August 31, 2026
about 3 hours ago
Summary
- Use improved reputation scores and labels on hosts to understand their riskiness for faster alert triage and prioritization.
- Added one new fingerprint for Forgejo to the Platform and four new risk fingerprints to ASM.
Platform
- Use improved reputation scores and labels on hosts to understand their riskiness so you can prioritize alerts with IP indicators faster and perform triage and analysis more effectively with a transparent and consistent scoring methodology.
- This new iteration of reputation scores and labels are generated using a machine-learning model trained on a broad set of host signals that uses SHAP (SHapley Additive exPlanations) methodology to assign each signal a share of the credit for the model's call.
- Each host receives:
- A label (Benign, Suspicious, Malicious, Honeypot, or Inactive) describing what the model believes the host is.
- A 0 to 100 score for fast triage and sorting.
- A label confidence level.
- Evidence for the top five signals that influenced the assessment the most.
- Some data fields from the legacy reputation score method changed as a result of this new release. Learn more in the documentation.
New fingerprints and risks
Added nine new fingerprints to the Platform and two new risk fingerprints to ASM.
Note that new ASM risk fingerprints may be disabled by default in your workspace. Reference your risk type configuration in the ASM web console to review new risk types.
New fingerprints
| Type | Name | Description | Query |
|---|---|---|---|
| software | Forgejo | Forgejo is software for hosting a forge using the Git version control system to aid with software development. | Platform query |
New risks
| Name | Description | Query |
|---|---|---|
| Vulnerable Ubiquiti UniFi Network Application [CVE-2026-77535, CVE-2026-77541] | This is a UniFi Network Application vulnerable to CVE-2026-77535 and CVE-2026-77541, both disclosed in Ubiquiti Security Advisory Bulletin 067 on 2026-08-26. CVE-2026-77535 is an improper input validation flaw that lets an attacker execute a command injection on an adopted device. CVE-2026-77541 is an improper access control flaw that lets an attacker escalate privileges within the application. Both require the attacker to already hold a high-privileged account on the application and network access to it, so neither is reachable by an unauthenticated attacker. Fixed in UniFi Network Application 10.5.67. | |
| Exposed Forgejo Application | This is an exposed HTTP service running Forgejo. This self-hosted Git service often contains source code repositories, user credentials, and CI/CD configurations. The sensitive nature of the information contained in this application makes it a target. | |
| Vulnerable Forgejo [CVE-2026-60004] | This is a service running a version of Forgejo vulnerable to CVE-2026-60004, a command injection in the diffpatch endpoint inherited from Gitea. A patch that writes to hooks/post-index-change lands in the bare temporary repository's hook directory as an executable file, and git runs it while updating the index, executing arbitrary shell commands as the Forgejo service account. Exploitation requires repository write access, which open registration makes reachable by anyone. Fixed in 15.0.6 on the v15 LTS branch. The v16 line is not affected: it moved server-side hooks to a centralised directory and sets core.hooksPath globally, so the hook the exploit plants is never executed. | |
| Vulnerable Gitea [CVE-2026-60004] | This is a service running a version of Gitea vulnerable to CVE-2026-60004, a command injection in the diffpatch endpoint (services/repository/files/patch.go). A patch that writes to hooks/post-index-change lands directly in the bare temporary repository's hook directory as an executable file, and git runs it while updating the index, executing arbitrary shell commands as the Gitea service account. Exploitation requires repository write access, but Gitea enables open registration by default, so on an unmodified install an anonymous visitor can register an account and create a repository to reach it. Fixed in Gitea 1.27.1. | |