The Research Record
Full findings record and published disclosures at forge.cyberdagger.com, the public archive of Dagger Forge, CyberDagger's vulnerability research practice.
260+
Total findings across 20+ enterprise vendors. Endpoint security, network appliances, VPN clients, IoT firmware, identity infrastructure.
46+
Findings rated CVSS 9.0 or higher (Critical severity).
28
Distinct software targets across 20+ vendors.
2
Published CVEs: CVE-2026-4837 (Rapid7) and CVE-2026-7431 (Ivanti). Additional disclosures publish as coordinated disclosure windows close.
Published Disclosures
CVE-2026-7431: Ivanti Secure Access Client for Windows
Severity: CVSS 4.4 Medium (Ivanti CNA assessment)
Class: Shared-memory ACL granting Authenticated Users read and write to two logging sections in connectionmanagerservice.dll. SYSTEM-context log service flushes attacker-written bytes to disk.
Status: Fixed in Ivanti Secure Access Client 22.8R6, released May 12, 2026. Coordinated with Ivanti PSIRT.
Timeline: ~3 months from initial report to patched release.
Read the full technical writeup → · Ivanti advisory
CVE-2026-4837: Rapid7 Insight Agent for Linux RCE
Severity: CVSS 6.6 Medium
Class: Remote code execution via Python eval() on attacker-influenced beacon data
Status: Patched April 8, 2026. Disclosed in coordination with Rapid7.
Timeline: 40 days from initial report to patched release.
Read the full technical writeup →
How Dagger Forge Worked
Dagger Forge was CyberDagger’s vulnerability research practice, powered by an internal automated pipeline that ran four parallel research tracks against vendor products. Each track was suited to a different target type. Findings were routed to dynamic validation before they counted as real, and to coordinated disclosure with the affected vendor before they were made public.
SOURCE_FUZZ
Coverage-guided fuzzing against open-source components, SDKs, and libraries shipped inside vendor products. Distributed across our in-house cluster for continuous corpus development.
FIRMWARE
Extraction, emulation, and binary analysis of router, IoT, camera, and embedded device firmware. Custom emulation scaffolding for vendor-specific architectures and bootloader chains.
BINARY_ONLY
Reverse engineering of closed-source agents and appliances using industry-standard tooling. Targets endpoint security agents, VPN clients, and proprietary management software.
SOURCE_SCAN
Taint analysis and rule-based static review of source code where available: open-source components, leaked source, and customer-provided code under engagement scope.
Findings from all four pipelines routed through dynamic validation against the actual vendor product. Static analysis output without dynamic confirmation was not treated as a finding.
Disclosure Posture
Coordinated, vendor-first. Every finding was reported to the affected vendor before it reached the public, the press, or any third party. We do not sell vulnerabilities. We do not work with brokers. We do not provide undisclosed vulnerabilities to intelligence services or any other party.
90-day window standard. Standard disclosure window was 90 days from initial vendor notification, extended when vendors were engaged and progressing in good faith.
No exploitation beyond proof of concept. Validation was conducted on legally obtained software in isolated lab environments. PoC code exists to confirm vulnerability and is shared privately with the affected vendor only.
Read our full Responsible Disclosure Policy.
Methodology Writeups
- There Are No Hidden Zero-Days: A field report from approximately ten weeks of pipeline operation. Why discovery is not the bottleneck.
- What Happens When You Point Offline AI at Critical Infrastructure Software: How the pipeline architecture combines AI acceleration with deterministic security toolchains.
- Security Agents Run as Root for a Reason: Full technical writeup of CVE-2026-4837.