Threat operations/Vulnerabilities / CVE activity
AL
Member accessPublic view · sign in
How threat priority works

CVSS gives technical context. It never enters the VTP threat score. Public exploitation evidence and observations from your honeypots are separate facts.

Vulnerability threat dossier

CVE-2026-39980

Vendor unknownProduct mapping pending

Metadata pending authoritative retrieval.

VTP deterministic threat13.8of 100 · CVSS excluded

VTP analyst assessment

CVE metadata pending; public Metasploit coverage

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateREVIEWED
AI priorityNONE
AI confidence48%
Public exploitation · VTP factUNKNOWN

Assessment

Rapid7 Metasploit Framework added exploit-oriented tooling coverage for CVE-2026-39980. Product, vulnerability mechanism, and impact are not yet available in this record.

Why it matters

  • Public tooling can reduce attacker effort once affected products are identified.

Evidence

2 record references and 1 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

The record lacks authoritative metadata and remediation.

Tooling coverage does not establish exploitation in the wild or successful execution.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

Track authoritative CVE metadata and vendor remediation before assigning product-specific actions.

AI baseline history (1)
  1. BASELINE ASSESSED
    CVE metadata pending; public Metasploit coveragegpt-5.6-terra · low
Technical severityUNKNOWNCVSS unknown · technical context
Public exploitationUNKNOWNGlobal public evidence
Exploit maturityPOCReliability not implied
EPSS0.0170th percentile · prediction
Evidence confidence90%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    A proof of concept is reported; functional reliability is not established.

  2. 02

    EPSS is 0.01; this is predictive context, not exploitation evidence.

  3. 03

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

EXPLOIT TEMPLATE AVAILABLEPublic exploit-oriented template available
03

Claim provenance

Evidence and source independence

1publications detected
1underlying evidence chains

0 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Source claimEXPLOIT TEMPLATE AVAILABLEPUBLIC EXPLOIT TEMPLATE
90%claim confidence
PRIMARYcorpus:METASPLOIT:28f4223c60cad9dac0ea92932afb24d8524484a5ACTIVE
Evidence
04

Event history

Threat timeline

  1. 19:0514 Oct
    EXPLOIT TEMPLATE AVAILABLE

    Public exploit-oriented template available

    Rapid7 Metasploit Framework published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.

05

Original publications

Source record

Rapid7 Metasploit FrameworkEXPLOIT INTELLIGENCEPRIMARY

Exploit tooling coverage changed for 2 CVEs

Rapid7 Metasploit Framework recorded exploit-tooling coverage changes for 2 CVEs in this pinned revision. 2 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.

CVE-2026-27960CVE-2026-39980
Separate evidence group
Original
06

Technical vulnerability data

Context, not threat proof

VTP threat score13.8vtp-threat-v1-public
Public exploitation0 / 30
EPSS prediction0.26 / 20
Exploit availability7.5 / 15
Source independence0 / 15
Intelligence recency6 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
Unknown · UNKNOWN
Vector
Unknown
CWE
Unknown
CPE records
0
Deterministic history records
4
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.