Release Highlights
Two attack pathways have been downgraded to reflect the dynamic nature of cyber risk.
Two threat vectors were downgraded in likelihood score due to evolving difficulty of achieving a breach and other factors
Downgraded threats will begin affecting scores at the next scan
Past risk ratings do not change
Change Details
Apache Tomcat Command Execution Vulnerability Exploitation (CVE-2025-24813)
Reduced the default likelihood
OpenSSH Remote Code Execution Vulnerability Exploitation (CVE-2024-6387)
Reduced the default likelihood
Analyst Note: These threats still exist, but BreachBits has not seen indications that these threats are being used in widespread attacks. Furthermore, finding verified vulnerable versions of the affected software can be noisy and time consuming, making them less attractive for use by attackers.
Affects on Ratings
Beginning in early February 2026, when these threat vectors are found, they will tend to have a lower Danger Rating that previously reported in most cases.
This will likely result in the BreachRisk™ Score to improve (i.e. go down) for entities affected by these threat vectors, if these threat vectors previously had the highest Danger Rating among all detected threat vectors.
Changes in default likelihood or default impact affect the base likelihood or impact of a threat vector. Other factors such as the prevailing IT and security environment of the affected company and results of active testing can then adjust the final scoring of a threat vector.
Future cycles/scans will consider these changes
Past risk ratings do not change