CISA KEV Flash: 12 CVEs Added — Check Point, Microsoft Office & UnrealIRCd Under Active Attack

---
title: Check Point Security Management - Suspicious Authentication Bypass Attempts
id: 8f2a1b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects authentication bypass attempts against Check Point Security Management and Gateway products exploiting CVE-2026-123039
author: Security Arsenal Detection Engineering
date: 2026/11/13
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://securityarsenal.com/darkside
logsource:
  product: checkpoint
  service: smartlog
detection:
  selection_auth:
    action: 'login'
    status: 'success'
    user: ''
  selection_suspicious_paths:
    uri|contains:
      - '/_int/'
      - '/.well-known/'
      - '/../'
      - '/WEB-INF/'
  selection_unusual_agents:
    user_agent|contains:
      - 'python-requests'
      - 'curl'
      - 'wget'
      - 'Go-http-client'
  condition: selection_auth and (selection_suspicious_paths or selection_unusual_agents)
falsepositives:
  - Legitimate API automation with proper service accounts
  - Vulnerability scanners (identify and exclude)
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078
  - cve.2026.123039

---
title: Microsoft Outlook - CVE-2026-124194 Preview Pane Exploitation
id: 9g3b2c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of Microsoft Outlook preview pane vulnerability (CVE-2026-124194) through suspicious email patterns and process behavior
author: Security Arsenal Detection Engineering
date: 2026/11/13
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_outlook:
    ParentImage|endswith: '\OUTLOOK.EXE'
  selection_child_suspicious:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  selection_network_behavior:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - '-enc'
      - '-e '
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'DownloadFile'
  condition: selection_parent_outlook and selection_child_suspicious and selection_network_behavior
falsepositives:
  - Legitimate Outlook add-ins (rare with network calls)
  - Corporate email security tools
level: high
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1204.002
  - attack.t1059
  - cve.2026.124194

---
title: Barracuda ESG - Authentication Bypass via Alternate Path
id: 0h4c5d6e-7f8a-9b0c-1d2e-3f4a5b6c7d8e
status: experimental
description: Detects authentication bypass attempts against Barracuda Email Security Gateway exploiting CVE-2026-111560 and CVE-2026-116606
author: Security Arsenal Detection Engineering
date: 2026/11/13
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://securityarsenal.com/darkside
logsource:
  category: webserver
  product: barracuda
detection:
  selection_endpoints:
    cs-uri-stem|contains:
      - '/cgi-mod/'
      - '/cgi-bin/'
      - '/api/'
      - '/rest/'
  selection_auth_bypass:
    cs-method: 'POST'
    sc-status: 200
    cs-user-agent|contains:
      - 'python'
      - 'curl'
      - 'wget'
      - 'perl'
      - 'ruby'
  selection_suspicious_payloads:
    cs-uri-query|contains:
      - 'eval'
      - 'exec'
      - 'system'
      - 'bash'
      - 'sh -c'
      - 'cmd.exe'
      - 'powershell'
      - 'nc -e'
      - 'bash -i'
  condition: selection_endpoints and (selection_auth_bypass or selection_suspicious_payloads)
falsepositives:
  - Legitimate Barracuda management tools
  - Email security testing platforms
level: critical
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1190
  - attack.t1059
  - cve.2026.111560
  - cve.2026.116606

// CISA KEV Active Exploitation Hunt — 2026-11-09 to 2026-11-13
// Multi-vendor exploitation indicators for Security Operations Centers

let KEVTimeframe = ago(14d);

// Check Point CVE-2026-123039 Exploitation Indicators
let CheckPointExploit = (
    CommonSecurityLog
    | where TimeGenerated > KEVTimeframe
    | where DeviceVendor == "Check Point"
    | where DeviceProduct has_any ("Smart-1", "Security Management", "Multi-Domain")
    | where Activity == "Accept" or Activity == "Allow"
    | where SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172."
    | where AdditionalExtensions has_any ("_int/", "../", ".well-known/")
    | extend SuspiciousPath = extract(@"(_int/|\.\./|\.well-known/)", 0, AdditionalExtensions)
    | where isnotempty(SuspiciousPath)
    | project TimeGenerated, SourceIP, DestinationIP, Activity, SuspiciousPath, DeviceProduct
);

// Microsoft Outlook CVE-2026-124194 Exploitation Indicators
let OutlookExploit = (
    DeviceProcessEvents
    | where TimeGenerated > KEVTimeframe
    | where InitiatingProcessFileName =~ "OUTLOOK.EXE"
    | where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe")
    | where ProcessCommandLine has_any ("http://", "https://", "-enc", "IEX", "Invoke-Expression", "DownloadString", "DownloadFile", "bypass", "hidden")
    | extend SuspiciousCommand = ProcessCommandLine
    | project TimeGenerated, DeviceName, AccountName, FileName, SuspiciousCommand, InitiatingProcessFileName
);

// Barracuda ESG CVE-2026-111560 / CVE-2026-116606 Exploitation Indicators
let BarracudaExploit = (
    CommonSecurityLog
    | where TimeGenerated > KEVTimeframe
    | where DeviceVendor == "Barracuda"
    | where DeviceProduct == "Email Security Gateway"
    | where RequestMethod == "POST"
    | where RequestURL has_any ("/cgi-mod/", "/cgi-bin/", "/api/", "/rest/")
    | where RequestClientApplication has_any ("python", "curl", "wget", "perl", "ruby")
    | where AdditionalExtensions has_any ("eval", "exec", "system", "bash", "cmd.exe", "powershell")
    | project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestClientApplication, AdditionalExtensions
);

// GPUStack CVE-2026-102895 Exploitation Indicators
let GPUStackExploit = (
    DeviceNetworkEvents
    | where TimeGenerated > KEVTimeframe
    | where RemotePort == 443 or RemotePort == 8080 or RemotePort == 3000
    | where RemoteUrl has_any ("gpustack", "gpu", "api/v1")
    | where InitiatingProcessFileName in~ ("python.exe", "curl.exe", "wget.exe", "powershell.exe")
    | where LocalIPType == "Public" or RemoteIPType == "Public"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
);

// OpenSSH CVE-2026-123158 Exploitation Indicators
let OpenSSHExploit = (
    Syslog
    | where TimeGenerated > KEVTimeframe
    | where Facility == "auth" or Facility == "authpriv"
    | where SyslogMessage has_any ("Accepted", "Failed", "Invalid", "authentication failure")
    | where SyslogMessage has_any ("keyboard-interactive", "publickey", "password")
    | extend AuthResult = case(
        SyslogMessage has "Accepted", "Success",
        SyslogMessage has "Failed", "Failure",
        SyslogMessage has "Invalid", "Invalid",
        "Other"
    )
    | where AuthResult == "Success"
    | extend ParsedUser = extract(@"for (\w+) from", 1, SyslogMessage)
    | extend ParsedIP = extract(@"from (\d+\.\d+\.\d+\.\d+)", 1, SyslogMessage)
    | where isnotempty(ParsedUser) and isnotempty(ParsedIP)
    | where ParsedIP !startswith "10." and ParsedIP !startswith "192.168." and ParsedIP !startswith "172."
    | project TimeGenerated, Computer, ParsedUser, ParsedIP, AuthResult, SyslogMessage
);

// Cisco BroadWorks CVE-2026-20320 XXE Exploitation Indicators
let CiscoXXEExploit = (
    CommonSecurityLog
    | where TimeGenerated > KEVTimeframe
    | where DeviceVendor == "Cisco"
    | where DeviceProduct has_any ("BroadWorks", "BroadSoft")
    | where RequestURL has_any (".xml", "/xml", "/api", "/soap")
    | where AdditionalExtensions has_any ("<!DOCTYPE", "<!ENTITY", "SYSTEM", "file:///", "http://", "ftp://")
    | extend XXEPattern = extract(@"(<!DOCTYPE|<!ENTITY|SYSTEM|file:///|http://|ftp://)", 0, AdditionalExtensions)
    | project TimeGenerated, SourceIP, DestinationIP, RequestURL, XXEPattern
);

// Unified Results with Risk Scoring
union withsource=DetectionSource CheckPointExploit, OutlookExploit, BarracudaExploit, GPUStackExploit, OpenSSHExploit, CiscoXXEExploit
| extend RiskScore = case(
    DetectionSource == "CheckPointExploit", 95,
    DetectionSource == "BarracudaExploit", 90,
    DetectionSource == "OutlookExploit", 85,
    DetectionSource == "GPUStackExploit", 88,
    DetectionSource == "OpenSSHExploit", 75,
    DetectionSource == "CiscoXXEExploit", 82,
    50
)
| extend Severity = case(
    RiskScore >= 90, "CRITICAL",
    RiskScore >= 80, "HIGH",
    RiskScore >= 70, "MEDIUM",
    "LOW"
)
| extend CVE = case(
    DetectionSource == "CheckPointExploit", "CVE-2026-123039",
    DetectionSource == "BarracudaExploit", "CVE-2026-111560/CVE-2026-116606",
    DetectionSource == "OutlookExploit", "CVE-2026-124194",
    DetectionSource == "GPUStackExploit", "CVE-2026-102895",
    DetectionSource == "OpenSSHExploit", "CVE-2026-123158",
    DetectionSource == "CiscoXXEExploit", "CVE-2026-20320",
    "Unknown"
)
| extend RecommendedAction = case(
    Severity == "CRITICAL", "IMMEDIATE ISOLATION — Disconnect from network, preserve forensics, patch within 4 hours",
    Severity == "HIGH", "Priority patching within 24 hours, enhanced monitoring, network segmentation",
    Severity == "MEDIUM", "Patch within 72 hours, review access controls",
    "Monitor and patch per standard cycle"
)
| project TimeGenerated, DetectionSource, CVE, Severity, RiskScore, RecommendedAction, DeviceName, SourceIP, DestinationIP, AccountName, SuspiciousCommand, RequestURL, SyslogMessage
| sort by RiskScore desc, TimeGenerated desc

# CISA KEV Vulnerability Inventory & Remediation Script — 2026-11-13
# Targets: Check Point, Microsoft Office, Barracuda ESG, GPUStack, OpenSSH
# Execution: Run as Administrator on domain controllers, then deploy via GPO/SCCM/Intune

[CmdletBinding()]
param(
    [Parameter(Mandatory=$false)]
    [string]$OutputPath = "C:\KEV_Assessment_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv",
    
    [Parameter(Mandatory=$false)]
    [switch]$Remediate = $false,
    
    [Parameter(Mandatory=$false)]
    [string[]]$ComputerName = @("localhost")
)

# Initialize results array
$Results = @()

# Function to check Check Point Security Management/Gateway
function Test-CheckPointVulnerability {
    param([string]$Computer)
    
    $Status = [PSCustomObject]@{
        ComputerName = $Computer
        Vendor = "Check Point"
        Product = "Security Management/Gateway"
        CVE = "CVE-2026-123039"
        Vulnerable = $false
        Installed = $false
        Version = "Not Detected"
        ActionRequired = "None"
        Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    }
    
    try {
        # Check for Check Point processes/services
        $Services = Get-Service -ComputerName $Computer -ErrorAction SilentlyContinue | 
            Where-Object { $_.Name -match "fw1|cpwd|cpwatch|cpportal" }
        
        if ($Services) {
            $Status.Installed = $true
            $Status.Vulnerable = $true  # Default to vulnerable until patched
            $Status.ActionRequired = "URGENT: Apply Check Point hotfix — see sk183416"
            
            # Attempt to get version via registry
            $RegPath = "HKLM:\SOFTWARE\CheckPoint\FW1"
            $Version = Invoke-Command -ComputerName $Computer -ScriptBlock {
                param($Path)
                try { (Get-ItemProperty -Path $Path -ErrorAction SilentlyContinue).Version }
                catch { "Unknown" }
            } -ArgumentList $RegPath
            
            if ($Version) { $Status.Version = $Version }
        }
    }
    catch {
        Write-Warning "Failed to assess Check Point on $Computer : $_"
    }
    
    return $Status
}

# Function to check Microsoft Office/Outlook vulnerability
function Test-OfficeVulnerability {
    param([string]$Computer)
    
    $Status = [PSCustomObject]@{
        ComputerName = $Computer
        Vendor = "Microsoft"
        Product = "Office/Outlook"
        CVE = "CVE-2026-124194"
        Vulnerable = $false
        Installed = $false
        Version = "Not Detected"
        ActionRequired = "None"
        Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    }
    
    try {
        # Check Office installation via registry
        $OfficeVersions = @("16.0", "15.0", "14.0")
        foreach ($Ver in $OfficeVersions) {
            $RegPath = "HKLM:\SOFTWARE\Microsoft\Office\$Ver\Outlook\InstallRoot"
            $InstallPath = Invoke-Command -ComputerName $Computer -ScriptBlock {
                param($Path)
                try { (Get-ItemProperty -Path $Path -ErrorAction SilentlyContinue).Path }
                catch { $null }
            } -ArgumentList $RegPath
            
            if ($InstallPath) {
                $Status.Installed = $true
                $Status.Version = "Office $Ver"
                
                # Check for November 2026 security update
                $UpdateCheck = Invoke-Command -ComputerName $Computer -ScriptBlock {
                    param($Version)
                    # Check for KB5000000-series updates (November 2026)
                    $Hotfix = Get-HotFix -ErrorAction SilentlyContinue | 
                        Where-Object { $_.HotFixID -match "KB50" -and $_.InstalledOn -ge (Get-Date "2026-11-10") }
                    return $Hotfix -ne $null
                } -ArgumentList $Ver
                
                if (-not $UpdateCheck) {
                    $Status.Vulnerable = $true
                    $Status.ActionRequired = "Install November 2026 Office Security Update"
                }
                break
            }
        }
    }
    catch {
        Write-Warning "Failed to assess Office on $Computer : $_"
    }
    
    return $Status
}

# Function to check Barracuda ESG
function Test-BarracudaVulnerability {
    param([string]$Computer)
    
    $Status = [PSCustomObject]@{
        ComputerName = $Computer
        Vendor = "Barracuda"
        Product = "Email Security Gateway"
        CVE = "CVE-2026-111560/CVE-2026-116606"
        Vulnerable = $false
        Installed = $false
        Version = "Not Detected"
        ActionRequired = "None"
        Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    }
    
    try {
        # Check for Barracuda services or network listeners
        $NetworkCheck = Invoke-Command -ComputerName $Computer -ScriptBlock {
            $Listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | 
                Where-Object { $_.LocalPort -in @(443, 80, 8000, 8080) }
            $Processes = Get-Process -ErrorAction SilentlyContinue | 
                Where-Object { $_.Name -match "barracuda|esg|emailsecurity" }
            return @{ Listeners = $Listeners; Processes = $Processes }
        }
        
        if ($NetworkCheck.Processes) {
            $Status.Installed = $true
            $Status.Vulnerable = $true
            $Status.ActionRequired = "IMMEDIATE: Isolate ESG, apply Barracuda patch 20261109, enable MFA"
        }
    }
    catch {
        Write-Warning "Failed to assess Barracuda on $Computer : $_"
    }
    
    return $Status
}

# Function to check GPUStack
function Test-GPUStackVulnerability {
    param([string]$Computer)
    
    $Status = [PSCustomObject]@{
        ComputerName = $Computer
        Vendor = "GPUStack"
        Product = "GPUStack AI Platform"
        CVE = "CVE-2026-102895"
        Vulnerable = $false
        Installed = $false
        Version = "Not Detected"
        ActionRequired = "None"
        Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    }
    
    try {
        $GPUStackCheck = Invoke-Command -ComputerName $Computer -ScriptBlock {
            $Process = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -match "gpustack" }
            $Service = Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.Name -match "gpustack" }
            $Port = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | 
                Where-Object { $_.LocalPort -in @(3000, 8080, 50051) }
            
            return @{ Process = $Process; Service = $Service; Port = $Port }
        }
        
        if ($GPUStackCheck.Process -or $GPUStackCheck.Service) {
            $Status.Installed = $true
            $Status.Vulnerable = $true
            $Status.ActionRequired = "Apply GPUStack v0.4.1+ or disable external API access"
        }
    }
    catch {
        Write-Warning "Failed to assess GPUStack on $Computer : $_"
    }
    
    return $Status
}

# Function to check OpenSSH
function Test-OpenSSHVulnerability {
    param([string]$Computer)
    
    $Status = [PSCustomObject]@{
        ComputerName = $Computer
        Vendor = "OpenBSD"
        Product = "OpenSSH"
        CVE = "CVE-2026-123158"
        Vulnerable = $false
        Installed = $false
        Version = "Not Detected"
        ActionRequired = "None"
        Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    }
    
    try {
        $SSHCheck = Invoke-Command -ComputerName $Computer -ScriptBlock {
            $Service = Get-Service -Name "sshd" -ErrorAction SilentlyContinue
            $Feature = Get-WindowsCapability -Online -ErrorAction SilentlyContinue | 
                Where-Object { $_.Name -like "OpenSSH*" }
            
            return @{ Service = $Service; Feature = $Feature }
        }
        
        if ($SSHCheck.Service -or ($SSHCheck.Feature | Where-Object { $_.State -eq "Installed" })) {
            $Status.Installed = $true
            
            # Get OpenSSH version
            $Version = Invoke-Command -ComputerName $Computer -ScriptBlock {
                try {
                    $SshPath = "$env:SystemRoot\System32\OpenSSH\ssh.exe"
                    if (Test-Path $SshPath) {
                        $VersionInfo = (Get-Item $SshPath).VersionInfo
                        return $VersionInfo.ProductVersion
                    }
                }
                catch { return "Unknown" }
            }
            
            if ($Version) {
                $Status.Version = $Version
                # Check if version is vulnerable (pre-9.9p1 or specific Linux builds)
                $VersionNum = $Version -replace '[^0-9.]', ''
                if ([version]$VersionNum -lt [version]"9.9") {
                    $Status.Vulnerable = $true
                    $Status.ActionRequired = "Update OpenSSH to 9.9p1 or later"
                }
            }
        }
    }
    catch {
        Write-Warning "Failed to assess OpenSSH on $Computer : $_"
    }
    
    return $Status
}

# Function to apply remediation
function Invoke-Remediation {
    param([PSCustomObject]$Vulnerability, [string]$Computer)
    
    if (-not $Remediate) { return }
    
    Write-Host "[REMEDIATION] $($Vulnerability.CVE) on $Computer" -ForegroundColor Yellow
    
    switch ($Vulnerability.Vendor) {
        "Check Point" {
            Write-Host "  → Applying network isolation via firewall rules" -ForegroundColor Cyan
            Invoke-Command -ComputerName $Computer -ScriptBlock {
                New-NetFirewallRule -DisplayName "KEV-CVE-2026-123039-Block" -Direction Inbound -Action Block -RemoteAddress Any -Protocol TCP -LocalPort 443,80,18190,18191,18209,18210,18221,18222,18223,18224,18225,18226,18231,18232,18233,18234,18235,18236,18241,18242,18243,18244,18245,18246,18251,18252,18253,18254,18255,18256,18261,18262,18263,18264,18265,18266 -ErrorAction SilentlyContinue
            }
        }
        
        "Microsoft" {
            Write-Host "  → Triggering Windows Update scan and installation" -ForegroundColor Cyan
            Invoke-Command -ComputerName $Computer -ScriptBlock {
                $UpdateSession = New-Object -ComObject Microsoft.Update.Session
                $UpdateSearcher = $UpdateSession.CreateUpdateSearcher()
                $SearchResult = $UpdateSearcher.Search("IsInstalled=0 and Type='Software'")
                
                if ($SearchResult.Updates.Count -gt 0) {
                    $UpdatesToInstall = New-Object -ComObject Microsoft.Update.UpdateColl
                    foreach ($Update in $SearchResult.Updates) {
                        if ($Update.Title -match "Office|Outlook|Security") {
                            $UpdatesToInstall.Add($Update) | Out-Null
                        }
                    }
                    
                    if ($UpdatesToInstall.Count -gt 0) {
                        $Installer = $UpdateSession.CreateUpdateInstaller()
                        $Installer.Updates = $UpdatesToInstall
                        $InstallationResult = $Installer.Install()
                        Write-Host "  → Installation result: $($InstallationResult.ResultCode)" -ForegroundColor Green
                    }
                }
            }
        }
        
        "Barracuda" {
            Write-Host "  → BLOCKING all external access to ESG interface" -ForegroundColor Red
            Invoke-Command -ComputerName $Computer -ScriptBlock {
                # Emergency block — Barracuda ESG should be physically isolated
                New-NetFirewallRule -DisplayName "KEV-BARRACUDA-EMERGENCY-BLOCK" -Direction Inbound -Action Block -Protocol TCP -LocalPort 443,80,8000,8080 -ErrorAction SilentlyContinue
            }
        }
        
        "GPUStack" {
            Write-Host "  → Disabling GPUStack service and blocking ports" -ForegroundColor Cyan
            Invoke-Command -ComputerName $Computer -ScriptBlock {
                Stop-Service -Name "gpustack*" -Force -ErrorAction SilentlyContinue
                Set-Service -Name "gpustack*" -StartupType Disabled -ErrorAction SilentlyContinue
                New-NetFirewallRule -DisplayName "KEV-GPUStack-Block" -Direction Inbound -Action Block -Protocol TCP -LocalPort 3000,8080,50051 -ErrorAction SilentlyContinue
            }
        }
        
        "OpenBSD" {
            Write-Host "  → Applying SSH hardening and restricting access" -ForegroundColor Cyan
            Invoke-Command -ComputerName $Computer -ScriptBlock {
                # Create restricted SSH config
                $SSHConfig = @"
# KEV-2026-123158 Emergency Hardening
PasswordAuthentication no
PermitRootLogin no
MaxAuthTries 3
MaxSessions 2
AllowUsers admin backup
"@
                $SSHConfig | Out-File "$env:ProgramData\ssh\sshd_config" -Force
                Restart-Service sshd -Force
                New-NetFirewallRule -DisplayName "KEV-SSH-Restrict" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 22 -RemoteAddress "10.0.0.0/8","172.16.0.0/12","192.168.0.0/16" -ErrorAction SilentlyContinue
                New-NetFirewallRule -DisplayName "KEV-SSH-Block-External" -Direction Inbound -Action Block -Protocol TCP -LocalPort 22 -RemoteAddress Any -ErrorAction SilentlyContinue
            }
        }
    }
}

# Main execution
Write-Host "═══════════════════════════════════════════════════════════" -ForegroundColor Red
Write-Host "  CISA KEV ACTIVE EXPLOITATION ASSESSMENT — 2026-11-13" -ForegroundColor Red
Write-Host "  Targeting: 12 CVEs | Remediation Mode: $Remediate" -ForegroundColor Red
Write-Host "═══════════════════════════════════════════════════════════" -ForegroundColor Red

foreach ($Computer in $ComputerName) {
    Write-Host "`n[ASSESSING] $Computer" -ForegroundColor Cyan
    
    # Test each vulnerability
    $Results += Test-CheckPointVulnerability -Computer $Computer
    $Results += Test-OfficeVulnerability -Computer $Computer
    $Results += Test-BarracudaVulnerability -Computer $Computer
    $Results += Test-GPUStackVulnerability -Computer $Computer
    $Results += Test-OpenSSHVulnerability -Computer $Computer
    
    # Apply remediation if requested
    if ($Remediate) {
        $VulnerableItems = $Results | Where-Object { $_.ComputerName -eq $Computer -and $_.Vulnerable -eq $true }
        foreach ($Item in $VulnerableItems) {
            Invoke-Remediation -Vulnerability $Item -Computer $Computer
        }
    }
}

# Export results
$Results | Export-Csv -Path $OutputPath -NoTypeInformation

# Summary report
Write-Host "`n═══════════════════════════════════════════════════════════" -ForegroundColor Green
Write-Host "  ASSESSMENT COMPLETE" -ForegroundColor Green
Write-Host "═══════════════════════════════════════════════════════════" -ForegroundColor Green

$Summary = $Results | Group-Object Vendor | Select-Object Name, Count, @{N='Vulnerable';E={($_.Group | Where-Object {$_.Vulnerable}).Count}}
$Summary | Format-Table -AutoSize

$CriticalFindings = $Results | Where-Object { $_.Vulnerable -eq $true }
if ($CriticalFindings) {
    Write-Host "`n[CRITICAL] $($CriticalFindings.Count) vulnerable instances detected!" -ForegroundColor Red
    $CriticalFindings | Format-Table ComputerName, Vendor, Product, CVE, ActionRequired -AutoSize
}

Write-Host "`nResults exported to: $OutputPath" -ForegroundColor Yellow
Write-Host "Next steps: Review findings, apply patches, verify with 'Get-Content $OutputPath'" -ForegroundColor Yellow

# Validation function
function Test-RemediationValidation {
    param([string]$Computer)
    
    Write-Host "`n[VALIDATION] Verifying remediation on $Computer" -ForegroundColor Cyan
    
    # Re-run assessments
    $PostAssessment = @()
    $PostAssessment += Test-CheckPointVulnerability -Computer $Computer
    $PostAssessment += Test-OfficeVulnerability -Computer $Computer
    $PostAssessment += Test-BarracudaVulnerability -Computer $Computer
    $PostAssessment += Test-GPUStackVulnerability -Computer $Computer
    $PostAssessment += Test-OpenSSHVulnerability -Computer $Computer
    
    $StillVulnerable = $PostAssessment | Where-Object { $_.Vulnerable -eq $true }
    
    if ($StillVulnerable) {
        Write-Host "[WARNING] $($StillVulnerable.Count) issues remain after remediation!" -ForegroundColor Red
        $StillVulnerable | Format-Table Vendor, Product, CVE, ActionRequired
    } else {
        Write-Host "[SUCCESS] All KEV vulnerabilities addressed on $Computer" -ForegroundColor Green
    }
}

# Uncomment to run validation after remediation
# if ($Remediate) { foreach ($Computer in $ComputerName) { Test-RemediationValidation -Computer $Computer } }