysis.

Evidence

No AI candidate evidence set is persisted for this CVE.

Uncertainties

No first-party sensor telemetry is configured. Local exploitation observation is unknown.

Next watchpoint · deterministic

A validated functional exploit or automated exploitation capability would materially change this assessment.

AI analysis history (0)
    Technical severityUNKNOWNCVSS unknown · technical context
    Public exploitationKEVGlobal public evidence
    Exploit maturityNONE KNOWNReliability not implied
    EPSS1.00100th percentile · prediction
    Evidence confidence0%Strongest independent active claim
    VelocitySTABLEMaterial events only
    First-party telemetryNo first-party sensor telemetry configured.
    Availability: NO_SENSOR_CONFIGURED · Evidence: UNKNOWN
    01

    VTP deterministic assessment

    Why this matters

    1. 01

      CISA KEV lists this vulnerability as known to be exploited globally.

    2. 02

      EPSS is 1.00; this is predictive context, not exploitation evidence.

    3. 03

      No first-party sensor telemetry is configured; first-party observation is unknown.

    02

    Material change ledger

    What changed

    KEV ADDEDCISA KEV entry added
    03

    Claim provenance

    Evidence and source independence

    0publications detected
    0underlying evidence chains

    0 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

    04

    Event history

    Threat timeline

    1. 00:0003 Nov
      KEV ADDED

      CISA KEV entry added

      CISA lists global known exploitation. This is not a VTP sensor observation.

    05

    Original publications

    Source record

    06

    Technical vulnerability data

    Context, not threat proof

    VTP threat score50.0vtp-threat-v1-public
    Public exploitation30 / 30
    EPSS prediction19.98 / 20
    Exploit availability0 / 15
    Source independence0 / 15
    Intelligence recency0 / 10
    Threat acceleration0 / 10
    CVSS technical severityExcluded
    CVSS
    Unknown · UNKNOWN
    Vector
    Unknown
    CWE
    Unknown
    CPE records
    0
    Deterministic history records
    2
    07

    Raw observations

    First-party sensor records

    No first-party sensor telemetry configured.