Research org contributor

Mandiant

cited as evidence in 52 · CNA assigner on 2 · credited finder on 3 of 53 known-exploited records. Every aggregate on this page is recomputed from the records listed below — each one already cited to its public source.

mandiant.com ↗ · home of the cited advisories

records cited in

deterministic count

finder / reporter credits

CVE.org credits

CVE records catalogued (CNA)

assigner

46%

avg modeled exploit prob.

FIRST EPSS, 52/53

32%

ransomware-associated

17 of 53 · CISA flag

Known for

— recomputed from this contributor’s own records

SurfacesApplication / other (26), Edge / remote-access infra (18), Operating system / kernel (5), Hypervisor / virtualization (3), Server / web platform (1)

WeaknessAuthentication (12), Memory safety (11), Injection (9), Path traversal / file (5), Authorization / access control (3)

PortfolioApple (8), SonicWall (5), Ivanti (5), Cisco (3), Oracle (3), Veritas (3)

PeopleNamed individuals credited under this contributor:

Stallone D’Souza, MandiantMandiant Threat DefensePeter Ukhanov from Google/Mandiant

Narrative reach

— how far this contributor’s records carry an attacker, front door → lights out

1Front door

52reach this stage

→

2Keys to the kingdom

52reach this stage

→

3Lateral reach

48reach this stage

→

4Data at risk

12reach this stage

→

5Lights out

1reach this stage

Furthest any of these records carries an attacker: 5 · Lights out. 12 of 52 narrative-framed records reach data-at-risk or lights-out. (furthest-position idiom, reused from the landing map; the stage mapping is a model output over cited evidence.)

Recent highlights

— this contributor’s newest known-exploited records

CVE-2026-35273Oracle8%RWKEV CVE-2024-1708ConnectWise88%RWKEV CVE-2025-31277Apple1%KEV CVE-2025-43510Apple0%KEV CVE-2025-43520Apple0%KEV CVE-2021-30952Apple8%KEV

Every record they’re cited in

— all 53, each linked to its cited source

This is the evidence behind every number above. Sorted ransomware-first, then by modeled exploit probability.

CVE-2024-21887Ivanti100%RWKEV CVE-2019-19781Citrix100%RWKEV CVE-2023-46805Ivanti100%RWKEV CVE-2025-0282Ivanti100%RWKEV CVE-2025-22457Ivanti100%RWKEV CVE-2022-42475Fortinet99%RWKEV CVE-2024-1708ConnectWise88%RWKEV CVE-2021-20021SonicWall83%RWKEV CVE-2021-27877Veritas65%RWKEV CVE-2021-20023SonicWall51%RWKEV CVE-2021-22893Ivanti47%RWKEV CVE-2021-20016SonicWall40%RWKEV CVE-2021-27878Veritas24%RWKEV CVE-2021-20022SonicWall17%RWKEV CVE-2021-27876Veritas13%RWKEV CVE-2026-35273Oracle8%RWKEV CVE-2023-4966Citrix NetScaler ADC/Gateway “Citrix Bleed”—RWKEV CVE-2023-44487IETF100%KEV CVE-2020-10189Zoho100%KEV CVE-2019-1653Cisco100%KEV CVE-2020-14750Oracle99%KEV CVE-2023-34048VMware99%KEV CVE-2022-3236Sophos99%KEV CVE-2024-47575Fortinet97%KEV CVE-2019-1652Cisco96%KEV CVE-2021-21311Adminer90%KEV CVE-2025-12480Gladinet90%KEV CVE-2020-14871Oracle80%KEV CVE-2022-28810Zoho70%KEV CVE-2020-8218Pulse Secure33%KEV CVE-2025-53690Sitecore26%KEV CVE-2022-0185Linux25%KEV CVE-2022-26871Trend Micro20%KEV CVE-2021-44207Acclaim Systems18%KEV CVE-2023-7101Spreadsheet::ParseExcel17%KEV CVE-2020-27950Apple17%KEV CVE-2022-22948VMware14%KEV CVE-2023-20867VMware14%KEV CVE-2026-22769Dell13%KEV CVE-2022-41328Fortinet12%KEV CVE-2022-20821Cisco12%KEV CVE-2021-30952Apple8%KEV CVE-2021-20035SonicWall4%KEV CVE-2023-43000Apple4%KEV CVE-2021-35247SolarWinds3%KEV CVE-2022-48503Apple3%KEV CVE-2021-43226Microsoft3%KEV CVE-2022-40139Trend Micro3%KEV CVE-2025-21590Juniper2%KEV CVE-2025-31277Apple1%KEV CVE-2023-41974Apple1%KEV CVE-2025-43520Apple0%KEV CVE-2025-43510Apple0%KEV

Coverage & confidence

— what this profile claims, and what it does not

Established (cited)

Cited in 53 known-exploited records — the list below; every one links to its public source.

Catalogued 2 CVE record(s) as the CNA assigner (from CVE.org).

Credited as the finder/reporter on 3 record(s) (CVE.org credits).

Coverage gaps — stated, not hidden

This profile is an aggregation: it asserts only what the listed records already cite — no new external claim about the contributor is made.

The TYPE badge and the narrative-stage mapping are editorial (our call), labeled as such, not a sourced fact.