DRAGONFORCE

CVE-2021-44228 CRITICAL Apache Software Foundation Apache Log4j2 10.0 CVE-2024-55591 CRITICAL Fortinet FortiOS 9.8 CVE-2024-40766 CRITICAL SonicWall SonicOS 9.8 CVE-2024-21762 CRITICAL Fortinet FortiProxy 9.8 CVE-2024-21887 CRITICAL Ivanti ICS 9.1 CVE-2023-46805 HIGH Ivanti ICS 8.2 CVE-2024-21893 HIGH Ivanti ICS 8.2 CVE-2024-21412 HIGH Microsoft Windows 11 version 21H2 8.1 CVE-2024-57727 HIGH SimpleHelp SimpleHelp 7.5 CVE-2024-57728 HIGH SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. 7.2

How does prediction work?

Predicted CVEs are identified through automated correlation using multiple sources: vendor/product profiles historically targeted by the group (MITRE ATT&CK), attack chain patterns (KEV + TTPs), threat intelligence (MISP, STIX), and AI analysis. These CVEs have not been confirmed as exploited by this specific group, but have a high probability of being targets based on the actor's operational profile.

CVE-2020-2021 CRITICAL Palo Alto Networks PAN-OS predicted 10.0 CVE-2025-55182 CRITICAL Meta react-server-dom-webpack predicted 10.0 CVE-2021-44228 CRITICAL Apache Software Foundation Apache Log4j2 predicted 10.0 CVE-2025-20337 CRITICAL Cisco Identity Services Engine Software low 10.0 CVE-2026-48558 CRITICAL SimpleHelp predicted 10.0 CVE-2025-32433 CRITICAL erlang otp low 10.0 CVE-2026-20079 CRITICAL Cisco Secure Firewall Management Center (FMC) low 10.0 CVE-2026-20131 CRITICAL Cisco Secure Firewall Management Center (FMC) predicted 10.0 CVE-2025-55182 CRITICAL Meta react-server-dom-webpack low 10.0 CVE-2024-3400 CRITICAL Palo Alto Networks PAN-OS predicted 10.0 CVE-2024-57726 CRITICAL SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role. predicted 9.9 CVE-2024-57726 CRITICAL SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role. high 9.9 CVE-2024-4577 CRITICAL PHP Group PHP predicted 9.8 CVE-2020-5135 CRITICAL SonicWall SonicOS predicted 9.8 CVE-2024-53704 CRITICAL SonicWall SonicOS predicted 9.8 CVE-2024-40766 CRITICAL SonicWall SonicOS predicted 9.8 CVE-2026-35273 CRITICAL Oracle Corporation PeopleSoft Enterprise PeopleTools predicted 9.8 CVE-2023-22527 CRITICAL Atlassian Confluence Data Center low 9.8 CVE-2025-53770 CRITICAL Microsoft SharePoint Enterprise Server 2016 low 9.8 CVE-2024-4577 CRITICAL PHP Group PHP low 9.8 CVE-2024-40711 CRITICAL Veeam Backup and Recovery low 9.8 CVE-2024-0012 CRITICAL Palo Alto Networks Cloud NGFW low 9.8 CVE-2024-50603 CRITICAL Aviatrix Controller low 9.8 CVE-2023-46604 CRITICAL Apache Software Foundation Apache ActiveMQ low 9.8 CVE-2025-31324 CRITICAL SAP_SE SAP NetWeaver (Visual Composer development server) low 9.8 CVE-2025-3248 CRITICAL langflow-ai langflow low 9.8 CVE-2025-54068 CRITICAL livewire low 9.8 CVE-2025-22457 CRITICAL Ivanti Connect Secure low 9.8 CVE-2024-36401 CRITICAL geoserver low 9.8 CVE-2023-22527 CRITICAL Atlassian Confluence Data Center predicted 9.8 CVE-2023-22518 CRITICAL Atlassian Confluence Data Center predicted 9.8 CVE-2023-22515 CRITICAL Atlassian Confluence Data Center predicted 9.8 CVE-2023-46604 CRITICAL Apache Software Foundation Apache ActiveMQ predicted 9.8 CVE-2022-26501 CRITICAL Veeam Backup & Replication predicted 9.8 CVE-2024-40711 CRITICAL Veeam Backup and Recovery predicted 9.8 CVE-2025-22457 CRITICAL Ivanti Connect Secure predicted 9.8 CVE-2025-31324 CRITICAL SAP_SE SAP NetWeaver (Visual Composer development server) predicted 9.8 CVE-2024-0012 CRITICAL Palo Alto Networks Cloud NGFW predicted 9.8 CVE-2025-53770 CRITICAL Microsoft SharePoint Enterprise Server 2016 predicted 9.8 CVE-2025-3248 CRITICAL langflow-ai langflow predicted 9.8 CVE-2026-1731 CRITICAL BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA) low 9.8 CVE-2020-12812 CRITICAL Fortinet FortiOS predicted 9.8 CVE-2022-42475 CRITICAL Fortinet FortiProxy predicted 9.8 CVE-2024-21762 CRITICAL Fortinet FortiProxy predicted 9.8 CVE-2026-1731 CRITICAL BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA) predicted 9.8 CVE-2024-55591 CRITICAL Fortinet FortiOS predicted 9.8 CVE-2026-104286 CRITICAL Fortinet FortiMail predicted 9.8 CVE-2026-35273 CRITICAL Oracle Corporation PeopleSoft Enterprise PeopleTools low 9.8 CVE-2024-21887 CRITICAL Ivanti ICS predicted 9.1 CVE-2026-0257 CRITICAL Palo Alto Networks Cloud NGFW predicted 9.1 CVE-2025-42999 CRITICAL SAP_SE SAP NetWeaver (Visual Composer development server) predicted 9.1 CVE-2025-0282 CRITICAL Ivanti Connect Secure predicted 9.0 CVE-2021-45046 CRITICAL Apache Software Foundation Apache Log4j predicted 9.0 CVE-2021-45046 CRITICAL Apache Software Foundation Apache Log4j low 9.0 CVE-2026-73570 HIGH Zimbra Collaboration low 8.9 CVE-2021-34527 HIGH Microsoft Windows 10 Version 1809 predicted 8.8 CVE-2025-4428 HIGH Ivanti Endpoint Manager Mobile low 8.8 CVE-2025-33073 HIGH Microsoft Windows 10 Version 1507 low 8.8 CVE-2025-49704 HIGH Microsoft SharePoint Enterprise Server 2016 predicted 8.8 CVE-2021-22899 HIGH Ivanti Pulse Connect Secure predicted 8.8 CVE-2021-22894 HIGH Ivanti Pulse Connect Secure predicted 8.8 CVE-2022-26500 HIGH Veeam Backup & Replication predicted 8.8 CVE-2023-46805 HIGH Ivanti ICS predicted 8.2 CVE-2024-21893 HIGH Ivanti ICS predicted 8.2 CVE-2025-24472 HIGH Fortinet FortiProxy predicted 8.1 CVE-2024-21412 HIGH Microsoft Windows 11 version 21H2 predicted 8.1 CVE-2023-28252 HIGH Microsoft Windows 10 Version 1809 predicted 7.8 CVE-2022-30190 HIGH Microsoft Windows 10 Version 1809 predicted 7.8 CVE-2020-0787 HIGH Microsoft Windows predicted 7.8 CVE-2024-26169 HIGH Microsoft Windows 10 Version 1809 predicted 7.8 CVE-2022-30190 HIGH Microsoft Windows 10 Version 1809 low 7.8 CVE-2021-1675 HIGH Microsoft Windows 10 Version 1809 predicted 7.8 CVE-2023-27532 HIGH Veeam Backup & Replication predicted 7.5 CVE-2025-4427 HIGH Ivanti Endpoint Manager Mobile low 7.5 CVE-2026-1603 HIGH Ivanti Endpoint Manager predicted 7.5 CVE-2020-3259 HIGH Cisco Adaptive Security Appliance (ASA) Software predicted 7.5 CVE-2020-3259 HIGH Cisco Adaptive Security Appliance (ASA) Software low 7.5 CVE-2024-57727 HIGH SimpleHelp SimpleHelp high 7.5 CVE-2021-36942 HIGH Microsoft Windows Server 2019 predicted 7.5 CVE-2023-36884 HIGH Microsoft Windows 10 Version 1809 predicted 7.5 CVE-2025-5777 HIGH NetScaler ADC predicted 7.5 CVE-2024-57727 HIGH SimpleHelp SimpleHelp predicted 7.5 CVE-2025-5777 HIGH NetScaler ADC low 7.5 CVE-2024-9474 HIGH Palo Alto Networks Cloud NGFW predicted 7.2 CVE-2026-6973 HIGH Ivanti Endpoint Manager Mobile predicted 7.2 CVE-2020-8260 HIGH Ivanti Pulse Connect Secure predicted 7.2 CVE-2020-8243 HIGH Ivanti Pulse Connect Secure predicted 7.2 CVE-2021-22900 HIGH Ivanti Pulse Connect Secure predicted 7.2 CVE-2023-35081 HIGH Ivanti EPMM predicted 7.2 CVE-2024-8190 HIGH Ivanti CSA (Cloud Services Appliance) predicted 7.2

T1204.002 User Execution Execution T1070.004 Indicator Removal: File Deletion Defense Evasion T1562.001 Impair Defenses: Disable or Modify Tools Defense Evasion T1083 File and Directory Discovery Discovery T1486 Data Encrypted for Impact Impact