Nothing to Exploit

A CVE tied to one autonomous system, a corpus that cannot answer the question, and a nine-year-old bug that still works

TI-2026-103I · Series: The Loud Hour · Letter I of 15 Operates under the rules of evidence in Letter O — The Instrument. This letter reports its own assigned question as largely unanswerable, and the controls that establish why. That is the finding.

Updated 2026-07-30. §10's disjointness question is closed by Letter J, and the answer is no — 1,751 addresses appear on both sensors. This letter's own suspicion about testing at the extremes was correct. Original text unaltered.

1. What this letter was for, and what happened to it

The series plan assigned this letter the CVE dimension: which vulnerabilities attach to the burst actors, whether any burst carried exploitation, and how reputation-feed CVE tagging compares with observed behaviour.

Letter G supplied the specific hook. GreyNoise Labs assessed AS51852 Private Layer INC — operator of 179.43.139.58, the largest beacon in the corpus — as purpose-built attack infrastructure exclusively exploiting CVE-2026-1281. Letter G declined to bridge that to the beacon, noting they were "two facts about the same autonomous system, not two facts about the same machine," and handed the test here.

The test was run. The first result looked like a headline: zero CVE associations for every principal actor, and zero activity for CVE-2026-1281 across the whole corpus.

Then the control was run, and the headline evaporated. The absence was not in the world. It was in the database.

What follows is the corrected version: a much narrower set of things this corpus can actually say about vulnerabilities, one genuine and surprising finding from the vector that does work, and a structural limit that applies to every honeypot everywhere.

2. The CVE in question

[DOCUMENTED] CVE-2026-1281 is real and serious:

[DOCUMENTED] This is a maximum-severity, unauthenticated RCE in an enterprise mobile-device management product, on the CISA Known Exploited Vulnerabilities list.

And here is the first thing worth noticing, before any query: CVE-2026-1281 is an HTTP vulnerability in an Ivanti web application. The sensor at the centre of this series is a Cowrie SSH honeypot. It emulates a shell. It does not emulate Ivanti EPMM, does not serve HTTP, and cannot present the vulnerable surface.

[INFERRED — confidence HIGH] No SSH honeypot can observe an Ivanti exploit. Whatever 179.43.139.58 does with CVE-2026-1281 elsewhere, this sensor was never in a position to see it. That is a fact about the instrument's shape, and it constrains everything below.

3. The result that looked like a finding

[DOCUMENTED] CVE profiles for the three most prolific actors in the corpus:

[DOCUMENTED] And for the CVE itself, across the SSH corpus: vulnerable_ips_total: 0, targeting_ips_total: 0, samples_total: 0.

The posture / offensive distinction these tools draw is the right one, and worth stating because it is routinely collapsed in threat reporting. Posture is what could be exploited on an address, derived from its own service banners. Offensive is what an address throws at others. They are opposites, and an address can carry both. Neither carried either.

Read naively, that is a strong result: the most persistent attackers in a four-month record have no vulnerability relationship of any kind, in either direction.

4. D13 — the control, and why the result was worthless

Status: RESOLVED. The finding it would have supported is withdrawn before publication.

[DOCUMENTED] The control: CVE-2021-44228 — Log4Shell. Apache Log4j2 JNDI injection, CVSS 10.0, CISA KEV, the most widely exploited vulnerability of the decade, present in effectively every scanning toolkit since December 2021.

Its profile in this corpus:

vulnerable_ips_total :  0
targeting_ips_total  :  0

[DOCUMENTED] Zero, across 16,137 tracked addresses, for Log4Shell.

[INFERRED — confidence HIGH] The SSH corpus's IP-to-CVE linkage is not sparse. It is unpopulated. A dataset that records no address as vulnerable to or targeting Log4Shell is not describing the internet; it is describing a table nobody filled in. Every "zero" in §3 is therefore uninformative, and the finding those zeros would have supported does not exist.

Rule R16. Before reporting any absence from a CVE, campaign, cluster or enrichment linkage, run a saturation control — query the value most certain to be present. If the control is also empty, the linkage is unpopulated and no absence claim can be made from it.

The second defect: inference wearing the clothes of observation

[DOCUMENTED] One part of the CVE layer is populated — sample-to-exploit associations — and it is populated by semantic similarity rather than analysis. Log4Shell returns 7 samples. The exploit list attached to one of them:

[DOCUMENTED] Every entry carries the flag "cve_inferred": true. The scores span 0.627–0.644 — a range of 0.017 — across vulnerabilities from 2006 to 2026 in entirely unrelated products. And six different samples return the identical list with identical scores.

[INFERRED — confidence HIGH] This is a vector-similarity match between a shell script and a library of exploit documents, not evidence that the sample exploits anything. The near-identical scores across two decades of unrelated CVEs are the signature of a generic document matching other generic documents. The pipeline is honest about this — cve_inferred: true says exactly what it is — but a consumer reading the field as "this malware exploits Log4Shell" would be wrong, and the flag is easy to miss.

Rule R17. A CVE association carrying cve_inferred: true is a similarity score, not an observation, and is never cited as evidence that a sample or actor uses that vulnerability.

5. The vector that does work

[DOCUMENTED] The same operator runs a second sensor — an HTTP-facing web-threat pipeline that correlates request paths to CVEs. Its saturation control returns a completely different picture.

CVE-2017-9841 — PHPUnit eval-stdin.php remote code execution:

10 IPs   ·   70,266 hits

(Targets are this operator's public web properties; the bare host address is withheld under TLP:WHITE.)

[DOCUMENTED] The web vector's CVE correlation is well populated. An absence measured there is a real absence.

And measured there:

[DOCUMENTED] CVE-2026-1281 has zero actors and zero hits on the vector capable of observing it. So does Log4Shell.

[INFERRED — confidence MEDIUM-HIGH] For CVE-2026-1281 this is now a meaningful negative, with one qualification: an Ivanti EPMM exploit aimed at a host that does not run Ivanti EPMM may never be attempted, because scanners fingerprint before firing. The absence is consistent both with "nobody threw it here" and with "nobody had reason to."

6. Scanners hunt old bugs, not famous ones

The control produced an unplanned finding, and it is the most useful thing in this letter.

[DOCUMENTED] CVE-2017-9841 is nine years old — a PHPUnit development-dependency exposure, long patched, requiring a vendor/ directory to have been deployed to a web root. It draws 70,266 hits from 10 addresses, one of them 26,806 hits across 26 distinct paths in a single day.

[DOCUMENTED] CVE-2021-44228 has a CVSS of 10.0, is on the KEV list, and drew the largest coordinated patching effort in recent memory. It draws zero.

[INFERRED — confidence HIGH] Commodity scanning is not organised around severity, novelty or fame. It is organised around reliability per unit cost. PHPUnit eval-stdin.php is a single unauthenticated GET or POST to a fixed path that either works or does not, needs no callback infrastructure, and still finds unpatched deployments nine years on. Log4Shell requires a JNDI listener, an outbound path from the target, and a vulnerable logging call in the request path — more moving parts, more infrastructure, and a target population that has largely been fixed.

A KEV listing measures how much damage a vulnerability did. It does not predict what will arrive at your address. The traffic here is shaped by what is cheap to attempt, and the cheapest thing is a nine-year-old path that costs one request to test.

[DOCUMENTED] The behavioural shape supports this. 209.182.216.63 tried 26 distinct paths in one day; 103.59.160.93 tried one path 3,277 times. Both are path-enumeration strategies against a fixed exploit, not adaptive exploitation.

7. The Private Layer question, closed

[DOCUMENTED] Assembling the record:

• GreyNoise assesses AS51852 as exclusively exploiting CVE-2026-1281 (Letter G).
• 179.43.139.58, on AS51852, is the largest beacon in this corpus: 8,463 sessions, 8,412 successful logins, zero commands, zero downloads (Letter B).
• CVE-2026-1281 is an HTTP vulnerability in Ivanti EPMM; the beacon's sensor is SSH-only.
• On the operator's HTTP vector, which can observe such traffic, CVE-2026-1281 has zero actors and zero hits.
• The SSH corpus's CVE linkage is unpopulated and cannot speak either way (§4).

[DOCUMENTED] There is no evidence in this corpus connecting 179.43.139.58 to CVE-2026-1281, and Letter G's refusal to bridge the ASN finding to the machine is upheld on direct test rather than on caution alone.

[INFERRED — confidence HIGH] The two facts are compatible without being connected. Letter H established that a bulletproof ASN is a multi-tenant platform: AS197170 carries an inventory fleet, a wallet thief and a marker-leaving third party simultaneously. AS51852 is the same kind of object. One tenant may weaponise an Ivanti RCE while another runs a mute credential beacon, and they share nothing but a routing table.

This is the third time in the series that ASN-level attribution has had to be pulled apart from machine-level behaviour. It should be treated as the default expectation for this class of infrastructure, not as a caveat.

8. What a honeypot can and cannot say about vulnerabilities

[DOCUMENTED] A structural limit, stated plainly because it bears on how this whole series should be read.

An SSH honeypot observes credential attacks and post-authentication behaviour. It does not observe vulnerability exploitation, because it presents no vulnerable product surface — only an emulated shell reached by password. Every finding in Letters A through F concerns who knocked, with what credential, and what they typed afterwards. None of it is capable of speaking to exploitation, and none of it does.

[INFERRED — confidence HIGH] This explains a pattern that has recurred throughout the series without being named: the corpus is dominated by credential-based activity — beacons, wordlists, uname calls, key installation — because that is the only kind of activity the sensor can be reached by. The 76 malware samples arrived through opened SSH sessions, not through exploits.

The absence of exploitation in this record is a property of the sensor, not a property of the internet. The operator's HTTP vector, running in parallel, records 70,266 exploit attempts against a single 2017 CVE. Both are true simultaneously, and reporting either alone would misdescribe the environment.

The two populations do not overlap

§10 of an earlier draft deferred this as a question for Letter J. It is cheap enough to answer here, and the answer is clean in both directions.

[DOCUMENTED] Forward test — does the largest web exploiter appear in the SSH corpus?

[DOCUMENTED] Reverse test — do the SSH principals throw web exploits?

[DOCUMENTED] The single most prolific exploiter on the web vector has never touched the SSH sensor. The two most prolific actors on the SSH sensor have never thrown a recognised exploit at the web vector.

[INFERRED — confidence MEDIUM-HIGH] These are disjoint populations pursuing different business. The web exploiters hunt unpatched web applications with one-request payloads; the SSH beacons and the inventory fleet hunt credentials and compute. They arrive at the same operator's address space within days of each other and share no addresses, no method and no apparent purpose.

The reverse test carries a caveat that must be stated: wt_ip_cves measures CVE-correlated web activity, not web presence generally. An address could reach the web vector without matching any exploit-path signature and would show zero here. The forward test has no such weakness — a honeypot session either exists or does not — so the disjointness is established firmly in one direction and indicatively in the other.

[INFERRED — confidence MEDIUM] This bears directly on how multi-sensor threat data should be read. An operator running both sensors could reasonably assume they observe one adversary population from two angles. They do not. They observe two populations that happen to share a target, and any aggregate statistic computed across both — total attacker count, dominant country, mean threat score — describes a union of unrelated things.

9. What this letter establishes

1. [DOCUMENTED] CVE-2026-1281 is Ivanti EPMM code injection, CWE-94, CVSS 9.8, CISA KEV — an HTTP vulnerability, on a sensor that speaks only SSH.
2. [DOCUMENTED] All three principal actors return zero posture CVEs, zero offensive CVEs and zero sample references.
3. [DOCUMENTED] D13 — that result is worthless. The Log4Shell control returns zero vulnerable and zero targeting addresses across 16,137 tracked IPs. The SSH corpus's IP-to-CVE linkage is unpopulated, and no absence claim can be made from it.
4. [DOCUMENTED] Sample-to-CVE associations are semantic-similarity inferences flagged cve_inferred: true, scoring 0.627–0.644 across CVEs from 2006 to 2026, with six samples returning identical lists.
5. [DOCUMENTED] The web vector's CVE correlation is well populated — 70,266 hits for one CVE — so absences measured there are real.
6. [DOCUMENTED] On that vector, CVE-2026-1281 has zero actors and zero hits, and so does Log4Shell, while a nine-year-old PHPUnit RCE draws 70,266 hits from 10 addresses.
7. [INFERRED] Commodity scanning is organised around reliability per unit cost, not severity or fame. A KEV listing does not predict arrival.
8. [DOCUMENTED] No evidence connects 179.43.139.58 to CVE-2026-1281. Letter G's refusal to bridge ASN to machine is upheld on test.

10. What this letter could not establish

• Whether the beacons or the fleet exploit anything anywhere. This corpus cannot see it, and saying so is the honest limit. GreyNoise's assessment of AS51852 stands on its own evidence, not on anything here.
• Why the SSH corpus's CVE linkage is unpopulated. Whether the enrichment stage is disabled, failing silently, or was never wired is not established, and it is a maintenance question worth answering: the tables and endpoints exist and return well-formed empty results, which is the most misleading possible failure mode.
• Whether CVE-2026-1281's absence on the web vector means it was never thrown, or thrown and not recognised. Path-based CVE correlation only matches known signatures; a novel exploit path would not be attributed.
• Whether the disjointness in §8 holds corpus-wide. Two forward and two reverse tests is not a census. Letter J should measure the overlap across all 16,137 tracked addresses rather than at the extremes, where it is most likely to hold by construction.

✅ CLOSED — Letter J measured it, and the answer is no. The same_ip_web_and_ssh relation holds 1,751 links — addresses present in both the web-threat and SSH corpora. **§8's disjointness is true at the extremes tested here and false across the corpus.** This item's own suspicion — that the extremes were where it was "most likely to hold by construction" — was right, and it took one query on the full relation to confirm. The finding is bounded: Letter J documents the count but has not enumerated which 1,751 addresses they are or which population each belongs to, so nothing here reassigns any specific actor across vectors. What falls is the general claim, not the specific tests.

• Whether any of the 76 malware samples genuinely references a CVE. Rule R17 disqualifies the inferred associations, and no manually verified association exists.

The second point deserves emphasis. An empty table that returns total: 0 with a valid schema is worse than an error, because it reads as an answer. This series has now found the same failure shape five times — a silently clamped parameter, two sweep-artefact date fields, an HTML-escaped filter returning zero, and now an unpopulated linkage — and in every case the instrument reported success while saying nothing. The saturation control in R16 is the general remedy, and it should have been standing practice from Letter A.

Next: Letter J — The Graph. A hundred and thirteen machines sharing one key, and what the entity graph does with them.