Infrastead
Preview

CISA KEV · live

Latest known exploited vulnerabilities from the CISA KEV catalog: CVE-2026-33824 (Microsoft Internet Key Exchange (IKE) Service Ext…), CVE-2026-59310 (Broadcom VMware vCenter), CVE-2026-55040 (Microsoft SharePoint), CVE-2026-20349 (Cisco Secure Firewall Adaptive Security Appli…), CVE-2026-68820 (Microsoft Windows Ancillary Function Driver for W…), CVE-2026-20316 (Cisco Secure Firewall Management Center (FMC)), CVE-2025-68686 (Fortinet FortiOS), CVE-2026-16812 (Arista VeloCloud Orchestrator), CVE-2026-16232 (Check Point SmartConsole), CVE-2026-50522 (Microsoft SharePoint).

CVE impact assessment · security advisory response

A critical advisory just landed. “Are we affected?”

Infrastead crosses the advisory against your device inventory, shows which assets are actually exposed, backs every status with evidence, checks whether the mitigation really holds — and turns it into an executive-ready report.

Start controlled preview Log inSee how it works ↓

advisory → assets → evidence → integrity → report

run · 2026-07-06T14:02ZLIVE SURFACE
ADVISORYCRITICALKEV
CVE-2024-3400 PAN-OS GlobalProtect · command injection
ASSETS
66 devices loaded · 4 candidates match vendor + product
EXPOSURE
▲ 2 affected◆ 1 requires validation● 63 not affected
EVIDENCE
pa-edge-fw-02 · workaround applied · HMAC validation disabled
INTEGRITYUNRESOLVED EXPOSURE
verdict from saved evidence, not ticket status
REPORTREADY
REPORT-2026-Q3-0042 · ready for leadership

one advisory run, end to end · sample data

The five questions every advisory raises. Answered, with evidence.

“Are we affected?”

An applicability verdict for every device: affected, not affected, or requires validation.

→ exposure analysis

“Which devices?”

The exposed assets, identified from your own inventory, with the matching conditions shown.

→ affected assets

“What proves it?”

A per-device evidence trail: versions, feature state, workaround status — recorded, not recalled.

→ remediation evidence

“Is patched actually mitigated?”

A mitigation integrity verdict from the evidence. Patch status is not proof.

→ mitigation validation

“What do I tell leadership?”

An executive vulnerability report built from the same evidence that produced the verdicts.

→ executive report

Advisory in. Answer out. Six steps.

This is the exact flow of the guided preview — what you see here is what you run there.

  1. 01

    Define advisory

    Import a vendor advisory from a URL or enter it manually.

  2. 02

    Scope infrastructure

    Load your device inventory from CSV — deduplicated and versioned.

  3. 03

    Analyze applicability

    Every device is classified: affected, not affected, or requires validation.

  4. 04

    Attach evidence

    Record per-device facts where they change the answer.

  5. 05

    Validate integrity

    Get a verdict on whether the mitigation actually holds.

  6. 06

    Generate report

    The same evidence becomes the report leadership signs.

Run it on one advisory

One advisory, your inventory, real analysis — end to end, in one sitting.

Advisories say what might be vulnerable. Not what is.

  • Vendor advisories describe products — not your devices, versions, or exposure
  • Scanners report what they can see — network infrastructure is often not in that picture
  • Inventories live somewhere else — applicability gets answered from memory
  • Patch status does not prove exposure is gone — a workaround can be silently undone
  • Leadership needs evidence — not ticket noise

noise / feed

▒ CVE-2024-3400 PAN-OS GlobalProtect

▒ CVE-2024-21762 FortiOS SSL-VPN

▒ CVE-2023-20198 IOS-XE Web UI

▒ CVE-2024-20399 NX-OS CLI

▒ CVE-2023-46805 Ivanti Connect Secure

▒ CVE-2023-4966 Citrix NetScaler

… thousands more this year

signal / your estate

▲ AFFECTED pa-edge-fw-01 exposed · GlobalProtect on

▲ AFFECTED pa-edge-fw-02 HA peer · mixed version

◆ VALIDATE pa-core-fw-01 version unknown

● CLEAR 61 devices not applicable

One advisory. Four devices that matter. Evidence for each.

advisory noise vs. infrastructure signal · sample

“Patched” is a claim. Integrity is a verdict.

Most workflows stop at tracking whether a patch was deployed. Infrastead asks the question your auditors and your leadership actually ask: is the mitigation trustworthy enough to support a decision? A workaround that was applied — then silently disabled by the next config push — is worse than no workaround, because everyone stopped watching.

Each affected device gets a mitigation integrity verdict computed from its saved evidence. When the evidence cannot support a verdict, the answer is requires_validation — never a quiet downgrade to “probably fine.”

Requires validation is not a failure. It is an honest state.

MITIGATED

Workaround applied, verified against evidence, integrity conditions hold.

PATCHED

Fixed version confirmed on-device — not assumed from a ticket.

PARTIALLY MITIGATED

Risk reduced but conditions remain: mixed HA versions, partial rollout.

REQUIRES VALIDATION

Evidence insufficient to conclude either way. Says so, out loud.

UNRESOLVED EXPOSURE

The mitigation does not hold. This is the row that pages someone.

integrity verdict states · deterministic classifier · sample

Evidence in. Executive answer out.

The report is assembled from the same records that produced the verdicts — advisory context, affected assets, evidence status, integrity, unresolved actions.

evidence · applicability run 2026-07-06T14:02Z

pa-edge-fw-01 AFFECTED PAN-OS 11.0.2 < fixed · GlobalProtect portal exposed

pa-edge-fw-02 AFFECTED HA peer on 11.0.0 · mixed-version pair

pa-core-fw-01 REQUIRES_VALIDATION os_version missing · feature state unknown

pa-branch-fw-12 PATCHED 11.0.3 confirmed · evidence: version + commit log

pa-lab-fw-09 NOT_AFFECTED GlobalProtect not licensed · no evidence required

pa-edge-fw-02 UNRESOLVED_EXPOSURE workaround present · HMAC validation disabled

Devices that are confidently clear never demand busywork evidence. Devices that are unclear never get quietly cleared.

evidence trail · CVE-2024-3400 · sample

REPORT-2026-Q3-0042

CVE-2024-3400 · generated 2026-07-06

Executive summary — GlobalProtect exposure

Of 66 devices in scope, 2 are affected, 1 requires validation, and 63 are not affected. One affected device carries an unresolved exposure: the applied workaround is present but HMAC validation is disabled, so the mitigation cannot be trusted as applied.

66

in scope

2

affected

1

validate

1

unresolved

UNRESOLVEDpa-edge-fw-02 — re-enable HMAC validation, re-verify workaround

VALIDATEpa-core-fw-01 — confirm os_version and GlobalProtect state

CLEAR63 devices — not affected, no action required

every line above traces to a recorded evidence entry

executive brief · generated from run evidence · sample

07 // controlled preview

Run it on your next advisory.

Infrastead is in a limited, guided preview: one advisory, your inventory, real applicability analysis, evidence, mitigation validation, and an executive report — end to end, in one sitting. This is not an open launch.

  • work email + invite required
  • guided preview — one advisory, end to end
  • no automatic infrastructure changes
  • tenant-scoped workspace
  • decision-support output
Start controlled preview I already have access

access · invite-gated · verified work email required