In a blog post published on Wednesday, Outpost24 clarified that it reached out to MITRE for a CVE on March 13 and the plan was to keep details of the vulnerability under wraps for 90 days to avoid malicious exploitation.

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Friday, 04-Apr-2025 21:21:28 JST Will Dormann

   in reply to

   There's this magical thinking that the CVE ID is what gives attackers the ability to compromise systems.

   If you say that your software is vulnerable but fail to assign CVEs, you're only helping the attackers.

   I remember the time that Microsoft got mad at me for "leaking" one of their CVEs to the public before the update was available. As in their world, CVE IDs were for Microsoft updates. Not for identifying vulnerabilities. 🤦♂️