U.S. Securities and Exchange Commission (SEC) Material Cybersecurity Incidents (Item 1.05) is affected by SEC-8K-ITEM105, rated 8.5 (high). No in-the-wild exploitation has been confirmed in the CISA KEV catalog at the time of writing.
What the flaw is
The NIST National Vulnerability Database describes it as follows:
A multi-agency analysis of recent SEC 8-K filings reveals how threat actors leverage compromised cloud credentials and unsecured data lakes to exfiltrate millions of sensitive PII records within 48 hours.
At a glance
| Field | Detail |
|---|---|
| CVE | SEC-8K-ITEM105 |
| Affected product | U.S. Securities and Exchange Commission (SEC) Material Cybersecurity Incidents (Item 1.05) |
| CVSS | 8.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
What defenders should do
- Patch: apply the fixed release from U.S. Securities and Exchange Commission (SEC); check the vendor advisory linked below for the exact versions.
- Inventory: identify every instance of U.S. Securities and Exchange Commission (SEC) Material Cybersecurity Incidents (Item 1.05), prioritising internet-facing ones.
