Core Concepts and Threat Actors

Because the attack is an ordinary, well-formed request. If the server never checks who owns the record, any account holder simply asks for someone else's identifier and is served it. Nothing is malformed, so nothing needs exploiting.

A crash proves the flaw is reachable, not that anyone can control your system. Vulnerability, working exploit and packaged tooling are three separate states with three separate dates, and only the last two widen who can attack you.

Zero-day is a patch state, not a quality grade. It asserts only that no vendor fix existed at the moment the flaw was used. It says nothing about the bug's elegance, the attacker's skill, or whether the attack was unstoppable.

A CVE record says a named authority described one flaw and listed the product versions it believes affected, under a permanent identifier. It never asserts exploitability where you run it, real-world attack, vendor agreement, or that a fix exists.

A CVE identifier names one flaw in one product, issued by a CVE Numbering Authority. A CWE identifier names the recurring weakness class that flaw belongs to, drawn from a community-maintained taxonomy. Class membership, not instance identity.

A threat is an actor - a person or crew with intent and capability. The load balancer has a vulnerability, a weakness in the thing itself. Say "the load balancer has a vulnerability; the threat is whoever exploits it".

An insider already holds the access an outsider has to attack to obtain. The damaging actions are operations the role is permitted to perform with a valid credential, so no flaw is broken and the only bound on the loss is what that role may reach.

Most intrusions pick the victim after the break-in, not before. A crew fires one flaw at every instance it can enumerate across the internet, then ranks what it caught. Being small changes your rank, not whether you are reached.

It asserts an organised, funded human adversary whose objective outlives any single campaign - sponsorship and patience. It never asserts novel techniques, an unfixed exploit, or that your organisation was specifically chosen.

Only intent differs. The account, the device, the working hours and the operations performed can be identical across all three, so nothing about the actor separates them. That leaves one movable control in common: the scope the role may grant.

A mass-exploitation crew enters the same generic way everywhere, at the same time as many other organisations, and often leaves the access untouched for weeks. A name-first crew substitutes paths until one reaches you specifically, and works the access almost immediately.

It hands the precondition away for free. Running contributor-authored build content is the runner's job, so anyone who can open a pull request already has local execution, and the flaw moves from post-compromise to initial access.

A crash proves memory was corrupted, not that the corruption can be steered. Reaching execution needs a controlled write or read primitive plus defeat of non-executable data pages, address randomisation, stack cookies and control-flow integrity. Many defects never get there.

Capability does not change; audience does. Anyone able to write or drive the exploit could already attack you. Packaging removes the skill and time cost, so the population that can try it grows from a handful of operators to effectively everyone.

The shipped fix is a description of the bug. Comparing the corrected code with the previous version localises the defect and often reveals the missing check, so people who could never have found it can now trigger it — while your machines still run the old code until each application restarts.

RESERVED means an assigner allocated the identifier and published nothing behind it: no description, no affected versions, no references. Seeing it in a commit tells you a number exists for something that may be published, not what the flaw is.

CWE-20 sits at the Class level of a four-tier taxonomy — Pillar, Class, Base, Variant. It says a check was missing, not which resource was harmed, so it constrains no change. The actionable statement lives at Base.

You have claimed that nobody in the reachable population will perform an ordinary action once during the flaw's remaining life, while anyone who can contact them may ask. Written out, that claim is usually false.

Patch level is a claim about third-party code someone else shipped a fix for. It says nothing about first-party authorization decisions, identifiers accepted as entitlement, workflow logic or configuration — flaws that never carry a version number at all.

Every tenant already holds the escape's only entry condition: code in a pod. Reliability turns a crash into repeatable takeover of the node and every workload on it, so this rung moves you far more than a single-tenant estate.

A dispute records that a party contests the record; it does not withdraw it, and nobody adjudicates. Judge the described behaviour against your own deployment. If the vendor calls it intended, no fix is coming.

File it at Base: CWE-732, incorrect permission assignment for a critical resource. The Pillar and Class above it are true but imply no change; only the Base entry names the resource and the consequence, so only it constrains the fix.

Class predicts what the same access gets spent on and whether the crew returns. Publicity is the hacktivist's objective, so access is consumed; for a criminal crew publicity destroys value. It is not a capability ladder.

The stolen session carries the engineer's standing roles, so the thief acts with the position rather than against it. Authentication has already succeeded, which spends every control keyed to identity; what happens next is bounded only by what those roles may reach.

Probably not by whoever got in. That pattern fits a split market: one party gained access opportunistically and sold it, a second party bought and chose you from a listing. The six-week gap measures time on a market, not patience.

First test the sentence: was a fix available on the day? Most such claims turn out to be n-day, where money spent shortening the gap between a fix existing and running pays off. If the claim holds, fund that shorter clock anyway and record the remainder as accepted residual risk.

An unfixed exploit is a wasting asset. Every use puts a copy somewhere the operator does not control, and one recovery leads to a fix that destroys its value everywhere at once. Broad use burns it fast, so it is spent narrowly.

Because publishing destroys most of its value. A working escape from a guest virtual machine is one of the most expensive capabilities to build or buy, so the holder keeps it private. The ladder tracks availability, not existence.

Nothing about the code. The count measures assignment decisions the vendor controls: its declared scope, what it counts as a vulnerability, what it publishes. Identifiers are requested by people, never discovered, so an unresearched product scores zero.