# strukturag vulnerabilities & exploitation

> As of 2026-10-23, Threadlinqs tracks 5 strukturag CVEs, 0 in the CISA Known Exploited Vulnerabilities catalog, linked to 3 tracked threat campaigns and 1 named threat actor.

**Data as of:** 2026-10-23

## Exploitation timeline

Threadlinqs has recorded 5 strukturag CVEs published between 2026-05-15 and 2026-08-15. The busiest month was 2026-08 (4 new CVEs). None of them is listed in CISA KEV yet.

## Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked strukturag CVEs.

- [CVE-2026-32882](https://intel.threadlinqs.com/cve/CVE-2026-32882) — HIGH 7.1 · EPSS 0.7% · 2026-05-19
- [CVE-2026-62292](https://intel.threadlinqs.com/cve/CVE-2026-62292) — HIGH 8.7 · EPSS 0.5% · 2026-08-18
- [CVE-2026-62377](https://intel.threadlinqs.com/cve/CVE-2026-62377) — MEDIUM 4.3 · EPSS 0.4% · 2026-08-18
- [CVE-2026-62289](https://intel.threadlinqs.com/cve/CVE-2026-62289) — MEDIUM 4.3 · EPSS 0.4% · 2026-08-18
- [CVE-2026-62291](https://intel.threadlinqs.com/cve/CVE-2026-62291) — MEDIUM 5.3 · EPSS 0.2% · 2026-08-18

## Products affected

Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 1 distinct strukturag product is affected. The most frequently affected:

- libheif — 5 CVEs

## Threat activity

3 tracked threat campaigns reference strukturag products or exploit strukturag CVEs:

- [Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers via ImageMagick/libheif (GHSA-x8r2-mggj-j6wr)](https://intel.threadlinqs.com/threat/TL-2026-2938) — CRITICAL — 2026-10-05
- [AI-Driven Exploit Chain Against OpenAI Community Forum via libheif Flaw (CVE-2026-32882)](https://intel.threadlinqs.com/threat/TL-2026-2558) — HIGH — 2026-09-18
- [AI-Built Exploit Chain Turns Unpatched libheif Flaw and OpenAI Forum Sign-In Bug into Internal Code Access](https://intel.threadlinqs.com/threat/TL-2026-2568) — HIGH — 2026-09-18

## Threat actors targeting strukturag

Named threat actors attributed to campaigns that involve strukturag products or CVEs, with the number of linked campaigns:

- [Hacktron AI](https://intel.threadlinqs.com/actor/Hacktron%20AI) — 2 campaigns

## How to prioritise strukturag patching

This order follows the data Threadlinqs holds for strukturag, not a generic severity checklist:

- No strukturag CVE is in CISA KEV yet, so rank by exploit probability instead.
- Outside KEV, the highest EPSS scores are [CVE-2026-32882](https://intel.threadlinqs.com/cve/CVE-2026-32882) (0.7%), [CVE-2026-62292](https://intel.threadlinqs.com/cve/CVE-2026-62292) (0.5%), [CVE-2026-62377](https://intel.threadlinqs.com/cve/CVE-2026-62377) (0.4%).
- 0 CVEs score Critical and 2 High on CVSS v3 (maximum 8.7, average 5.9); sequence these after KEV and high-EPSS items.
- 4 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

## About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-23 and refresh daily.

Canonical: https://intel.threadlinqs.com/vendors/strukturag
All vendors: https://intel.threadlinqs.com/vendors
Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp