Introduction

Every security team faces the same structural problem. Vulnerabilities are disclosed continuously. CVE identifiers accumulate faster than most organizations can patch. The frameworks built to help, CVSS to score severity, EPSS to model exploitation probability, KEV to confirm active use, exist precisely to cut through the volume and surface what demands attention first. The problem is not that these tools fail. It is what they are designed to measure, and what falls outside that design. Formal vulnerability intelligence is built around public data: NVD records, published scores, confirmed exploitation events. It is not built around criminal forums, private Telegram channels, or the underground markets where exploitation tooling is developed, tested, and distributed before it reaches any formal source. The gap between those two information layers is where attacks begin. The following case makes it concrete.

The case of CVE-2026-27825

The intelligence gap between CVE publication and criminal exploit was six days. On March 10, 2026, CVE-2026-27825 and CVE-2026-27826 appeared on the National Vulnerability Database. Two critical vulnerabilities in mcp-atlassian, the most widely deployed open-source MCP server for Jira and Confluence, scored CVSS 9.1 and CVSS 8.2 respectively. The patch had been available since February 24, when version 0.17.0 shipped. The formal intelligence stack was doing exactly what it was designed to do: naming the vulnerability, scoring its severity, flagging the fix. Six days later, on March 16, KELA analysts identified a detailed exploitation writeup, including a working proof-of-concept exploit, on XSS.PRO: one of the longest-running Russian-language criminal forums, where the same platform hosts active listings for stolen payment card data, cryptocurrency mixing services, and credential markets. As this blog is published, CVE-2026-27825 is not in CISA's Known Exploited Vulnerabilities catalog. EPSS rates it at 2.3% probability of exploitation. Low. The formal stack is not wrong, it's just incomplete, so for this blog we'll focus on the gap. This post builds on Pluto Security's MCPwnfluence research. Pluto Security discovered and disclosed the vulnerability chain. KELA supplies the threat intelligence layer: what happened after the patch, where the PoC went, and what that means for organizations still running unpatched versions.

What the Formal Vulnerability Stack Measures, and What It Does Not

CVE, CVSS, EPSS, and KEV are four distinct instruments. Each measures something specific. Each does its job. Together they leave a gap that criminal actors operate inside.

Here's the explanation for each:

• A CVE ID is a naming mechanism. It confirms a vulnerability is formally identified and catalogued. It does not tell you whether anyone is actively building an exploit from the NVD description.
• CVSS scores theoretical severity: attack vector, complexity, privileges required, impact ceiling. CVE-2026-27825 scored 9.1, Critical. That tells you the ceiling is very high. It says nothing about what is happening in criminal infrastructure at any given moment.
• EPSS models the statistical probability of exploitation in the next 30 days, based on historical patterns. CVE-2026-27825 carries an EPSS of 2.3%, rated Low. That is not incorrect. The statistical model draws on observable signals in its training data, not on a criminal forum post that required underground network access to find. EPSS is working exactly as designed.
• KEV is CISA's confirmed exploitation list. It is authoritative and maintained with care. Its structural limitation is definitional: something has to be confirmed as actively exploited in the wild before it appears. KEV tells you the gap has closed. It cannot tell you where you are while the gap is still open.

The key point is this: none of these instruments has a direct line to the underground. None of them monitors the criminal forums where exploitation tools are built, tested, shared, and sold. They are each correct within their scope. Together they leave a gap, and that gap is the window criminal actors operate inside.

The Weaponization Timeline

Twenty days separated the patch from a working criminal exploit.

Six days separated the public CVE announcement from the same point. Those two numbers measure different things.

• Feb 24, 2026: Version 0.17.0 released; CVE-2026-27825 (CVSS 9.1) and CVE-2026-27826 (CVSS 8.2) formally issued
• Feb 26, 2026: Pluto Security publishes MCPwnfluence analysis; no active exploitation observed at time of publication
• Mar 10, 2026: CVE designations published on NVD; vulnerabilities become public knowledge
• Mar 16, 2026: KELA analysts identify full PoC exploit posted to XSS.PRO criminal forum
• Sep 9, 2026: CVE-2026-27825 not listed in CISA KEV; EPSS: 2.3% (Low)

Twenty days is the window during which every unpatched deployment was exposed to a known, fixable vulnerability. Six days is the window the formal vulnerability intelligence stack had no visibility into. Between March 10 and March 16, EPSS rated CVE-2026-27825 at 2.3% Low. KEV had no entry. By every formal measure, a low-urgency, unconfirmed risk. In practice, a weaponized exploit was in criminal hands by the end of that window, and it remains absent from KEV today.

What KELA Found: The XSS.PRO PoC

XSS.PRO is a long-running Russian-language hacking forum. Its user base spans vulnerability researchers, malware developers, and criminal operators. The same platform that hosted the mcp-atlassian exploitation writeup also carried active listings for stolen credit cards, cryptocurrency mixing services, and seed phrase processing tools on the same page. This is not a security researcher sharing responsible disclosure notes. This is operational criminal infrastructure. On March 16, 2026, a forum user published a detailed technical writeup covering: an explanation of MCP architecture and how mcp-atlassian exposes Atlassian APIs to AI assistants; instructions for identifying vulnerable versus patched versions, including a method to navigate the vendor's backport of patches to earlier release branches; step-by-step exploitation of both CVE-2026-27825 and CVE-2026-27826; and a working proof-of-concept exploit script. The technical depth, including source code walkthroughs and version fingerprinting guidance, is consistent with an author who had working access to the codebase and verified exploitation against a live environment. The post was distributed via the forum's .onion address, targeting a criminal audience rather than the security research community. The takeaway is direct: a functional exploit for a CVSS 9.1 and CVSS 8.2 vulnerability chain was in criminal hands six days after the CVE was published on NVD, while formal scoring reported low exploitation probability and no confirmed active use.

Why the Gap Is Closing

The six-day window between CVE publication and criminal PoC for mcp-atlassian is not exceptional. It is increasingly representative of how quickly the criminal ecosystem moves when a high-profile vulnerability goes public. When a CVE appears on NVD with full technical detail, the vulnerability description is a roadmap. Attackers with moderate capability can read the affected version range, diff the patched and unpatched code, understand exactly what changed, and work backward to a functional exploit. AI-assisted code analysis has made that process materially faster than it was two years ago. Six days is not an aberration. For well-resourced actors targeting popular open-source tooling, it may already be a ceiling rather than a floor. The attack surface is also expanding through AI adoption. mcp-atlassian, with over 4 million downloads as of February 2026, connects AI assistants, including Claude, GitHub Copilot, and Cursor, to enterprise Atlassian data. The vulnerabilities in it were not incidental to AI adoption: they were a direct consequence of it. The MCP ecosystem is being built at speed, for productivity, outside the secure-by-default design standards that established enterprise software enforces. As Pluto Security's lead researcher Yotam Perkal concluded, "adoption speed is outpacing secure-by-default design" across the MCP ecosystem. mcp-atlassian is the proof of concept for that assessment. The combination is predictable: a widening attack surface, lower barriers to exploit development, and a formal intelligence framework built for a threat environment that no longer reflects the pace at which criminals operate.

How KELA Surfaces This Intelligence

The sequence described in this post, from CVE publication to criminal PoC in six days, is a pattern KELA tracks systematically across the criminal underground. KELA's intelligence collection spans hacking forums including XSS.PRO, dark net communities, instant messaging channels, and criminal platforms where exploitation tools are built, tested, shared, and sold. When a high-profile CVE is published on the NVD, KELA analysts monitor those sources for the discussion, tooling, and PoC activity that follows in the criminal ecosystem, mapping findings directly to CVE identifiers and tracking how quickly the gap between disclosure and weaponization closes. For CVE-2026-27825, that monitoring surfaced the XSS.PRO post on March 16. The finding confirmed that the formal vulnerability intelligence stack was telling a materially incomplete story: CVSS 9.1 Critical, EPSS 2.3% Low, no KEV entry, and a working criminal exploit already in distribution.

But why no KEV, still? KEV requires confirmed exploitation. Confirmed exploitation requires a reported incident. Reported incidents require detection. For a tool like MCP Atlassian running on developer laptops and local networks with no authentication logging, that chain breaks quietly. In summary: the intelligence gap between "CVE published" and "CVE weaponized by criminals" is not a gap organizations have to accept. It is measurable, it is trackable, and it is closeable. The data exists. The question is whether your vulnerability management program has access to it.

Conclusion

CVE-2026-27825 illustrates a structural problem in contemporary vulnerability management, not a unique event. The formal stack gave security teams consistent signals in March 2026: Critical severity, low exploitation probability, no confirmed active use. Those signals were accurate within their scope. They were also missing six days of criminal activity during which a working exploit was built and distributed. Standard remediation guidance, upgrade to mcp-atlassian 0.17.0 immediately, is correct and necessary. It is also incomplete without the intelligence context. Knowing that a working PoC was circulating on a major criminal forum six days after the CVE was published changes the urgency calculation for any organization with unpatched deployments. Patch management timelines that treat KEV as the confirmation signal are, by the architecture of the system, operating weeks to months behind the criminal ecosystem. The disclosure-to-criminal gap is shrinking. For CVE-2026-27825, it was six days from public announcement. Knowing how wide that gap is, in real time, for vulnerabilities in your stack, is now a required input to realistic vulnerability management.