Add vpatch-CVE-2026-1603 rule and test#1770
Add vpatch-CVE-2026-1603 rule and test#1770crowdsec-automation wants to merge 6 commits intomasterfrom
Conversation
|
Hello @crowdsec-automation and thank you for your contribution! ❗ It seems that the following scenarios are not part of the 'crowdsecurity/appsec-virtual-patching' collection: 🔴 crowdsecurity/vpatch-CVE-2026-1603 🔴 |
|
Hello @crowdsec-automation and thank you for your contribution! I'm a bot that helps maintainers to validate scenarios and ensure they include all the required information. The following items have errors: crowdsecurity/crs-exclusion-plugin-cpanel:
crowdsecurity/crs-exclusion-plugin-dokuwiki:
crowdsecurity/crs-exclusion-plugin-drupal:
crowdsecurity/crs-exclusion-plugin-nextcloud:
crowdsecurity/crs-exclusion-plugin-phpbb:
crowdsecurity/crs-exclusion-plugin-phpmyadmin:
crowdsecurity/crs-exclusion-plugin-wordpress:
crowdsecurity/crs-exclusion-plugin-xenforo:
Mitre ATT&CKInformation about mitre attack can be found here.
Expected format is (where labels:
classification:
- attack.TXXXXCVEsIf your scenario covers a specific CVE (Common Vulnerabilities and Exposures), please add it. Expected format is (where labels:
classification:
- cve.CVE-XXX-XXXBehaviorsPlease identify the behavior(s) your scenario is targeting. You can find the list of available behaviors here. Expected format is (where labels:
behavior: <behavior>See the labels documentation for more information. |
|
Hello @buixor and thank you for your contribution! ❗ It seems that the following scenarios are not part of the 'crowdsecurity/appsec-virtual-patching' collection: 🔴 crowdsecurity/vpatch-CVE-2023-6623 🔴 |
|
Hello @buixor and thank you for your contribution! I'm a bot that helps maintainers to validate scenarios and ensure they include all the required information. The following items have errors: crowdsecurity/crs-exclusion-plugin-cpanel:
crowdsecurity/crs-exclusion-plugin-dokuwiki:
crowdsecurity/crs-exclusion-plugin-drupal:
crowdsecurity/crs-exclusion-plugin-nextcloud:
crowdsecurity/crs-exclusion-plugin-phpbb:
crowdsecurity/crs-exclusion-plugin-phpmyadmin:
crowdsecurity/crs-exclusion-plugin-wordpress:
crowdsecurity/crs-exclusion-plugin-xenforo:
Mitre ATT&CKInformation about mitre attack can be found here.
Expected format is (where labels:
classification:
- attack.TXXXXCVEsIf your scenario covers a specific CVE (Common Vulnerabilities and Exposures), please add it. Expected format is (where labels:
classification:
- cve.CVE-XXX-XXXBehaviorsPlease identify the behavior(s) your scenario is targeting. You can find the list of available behaviors here. Expected format is (where labels:
behavior: <behavior>See the labels documentation for more information. |
|
Hello @buixor and thank you for your contribution! ❗ It seems that the following scenarios are not part of the 'crowdsecurity/appsec-virtual-patching' collection: 🔴 crowdsecurity/vpatch-CVE-2023-6623 🔴 |
|
Hello @buixor and thank you for your contribution! I'm a bot that helps maintainers to validate scenarios and ensure they include all the required information. The following items have errors: crowdsecurity/crs-exclusion-plugin-cpanel:
crowdsecurity/crs-exclusion-plugin-dokuwiki:
crowdsecurity/crs-exclusion-plugin-drupal:
crowdsecurity/crs-exclusion-plugin-nextcloud:
crowdsecurity/crs-exclusion-plugin-phpbb:
crowdsecurity/crs-exclusion-plugin-phpmyadmin:
crowdsecurity/crs-exclusion-plugin-wordpress:
crowdsecurity/crs-exclusion-plugin-xenforo:
Mitre ATT&CKInformation about mitre attack can be found here.
Expected format is (where labels:
classification:
- attack.TXXXXCVEsIf your scenario covers a specific CVE (Common Vulnerabilities and Exposures), please add it. Expected format is (where labels:
classification:
- cve.CVE-XXX-XXXBehaviorsPlease identify the behavior(s) your scenario is targeting. You can find the list of available behaviors here. Expected format is (where labels:
behavior: <behavior>See the labels documentation for more information. |
2 participants
This rule detects attempts to exploit the authentication bypass vulnerability in Ivanti Endpoint Manager (CVE-2026-1603). The detection focuses on POST requests to the
/RemoteControlAuth/api/Authendpoint with a JSON body containing"logintype":"64", which is the key indicator of the exploit as shown in the nuclei template. Thezonesare set toURI(with a lowercase transform and contains match for the endpoint) andRAW_BODY(with lowercase transform and contains match for the specific logintype value). This approach ensures the rule is case-insensitive and targets only the relevant exploit vector, minimizing false positives. No variable-specific matching is needed since the exploit is based on a fixed JSON structure. All values are lowercase, and the rule usescontainsfor robust matching.