Structural Outlook forecasts

Atlassian CVE-2026-21589 (unauthenticated file read across eight Data Center products) is added to the CISA Known Exploited Vulnerabilities catalog on or before 2027-01-11.

SO-2026-001 · MET · EXPERIMENTAL

n8n CVE-2026-21858 (authentication bypass) is added to the CISA KEV catalog on or before 2027-01-11.

SO-2026-002 · OPEN · EXPERIMENTAL

Google or Irregular publishes a first-party account (blog, report or system-card section) of the May 2026 Gemini evaluation reaching real third-party systems, on or before 2027-01-11.

SO-2026-003 · OPEN · EXPERIMENTAL

METR publishes its independent investigation (or an interim public report) of the Anthropic cybersecurity-evaluation incidents on or before 2027-01-11.

SO-2026-004 · OPEN · EXPERIMENTAL

An operator other than OpenAI publishes a first-party account, naming the system reached, of a benignly tasked (non-capture-the-flag) agent exceeding its sanctioned authorization against a third party's production system, for an event occurring after 2026-10-13, on or before 2027-01-11.

SO-2026-005 · OPEN · EXPERIMENTAL

A vendor telemetry or incident-response source (Mandiant/GTIG, Microsoft, Unit 42, Huntress, watchTowr, Sysdig, CrowdStrike, Sophos) publishes, after issuance, an account of an attacker-operated AI agent framework used in a real intrusion that includes recovered agent artifacts (instruction, configuration or prompt files) and a described victim, for an actor other than JadePuffer/Storm-3168, on or before 2027-01-11.

SO-2026-006 · OPEN · EXPERIMENTAL

At least one new SC-2026-006-qualifying instance (exploitation documented before public disclosure, on sources independent for the two dates) at a vendor not in the qualifying set at issuance (PaperCut, Check Point, Zammad, Zimbra, NetScaler) is publicly documented on or before 2027-01-11.

SO-2026-007 · MET · EXPERIMENTAL

PaperCut CVE-2026-82077 (post-authentication RCE, fixed in 26.0.5) is added to the CISA KEV catalog on or before 2027-01-11.

SO-2026-008 · OPEN · EXPERIMENTAL

Citrix NetScaler receives at least one further CISA KEV entry (any CVE) with dateAdded after 2026-10-13 and on or before 2027-01-11.

SO-2026-009 · OPEN · EXPERIMENTAL

The CISA KEV catalog goes five or more consecutive calendar days without a new release at least once between 2026-10-14 and 2027-01-11.

SO-2026-010 · OPEN · EXPERIMENTAL

ENISA EUVD lists as exploited a 2026 CVE that is absent from the CISA KEV catalog for 14 or more consecutive days, as observed by CHQ's daily second-catalog check, on or before 2027-01-11.

SO-2026-011 · OPEN · EXPERIMENTAL

An SEC Form 8-K Item 1.05 filing dated after issuance and on or before 2027-01-11 names a specific CVE as the initial access vector of the disclosed incident.

SO-2026-012 · OPEN · EXPERIMENTAL

SO-2026-013

SO-2026-013 · NOT_ISSUED

• Number reserved and retired unused at the 26 October 2026 cutoff: a claim on management-plane catalog additions was dropped as a reproduction of a base rate.

A compromise of a single third-party SaaS integration (OAuth app, service principal, delegated credential or integration token held by a vendor), beginning after issuance, is documented as used to access resources in at least three independent customer organizations, by 2027-04-26T12:30Z.

SO-2026-014 · OPEN

A production enterprise AI agent (an AI-driven workflow able to select or execute tool actions against an external system under delegated authority) is publicly confirmed by a first-party source to have performed an unauthorized data transfer or privileged action because of attacker-controlled content encountered during a legitimate task, the occurrence after issuance, by 2027-04-26T12:30Z.

SO-2026-015 · OPEN

At least two distinct vendor advisory assurances published after issuance and on or before 2027-01-31T23:59Z, each stating a vulnerability is not known to be exploited, are retrospectively undermined by 2027-04-26T12:30Z by documented exploitation evidence dated before the assurance (same-day pairs only with reliable ordering).

SO-2026-016 · OPEN

An incident-response or threat-intelligence provider documents a new attack, the modification after issuance, in which a malicious modification of a trusted software distribution channel persisted for less than 60 minutes in at least one window and delivered malicious content to at least one downstream system through that same window, by 2027-04-26T12:30Z. EXPERIMENTAL.

SO-2026-017 · OPEN · EXPERIMENTAL

SO-2026-018

SO-2026-018 · NOT_ISSUED

• Withdrawn before issuance at the 26 October 2026 cutoff: a joint edge-vendor claim reproduced a public base rate; its content was published unscored in Issue No. 44, Section F.