Exploitable Critical Vulnerabilities
Shows Critical CVEs that are considered exploitable (based on ExploitStatusEnum > 30). Results are aggregated by CVE and exploitability state, including the number of affected hosts.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=FEMVulnerabilityMutation
| FEMVulnerabilityMutation.VulnerabilityInstance.Cve.Severity = Critical
| FEMVulnerabilityMutation.VulnerabilityInstance.Cve.ExploitStatusEnum > 30
| groupBy([FEMVulnerabilityMutation.VulnerabilityInstance.Cve.Id, FEMVulnerabilityMutation.VulnerabilityInstance.Cve.Severity,FEMVulnerabilityMutation.VulnerabilityInstance.Cve.ExploitStatus],function=count(FEMVulnerabilityMutation.VulnerabilityInstance.HostInfo.Hostname))
| sort(_count)
| rename(field=[[FEMVulnerabilityMutation.VulnerabilityInstance.Cve.Id, CVE_ID], [FEMVulnerabilityMutation.VulnerabilityInstance.Cve.ExploitStatus, Ausnutzbarkeit], [FEMVulnerabilityMutation.VulnerabilityInstance.Cve.Severity, Severity],[_count,"Host(s)"]])exploitable_critical_vulnerabilities.yml
TA0001
ByteRay GmbH
Monitoring
Endpoint
2026-01-27
2026-02-13
