Notifications
Clear all
Topic starter
19/08/2026 3:41 pm
TL;DR: Publicly disclosed vulnerabilities can remain invisible to teams that depend only on the National Vulnerability Database, while attackers monitor the same disclosure channels for early exploitation, according to Intruder. The result is a shrinking remediation window that forces vulnerability management to treat disclosure streams, not NVD alone, as the operational source of truth.
NHIMG editorial — based on content published by Intruder: Ghost CVEs and the gap between disclosure and NVD publication
By the numbers:
- The GhostCVEs repository had only 14 stars on GitHub at the time of writing.
Questions worth separating out
Q: How should vulnerability teams respond before a CVE appears in NVD?
A: Teams should treat public disclosure channels as the first alert, not NVD.
Q: Why is NVD alone not enough for vulnerability prioritisation?
A: NVD is authoritative, but it is not instantaneous.
Q: What breaks when disclosure monitoring is missing from vulnerability management?
A: Teams lose the earliest chance to correlate a newly disclosed weakness with their own footprint.
Practitioner guidance
- Track disclosure sources before NVD publication Monitor vendor advisories, CNA notices, GitHub commits, and mailing lists so newly disclosed CVEs enter triage before the catalogue catches up.
- Map disclosure alerts to identity-sensitive assets Tag internet-facing systems, credential stores, and services that handle API keys or service accounts so they are prioritised first when a Ghost CVE appears.
- Create a disclosure-to-remediation SLA Set a response target from public disclosure to risk decision, patch, or compensating control, then measure whether teams meet that target consistently.
What's in the full article
Intruder's full research covers the operational detail this post intentionally leaves for the source:
- A practical view of how Ghost CVEs fit into Intruder's Rapid Response workflow
- The specific example of CVE-2026-24512 and how early disclosure changed remediation timing
- Why the team argues that vulnerability visibility should start before NVD enrichment
- How early warning can be turned into faster customer protection decisions
👉 Read Intruder's analysis of Ghost CVEs and the NVD delay problem →
Ghost CVEs: what should vulnerability teams do before NVD catches up?
Explore further
19/08/2026 4:20 pm
Ghost CVEs expose a governance failure in dependency on delayed vulnerability catalogues. Security teams often treat NVD completeness as if it were contemporaneous with disclosure, but the article shows that assumption is wrong. The practical issue is not catalogue quality alone. It is the governance gap between public disclosure and internal action, which leaves organisations blind during the most dangerous part of the lifecycle. Practitioners should treat disclosure-time visibility as a control objective, not a nice-to-have.
A few things that frame the scale:
- The GhostCVEs repository had only 14 stars on GitHub at the time of writing, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
A question worth separating out:
Q: How do organisations reduce exposure during the NVD delay window?
A: They combine disclosure monitoring with asset inventory, ownership data, and rapid decision-making. That allows teams to identify whether a public vulnerability affects critical systems, then apply fixes or mitigations before attackers capitalise on the lag. The best programmes measure time from public reference to containment, not just time from NVD entry to patch.
👉 Read our full editorial: Ghost CVEs expose the vulnerability gap between disclosure and NVD
