[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLCm49RIWXuraVCR8I5iE11J1xiteK-naM2BX-9xnpjI":3,"$fdHGa9u-rcukTM6b57jqqaXksWphD6iHKNXxUAp91YXc":64},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":61,"created_at":62,"updated_at":63,"published_at":49},"palo-alto-unit-42-s-nova-ai-finds-14-090-oss-vulnerabilities-in-two-months","Palo Alto Unit 42's NOVA AI Finds 14,090 OSS Vulnerabilities in Two Months","Autonomous agentic system analyzed 3,915 open-source projects, finding 14,090 confirmed vulns — 99.4% previously unreported, 40% high\u002Fcritical.","Palo Alto Networks Unit 42 released NOVA, an autonomous AI-driven vulnerability discovery system that analyzed 3,915 OSS projects in two months and confirmed 14,090 vulnerabilities, 99.4% of which were previously unreported and 40% rated high or critical.",[10,11,12,13,14,15],"Palo Alto Networks","Unit 42","NOVA","AI vulnerability discovery","open-source","agentic AI","# Palo Alto Unit 42's NOVA AI Finds 14,090 OSS Vulnerabilities in Two Months\n\n*Autonomous agentic system analyzed 3,915 open-source projects, finding 14,090 confirmed vulns — 99.4% previously unreported, 40% high\u002Fcritical.*\n\n**Tags:** `Palo Alto Networks` `Unit 42` `NOVA` `AI vulnerability discovery` `open-source` `agentic AI`\n\n> Palo Alto Networks Unit 42 released NOVA, an autonomous AI-driven vulnerability discovery system that analyzed 3,915 OSS projects in two months and confirmed 14,090 vulnerabilities, 99.4% of which were previously unreported and 40% rated high or critical.\n\n---\n\n## What happened\n\nPalo Alto Networks Unit 42 has disclosed a new autonomous vulnerability discovery system it calls NOVA, or Network and Open-Source Vulnerability Analyzer. The agentic research system uses proprietary AI harnesses powered by multiple leading frontier AI models to find, validate, and report vulnerabilities in open-source software without a human in the loop until final review.\n\nIn two months, NOVA analyzed 3,915 open-source projects and confirmed 14,090 vulnerabilities. Unit 42 says 99.4% of the findings were previously unreported, and 40% are rated high or critical severity. The team also identified three CVEs: CVE-2025-40947, CVE-2025-40948, and CVE-2026-0257, covering PAN-OS and ROX II.\n\nFor each project, NOVA reviewed the project history, read the source code, identified vulnerability candidates, created a working proof of concept, and performed deterministic validation. Unit 42 notes that under CVSS 3.1, 4,030 findings (28.6%) scored High or Critical, while under CVSS 4.0, 5,600 findings (39.7%) hit that threshold.\n\n## Technical details\n\nNOVA operates as a fully autonomous agentic system that processes each target through five sequential stages: project history review, source code reading, vulnerability candidate identification, working proof-of-concept generation, and deterministic validation. No human intervenes until final review, at which point the team confirms the PoC and assigns a CVE.\n\nThe three disclosed CVEs cover two distinct targets. CVE-2025-40947 and CVE-2025-40948 affect PAN-OS, while CVE-2026-0257 hits ROX II. Unit 42 did not publish a separate CVSS vector or EPSS score for any of the three in this disclosure; the 14,090 confirmed findings are scored under both CVSS 3.1 and 4.0, with 4,030 (28.6%) and 5,600 (39.7%) landing at High or Critical respectively.\n\nThe vulnerability mix skews toward memory and calculation bugs. In Unit 42's taxonomy, memory and calculation issues account for 557 findings (4.0% of the total), with resource-management and denial-of-service issues making up the remainder. That is a meaningful step beyond prior automated scanners, which typically surface a long tail of low-impact issues.\n\n## Who is affected\n\nThe three disclosed CVEs cover two distinct targets: PAN-OS (CVE-2025-40947 and CVE-2025-40948) and ROX II (CVE-2026-0257). Unit 42 did not publish a separate CVSS vector or EPSS score for any of the three in this disclosure; the 14,090 confirmed findings are scored under both CVSS 3.1 and 4.0, with 4,030 (28.6%) and 5,600 (39.7%) landing at High or Critical respectively.\n\nThe vulnerability mix skews toward memory and calculation bugs. In Unit 42's taxonomy, memory and calculation issues account for 557 findings (4.0% of the total), with resource-management and denial-of-service issues making up the remainder. That is a meaningful step beyond prior automated scanners, which typically surface a long tail of low-impact issues.\n\n## What to do\n\nPalo Alto Networks recommends that organizations apply the three disclosed CVEs to PAN-OS and ROX II as soon as vendor patches land, then verify the fix against the provided proof-of-concept. For PAN-OS, deploy the updated build and confirm the CVE-2025-40947 and CVE-2025-40948 fixes; for ROX II, apply the patch covering CVE-2026-0257. Unit 42 did not publish a separate CVSS vector or EPSS score for any of the three in this disclosure, so treat the 14,090 confirmed findings as the primary severity signal — 4,030 (28.6%) score High or Critical under CVSS 3.1, and 5,600 (39.7%) under CVSS 4.0.\n\nFor detection, add the three CVE IDs to your scanner or SCA pipeline and watch for the PoC execution pattern. The vulnerability mix skews toward memory and calculation bugs — 557 findings (4.0% of the total) in Unit 42's taxonomy — with resource-management and denial-of-service issues making up the remainder. That is a meaningful step beyond prior automated scanners, which typically surface a long tail of low-impact issues.\n\nPalo Alto Networks recommends that organizations deploy relevant best practices, including vulnerability management, zero-trust network architecture, software supply chain security, and other attack surface reduction best practices. The patch window has collapsed: when vulnerability discovery accelerates, the time between disclosure and potential exploitation shrinks dramatically, and attackers need not have a full RCE to start probing.\n\n## Key points\n\n- NOVA is a fully autonomous agentic system that reviews project history, reads source code, identifies candidates, generates a working PoC, and deterministically validates each vulnerability without a human in the loop until final review.\n- In two months, NOVA analyzed 3,915 OSS projects and confirmed 14,090 vulnerabilities: 99.4% previously unreported, 40% high\u002Fcritical severity.\n- Under CVSS 3.1, 4,030 findings (28.6%) scored High\u002FCritical; under CVSS 4.0, 5,600 findings (39.7%) scored High\u002FCritical.\n- Memory and calculation issues — the closest prior-automation category — accounted for only 557 findings (4.0%), showing NOVA goes deeper than previous automated scanners.\n- Unit 42 says the patch window has collapsed: the time between disclosure and exploitation shrks dramatically, and attackers no longer need to be human to find and exploit these bugs.\n\n## Further reading & sources\n\n- [The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software](https:\u002F\u002Funit42.paloaltonetworks.com\u002Ffrontier-ai-vulnerability-burst) — PaloAlto Networks Unit 42\n- [John 11 NIV - The Death of Lazarus - Now a man named - Bible Gateway](https:\u002F\u002Fwww.biblegateway.com\u002Fpassage\u002F?search=john%2011&version=NIV)\n- [Wiz’s First 6 Months as Part of Google | Assaf Rappaport | Wiz Blog](https:\u002F\u002Fwww.wiz.io\u002Fblog\u002F6-months-google)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-s-nova-ai-finds-14-090-oss-vulnerabilities-in-two-months.png?v=e55edd825a",{"cves":19,"actors":44,"timeline":50,"technologies":55},[20,29,36],{"id":21,"kev":22,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},"CVE-2025-40947",false,"\u002Fvulnerabilities\u002FCVE-2025-40947",7.5,0.0054,"Medium",47.17,"3.1",{"id":30,"kev":22,"poc":22,"url":31,"cvss":32,"epss":33,"risk_band":34,"risk_score":35,"cvss_version":28},"CVE-2025-40948","\u002Fvulnerabilities\u002FCVE-2025-40948",6.8,0.004,"Low",25.49,{"id":37,"kev":38,"poc":38,"url":39,"cvss":40,"epss":41,"risk_band":42,"risk_score":43,"cvss_version":28},"CVE-2026-0257",true,"\u002Fvulnerabilities\u002FCVE-2026-0257",9.1,0.969,"Critical",89.49,[45],{"url":46,"name":47,"slug":47,"type":48,"origin":49,"motivation":49},"\u002Fthreat-groups\u002Fnova","nova","ransomware",null,[51],{"date":52,"event":53,"description":54},"2026-08-04","Publication","Palo Alto Networks publishes NOVA research",[56,58],{"vendor":10,"product":57},"PAN-OS",{"vendor":59,"product":60},"Siemens","ROX II","vulnerability_disclosure","2026-08-27T12:08:58.15841+00:00","2026-10-16T12:29:15.102621+00:00",{"articles":65},[66,77,90,103],{"slug":67,"title":68,"summary":69,"tags":70,"hero_image_url":75,"story_type":61,"created_at":76},"palo-alto-networks-unit-42-discloses-pass-the-passkey-attack-against-google-s-sy","Palo Alto Networks Unit 42 Discloses 'Pass the Passkey' Attack Against Google's Synced Passkey Ecosystem","Palo Alto Networks Unit 42 has identified a new 'Pass the Passkey' attack class that targets Google's synced passkey ecosystem, enabling malware to authenticate as the user, bypass user verification, and extract all synced passkey private keys.",[10,11,71,72,73,74],"Passkey","Google","Passwordless","CVE-2022-38028","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-networks-unit-42-discloses-pass-the-passkey-attack-against-google-s-sy.png?v=12818dadac","2026-08-27T12:05:41.581419+00:00",{"slug":78,"title":79,"summary":80,"tags":81,"hero_image_url":88,"story_type":61,"created_at":89},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[82,83,84,85,86,87],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00",{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":101,"story_type":61,"created_at":102},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[95,96,97,98,99,100],"windows","shell-link","zero-day","ZDI","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00",{"slug":104,"title":105,"summary":106,"tags":107,"hero_image_url":113,"story_type":61,"created_at":114},"head-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog","Head Mare Exploits Three Zero-Days to Trojanize TrueConf, Atlassian Rovo, and Progress LoadMaster","The Head Mare APT group is actively exploiting three zero-day vulnerabilities in Atlassian Rovo, Progress LoadMaster, and Metabase, with Progress LoadMaster CVE-2026-8037 now on CISA KEV after 792 observed exploitation attempts.",[108,97,109,110,111,112],"Head Mare","Atlassian Rovo","Progress LoadMaster","Metabase","CVE-2026-8037","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog.png?v=48acc20ab2","2026-09-22T12:04:22.141581+00:00"]