# IDENT PROBE — 2026-08-07 Source audit: `ident_audit_latest.json` (generated 2026-08-06T12:29:57Z); 27 distinct tokens, 25 probed this run. Registries: CISA KEV catalogVersion 2026.08.06 (1661 entries) - NVD 2.0 - MITRE CVE Services. The audit's UNSOURCED verdict means *not present in the published record* — the packets are withheld (KNP 7.04), so the CI cannot ground the identifiers its arms forecast about. This probe closes the gap from the registry side. ABSENT is as-of the probe date; MITRE assignment is near-immediate on allocation, so absence weeks after the citing report is strong. RESERVED and RECORDED-MITRE exist because NVD lags — MITRE decides assignment, NVD corroborates. | verdict | n | tokens | |---|---|---| | TRUNCATED | 2 | CVE-2026-6, CVE-2026-63 | | REAL-EXPLOITED | 14 | CVE-2021-27137, CVE-2025-68686, CVE-2026-0770, CVE-2026-16232, CVE-2026-16812, CVE-2026-18556, CVE-2026-18577, CVE-2026-20316, CVE-2026-34486, CVE-2026-50522, CVE-2026-60137, CVE-2026-63030, CVE-2026-63077, CVE-2026-9198 | | REAL-RECORDED | 8 | CVE-2026-10702, CVE-2026-14266, CVE-2026-29059, CVE-2026-42533, CVE-2026-53264, CVE-2026-64600, CVE-2026-66066, CVE-2026-6875 | | ABSENT | 3 | CVE-2026-50523, CVE-2026-53921, CVE-2026-66067 | ## Per-token record ### CVE-2026-6 — TRUNCATED - fewer than 4 sequence digits — a truncation artifact of synthesis prose, not an identifier - first seen in synthesis: 2026-07-21 across 2 report(s) - sealed rows citing it: KKR-20260721-07 (lmstudio/auto, keyless) ### CVE-2026-63 — TRUNCATED - fewer than 4 sequence digits — a truncation artifact of synthesis prose, not an identifier - first seen in synthesis: 2026-07-21 across 1 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2021-27137 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-07-21 (DD-WRT/DD-WRT) - first seen in synthesis: 2026-07-21 across 6 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2025-68686 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-07-27 (Fortinet/FortiOS) - first seen in synthesis: 2026-07-28 across 9 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-0770 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-07-21 (Langflow/Langflow) - first seen in synthesis: 2026-07-21 across 6 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-16232 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-07-22 (Check Point/SmartConsole) - first seen in synthesis: 2026-07-23 across 2 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-16812 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-07-27 (Arista/VeloCloud Orchestrator) - first seen in synthesis: 2026-07-28 across 9 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-18556 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-08-04 (N-able/N-central) - first seen in synthesis: 2026-08-05 across 1 report(s) - sealed rows citing it: KKR-20260804-59 (manual/opus-5/unattested, undetermined) ### CVE-2026-18577 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-08-03 (N-able/N-central) - first seen in synthesis: 2026-08-03 across 5 report(s) - sealed rows citing it: KKR-20260804-02 (lmstudio/auto, keyless); KKR-20260804-10 (control/baserate, keyed); KKR-20260804-49 (lmstudio/auto, undetermined); KKR-20260804-59 (manual/opus-5/unattested, undetermined); KKR-20260804-64 (manual/sonnet-5/unattested, undetermined) ### CVE-2026-20316 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-07-29 (Cisco/Secure Firewall Management Center (FMC)) - first seen in synthesis: 2026-07-30 across 1 report(s) - sealed rows citing it: KKR-20260730-05 (manual/fable-5, keyless); KKR-20260730-15 (manual/opus-5, keyed); KKR-20260730-25 (manual/sonnet-5, keyed) ### CVE-2026-34486 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-08-04 (Apache/Tomcat) - first seen in synthesis: 2026-08-05 across 1 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-50522 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-07-22 (Microsoft/SharePoint) - first seen in synthesis: 2026-07-22 across 3 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-60137 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-07-21 (WordPress/Core) - first seen in synthesis: 2026-07-21 across 6 report(s) - sealed rows citing it: KKR-20260721-04 (lmstudio/auto, keyed) ### CVE-2026-63030 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-07-21 (WordPress/Core) - first seen in synthesis: 2026-07-21 across 6 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-63077 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-08-05 (JetBrains/TeamCity) - first seen in synthesis: 2026-07-28 across 2 report(s) - sealed rows citing it: KKR-20260806-32 (lmstudio/auto, undetermined) ### CVE-2026-9198 — REAL-EXPLOITED - CISA KEV entry, dateAdded 2026-08-04 (IBM/Langflow) - first seen in synthesis: 2026-08-05 across 1 report(s) - sealed rows citing it: KKR-20260805-01 (lmstudio/auto, undetermined) ### CVE-2026-10702 — REAL-RECORDED - NVD record, published 2026-06-02, status Modified - first seen in synthesis: 2026-07-29 across 1 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-14266 — REAL-RECORDED - NVD record, published 2026-07-29, status Awaiting Analysis - first seen in synthesis: 2026-07-20 across 4 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-29059 — REAL-RECORDED - NVD record, published 2026-03-06, status Analyzed - first seen in synthesis: 2026-07-22 across 1 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-42533 — REAL-RECORDED - NVD record, published 2026-07-15, status Undergoing Analysis - first seen in synthesis: 2026-07-20 across 1 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-53264 — REAL-RECORDED - NVD record, published 2026-06-25, status Modified - first seen in synthesis: 2026-07-28 across 1 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-64600 — REAL-RECORDED - NVD record, published 2026-07-23, status Awaiting Analysis - first seen in synthesis: 2026-07-23 across 1 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-66066 — REAL-RECORDED - NVD record, published 2026-07-30, status Received - first seen in synthesis: 2026-07-30 across 1 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-6875 — REAL-RECORDED - NVD record, published 2026-07-13, status Awaiting Analysis - first seen in synthesis: 2026-07-20 across 5 report(s) - sealed rows citing it: KKR-20260720-20 (lmstudio/auto, keyless) ### CVE-2026-50523 — ABSENT - no record at MITRE (the issuing authority) and none at NVD — the ID was never assigned; likely-confabulated as of the probe date - first seen in synthesis: 2026-07-21 across 1 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-53921 — ABSENT - no record at MITRE (the issuing authority) and none at NVD — the ID was never assigned; likely-confabulated as of the probe date - first seen in synthesis: 2026-07-28 across 2 report(s) - reaches no sealed row (synthesis prose only) ### CVE-2026-66067 — ABSENT - no record at MITRE (the issuing authority) and none at NVD — the ID was never assigned; likely-confabulated as of the probe date - first seen in synthesis: 2026-07-30 across 1 report(s) - reaches no sealed row (synthesis prose only) ## The elicitation finding (data summary; DRAFT tier) 3 of 25 probed identifiers were never assigned by the issuing authority. Machine-drafted synthesis prose cited CVE identifiers that do not exist, and 0 of them reached sealed forecast rows. This is a measured property of the elicitation pipeline, printed rather than tidied. Sealed rows stand; the finding enters the record as a new entry. Probe evidence: `evidence/ident_probe_2026-08-07_0335.json` (withheld per the KK23 evidence ruling, available on analyst query).