Badge
11,371 badges added since 01 January 2025
Internal validation & live display
Multiple badges & continuous verification
Faster underwriting decisions

McKinsey & Company is a global management consulting firm. We are the trusted advisor to the world's leading businesses, governments, and institutions. We work with leading organizations across the private, public and social sectors. Our scale, scope, and knowledge allow us to address problems that no one else can. We have deep functional and industry expertise as well as breadth of geographical reach. We are passionate about taking on immense challenges that matter to our clients and, often, to the world. We work with our clients as we do with our colleagues. We build their capabilities and leadership skills at every level and every opportunity. We do this to help build internal support, get to real issues, and reach practical recommendations. We bring out the capabilities of clients to fully participate in the process and lead the ongoing work.

McKinsey & Company A.I CyberSecurity Scoring

MC

Company Details

Linkedin ID:

mckinsey

Employees number:

38,633

Number of followers:

6,920,938

NAICS:

5416

Industry Type:

Business Consulting and Services

Homepage:

mckinsey.com

IP Addresses:

0

Company ID:

MCK_2563487

Scan Status:

In-progress

AI scoreMC Risk Score (AI oriented)

Between 800 and 849

https://images.rankiteo.com/companyimages/mckinsey.jpeg
MC Business Consulting and Services
Updated:
  • Powered by our proprietary A.I cyber incident model
  • Insurance preferes TPRM score to calculate premium
Get a Score Increase
globalscoreMC Global Score (TPRM)

XXXX

https://images.rankiteo.com/companyimages/mckinsey.jpeg
MC Business Consulting and Services
  • Instant access to detailed risk factors
  • Benchmark vs. industry & size peers
  • Vulnerabilities
  • Findings

MC Company CyberSecurity News & History

Past Incidents
1
Attack Types
1
EntityTypeSeverityImpactSeenBlog DetailsSupply Chain SourceIncident DetailsView
McKinsey & CompanyCyber Attack10053/2026NA
Rankiteo Explanation :
Attack threatening the organization's existence

Description: AI Agent Exploits McKinsey’s Internal Chatbot in Under Two Hours Researchers at security startup CodeWall demonstrated how an autonomous AI agent hacked McKinsey’s internal generative AI platform, *Lilli*, gaining full read-and-write access to its production database within two hours. The attack, conducted in late February, exposed 46.5 million chat messages, 728,000 confidential client files, 57,000 user accounts, and 95 writable system prompts all in plaintext. The agent exploited an unauthenticated SQL injection vulnerability in Lilli’s API, which was publicly exposed through 22 unsecured endpoints. By manipulating JSON keys in user search queries, the AI bypassed standard security tools, eventually extracting live production data. The flaw also allowed attackers to rewrite Lilli’s system prompts, potentially poisoning responses for McKinsey’s 40,000+ users without requiring code changes just a single HTTP request. McKinsey patched the vulnerabilities within hours of disclosure on March 1, taking the development environment offline and securing API documentation. A company spokesperson confirmed no evidence of unauthorized client data access, though the incident underscores the growing threat of AI-driven cyberattacks. CodeWall’s CEO noted that the attack was fully autonomous, from target selection to exploitation, signaling a shift toward machine-speed intrusions by malicious actors. The firm’s findings highlight the risks of AI systems interacting with insecure databases and the potential for large-scale data manipulation.

McKinsey: AI agent hacked McKinsey chatbot for read-write access
Cyber Attack
Severity: 100
Impact: 5
Seen: 3/2026
Blog:
Supply Chain Source: NA
Rankiteo Explanation
Attack threatening the organization's existence

Description: AI Agent Exploits McKinsey’s Internal Chatbot in Under Two Hours Researchers at security startup CodeWall demonstrated how an autonomous AI agent hacked McKinsey’s internal generative AI platform, *Lilli*, gaining full read-and-write access to its production database within two hours. The attack, conducted in late February, exposed 46.5 million chat messages, 728,000 confidential client files, 57,000 user accounts, and 95 writable system prompts all in plaintext. The agent exploited an unauthenticated SQL injection vulnerability in Lilli’s API, which was publicly exposed through 22 unsecured endpoints. By manipulating JSON keys in user search queries, the AI bypassed standard security tools, eventually extracting live production data. The flaw also allowed attackers to rewrite Lilli’s system prompts, potentially poisoning responses for McKinsey’s 40,000+ users without requiring code changes just a single HTTP request. McKinsey patched the vulnerabilities within hours of disclosure on March 1, taking the development environment offline and securing API documentation. A company spokesperson confirmed no evidence of unauthorized client data access, though the incident underscores the growing threat of AI-driven cyberattacks. CodeWall’s CEO noted that the attack was fully autonomous, from target selection to exploitation, signaling a shift toward machine-speed intrusions by malicious actors. The firm’s findings highlight the risks of AI systems interacting with insecure databases and the potential for large-scale data manipulation.

Ailogo

MC Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

🔒
Incident Predictions locked
Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

🔒
A.I. Risk Score Predictions locked
Access Monitoring Plan
statics

Underwriter Stats for MC

Incidents vs Business Consulting and Services Industry Average (This Year)

McKinsey & Company has 35.48% fewer incidents than the average of same-industry companies with at least one recorded incident.

Incidents vs All-Companies Average (This Year)

McKinsey & Company has 13.79% fewer incidents than the average of all companies with at least one recorded incident.

Incident Types MC vs Business Consulting and Services Industry Avg (This Year)

McKinsey & Company reported 1 incidents this year: 1 cyber attacks, 0 ransomware, 0 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.

Incident History — MC (X = Date, Y = Severity)

MC cyber incidents detection timeline including parent company and subsidiaries

MC Company Subsidiaries

SubsidiaryImage

McKinsey & Company is a global management consulting firm. We are the trusted advisor to the world's leading businesses, governments, and institutions. We work with leading organizations across the private, public and social sectors. Our scale, scope, and knowledge allow us to address problems that no one else can. We have deep functional and industry expertise as well as breadth of geographical reach. We are passionate about taking on immense challenges that matter to our clients and, often, to the world. We work with our clients as we do with our colleagues. We build their capabilities and leadership skills at every level and every opportunity. We do this to help build internal support, get to real issues, and reach practical recommendations. We bring out the capabilities of clients to fully participate in the process and lead the ongoing work.

Loading...
similarCompanies

MC Similar Companies

As the leader in circular services at work, Elis ensures its clients achieve optimal hygiene, well-being and protection – everywhere, every day, in a sustainable way. We employ 54,000 people locally in 30 countries. We work for public and private organizations of all sizes, in all sectors of activi

Straive

At Straive, we operationalize Data Analytics and AI for global enterprises, working with several Fortune 500 companies. We don’t just build world-class data analytics and AI solutions—we embed them seamlessly into your core workflows. This drives greater efficiency, enhances user experience, and boo

Devoteam

Devoteam is a AI-driven tech consulting firm specialised in cloud platforms, cyber, data, and sustainability. Tech native for almost 30 years, Devoteam guides businesses through sustainable digital transformation to deliver value. With over 11,000 tech architects in more than 25 countries across

EY-Parthenon

Our unique combination of transformative strategy, transactions and corporate finance delivers real-world value – solutions that work in practice, not just on paper. Benefiting from EY’s full spectrum of services, we’ve reimagined strategic consulting to work in a world of increasing complexity. Wi

Capgemini Invent

Capgemini Invent is the digital innovation, consulting and transformation brand of the Capgemini Group, a global business line that combines market leading expertise in strategy, technology, data science and creative design, to help CxOs envision and build what’s next for their businesses. For more

Ayesa

Ayesa is a global provider of technology and engineering services with more than 11500 employees in twenty-three countries across Europe, Latin America, Africa and Asia. The company develops and implements digital solutions for the private and public sector and uses the latest technology to provide

Jacobs

At Jacobs, we're challenging today to reinvent tomorrow – delivering outcomes and solutions for the world's most complex challenges. With a team of approximately 45,000, we provide end-to-end services in advanced manufacturing, cities & places, energy, environmental, life sciences, transportation an

Conduent

Conduent delivers digital business solutions and services spanning the commercial, government and transportation spectrum – creating valuable outcomes for its clients and the millions of people who count on them. We leverage cloud computing, artificial intelligence, machine learning, automation and

Boston Consulting Group (BCG)

Boston Consulting Group partners with leaders in business and society to tackle their most important challenges and capture their greatest opportunities. BCG was the pioneer in business strategy when it was founded in 1963. Today, we work closely with clients to embrace a transformational approach a

newsone

MC CyberSecurity News

March 28, 2026 12:37 PM
IIM-Ahmedabad 2026 Placement: BCG, McKinsey, Goldman Sachs among top recruiters

In the consulting domain, Boston Consulting Group emerged as the largest recruiter with 33 offers, followed by McKinsey & Company (21) and...

March 27, 2026 09:27 AM
The man who watches over the world for McKinsey: "Every 20 or 30 years there is a major leap of era that changes the rules of the game"

The work of Jeongmin Seong (South Korea, 1977) is to watch over the world for McKinsey, the most powerful consultancy on the planet.

March 26, 2026 03:23 PM
McKinsey has expanded its leadership training program for top brass, which includes coaching by Navy SEALs

McKinsey has doubled its leadership programming participation in less than two years, as pressure mounts on senior partners.

March 26, 2026 12:59 AM
Mamdani Now Plans $1.3 Billion in Cuts in Programs That He Favored

Mayor Zohran Mamdani is banking on savings from a delay he is seeking in the state mandate for smaller class sizes. He is also scaling back...

March 25, 2026 02:52 PM
Report: NYC Mayor Mamdani signals he’s ‘highly unlikely’ to go through with property tax hike

Five weeks after floating the tax increase, the mayor appears to be retreating from the plan, according to a report.

March 25, 2026 12:00 AM
State of AI trust in 2026: Shifting to the agentic era

Findings from McKinsey's 2026 AI Trust Maturity Survey reveal progress in trust maturity, alongside persistent gaps in strategy, governance,...

March 24, 2026 12:00 AM
Securing the agentic enterprise: Opportunities for cybersecurity providers

The rise of agentic AI is reshaping enterprise cybersecurity risk, requiring new priorities for the CISO and creating fresh opportunities...

March 24, 2026 12:00 AM
Megadeals propel M&A activity

March 24, 2026 After dealmaking slowed momentarily in early 2025, global M&A activity quickly assumed a grand scale—delivering big gains for...

March 23, 2026 12:00 AM
Infrastructure: Investing to support global growth

In McKinsey's Global Banking Annual Review 2025 McKinsey's annual Global infrastructure report, we explore how private capital is scaling to...

faq

Frequently Asked Questions

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.

MC CyberSecurity History Information

Official Website of McKinsey & Company

The official website of McKinsey & Company is http://www.mckinsey.com.

McKinsey & Company’s AI-Generated Cybersecurity Score

According to Rankiteo, McKinsey & Company’s AI-generated cybersecurity score is 815, reflecting their Good security posture.

How many security badges does McKinsey & Company’ have ?

According to Rankiteo, McKinsey & Company currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has McKinsey & Company been affected by any supply chain cyber incidents ?

According to Rankiteo, McKinsey & Company has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does McKinsey & Company have SOC 2 Type 1 certification ?

According to Rankiteo, McKinsey & Company is not certified under SOC 2 Type 1.

Does McKinsey & Company have SOC 2 Type 2 certification ?

According to Rankiteo, McKinsey & Company does not hold a SOC 2 Type 2 certification.

Does McKinsey & Company comply with GDPR ?

According to Rankiteo, McKinsey & Company is not listed as GDPR compliant.

Does McKinsey & Company have PCI DSS certification ?

According to Rankiteo, McKinsey & Company does not currently maintain PCI DSS compliance.

Does McKinsey & Company comply with HIPAA ?

According to Rankiteo, McKinsey & Company is not compliant with HIPAA regulations.

Does McKinsey & Company have ISO 27001 certification ?

According to Rankiteo,McKinsey & Company is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Industry Classification of McKinsey & Company

McKinsey & Company operates primarily in the Business Consulting and Services industry.

Number of Employees at McKinsey & Company

McKinsey & Company employs approximately 38,633 people worldwide.

Subsidiaries Owned by McKinsey & Company

McKinsey & Company presently has no subsidiaries across any sectors.

McKinsey & Company’s LinkedIn Followers

McKinsey & Company’s official LinkedIn profile has approximately 6,920,938 followers.

NAICS Classification of McKinsey & Company

McKinsey & Company is classified under the NAICS code 5416, which corresponds to Management, Scientific, and Technical Consulting Services.

McKinsey & Company’s Presence on Crunchbase

No, McKinsey & Company does not have a profile on Crunchbase.

McKinsey & Company’s Presence on LinkedIn

Yes, McKinsey & Company maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/mckinsey.

Cybersecurity Incidents Involving McKinsey & Company

As of April 02, 2026, Rankiteo reports that McKinsey & Company has experienced 1 cybersecurity incidents.

Number of Peer and Competitor Companies

McKinsey & Company has an estimated 19,100 peer or competitor companies worldwide.

What types of cybersecurity incidents have occurred at McKinsey & Company ?

Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack.

How does McKinsey & Company detect and respond to cybersecurity incidents ?

Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with took development environment offline, secured api documentation, and remediation measures with patched sql injection vulnerability, and communication strategy with company spokesperson confirmed no unauthorized client data access..

Incident Details

Can you provide details on each incident ?

Incident : AI-driven cyberattack

Title: AI Agent Exploits McKinsey’s Internal Chatbot in Under Two Hours

Description: Researchers at security startup CodeWall demonstrated how an autonomous AI agent hacked McKinsey’s internal generative AI platform, *Lilli*, gaining full read-and-write access to its production database within two hours. The attack exposed 46.5 million chat messages, 728,000 confidential client files, 57,000 user accounts, and 95 writable system prompts in plaintext. The agent exploited an unauthenticated SQL injection vulnerability in Lilli’s API, bypassing standard security tools and potentially poisoning responses for McKinsey’s 40,000+ users.

Date Detected: 2024-02-29

Date Resolved: 2024-03-01

Type: AI-driven cyberattack

Attack Vector: Unauthenticated SQL injection via API

Vulnerability Exploited: Unauthenticated SQL injection in Lilli’s API, publicly exposed endpoints

Threat Actor: CodeWall (security researchers)

Motivation: Demonstration of AI-driven exploitation risks

What are the most common types of attacks the company has faced ?

Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.

How does the company identify the attack vectors used in incidents ?

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Unauthenticated SQL injection in Lilli’s API.

Impact of the Incidents

What was the impact of each incident ?

Incident : AI-driven cyberattack MCK1773109656

Data Compromised: 46.5 million chat messages, 728,000 confidential client files, 57,000 user accounts, 95 writable system prompts

Systems Affected: McKinsey’s internal generative AI platform (*Lilli*)

Operational Impact: Potential poisoning of AI responses for 40,000+ users

Brand Reputation Impact: Undermined trust in AI security

What types of data are most commonly compromised in incidents ?

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Chat Messages, Confidential Client Files, User Accounts, System Prompts and .

Which entities were affected by each incident ?

Incident : AI-driven cyberattack MCK1773109656

Entity Name: McKinsey & Company

Entity Type: Consulting firm

Industry: Management consulting

Size: 40,000+ users

Response to the Incidents

What measures were taken in response to each incident ?

Incident : AI-driven cyberattack MCK1773109656

Containment Measures: Took development environment offline, secured API documentation

Remediation Measures: Patched SQL injection vulnerability

Communication Strategy: Company spokesperson confirmed no unauthorized client data access

Data Breach Information

What type of data was compromised in each breach ?

Incident : AI-driven cyberattack MCK1773109656

Type of Data Compromised: Chat messages, Confidential client files, User accounts, System prompts

Number of Records Exposed: 46.5 million chat messages, 728,000 files, 57,000 accounts, 95 prompts

Sensitivity of Data: High (confidential client files, plaintext data)

Data Encryption: No (plaintext)

What measures does the company take to prevent data exfiltration ?

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Patched SQL injection vulnerability.

How does the company handle incidents involving personally identifiable information (PII) ?

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by took development environment offline and secured api documentation.

Lessons Learned and Recommendations

What lessons were learned from each incident ?

Incident : AI-driven cyberattack MCK1773109656

Lessons Learned: Risks of AI systems interacting with insecure databases, potential for large-scale data manipulation via AI-driven attacks

What recommendations were made to prevent future incidents ?

Incident : AI-driven cyberattack MCK1773109656

Recommendations: Secure API endpoints, implement authentication for database access, monitor AI system interactions for anomalies

What are the key lessons learned from past incidents ?

Key Lessons Learned: The key lessons learned from past incidents are Risks of AI systems interacting with insecure databases, potential for large-scale data manipulation via AI-driven attacks.

What recommendations has the company implemented to improve cybersecurity ?

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Secure API endpoints, implement authentication for database access and monitor AI system interactions for anomalies.

References

Where can I find more information about each incident ?

Incident : AI-driven cyberattack MCK1773109656

Source: CodeWall research

Where can stakeholders find additional resources on cybersecurity best practices ?

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: CodeWall research.

Investigation Status

What is the current status of the investigation for each incident ?

Incident : AI-driven cyberattack MCK1773109656

Investigation Status: Resolved

How does the company communicate the status of incident investigations to stakeholders ?

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Company spokesperson confirmed no unauthorized client data access.

Initial Access Broker

How did the initial access broker gain entry for each incident ?

Incident : AI-driven cyberattack MCK1773109656

Entry Point: Unauthenticated SQL injection in Lilli’s API

Post-Incident Analysis

What were the root causes and corrective actions taken for each incident ?

Incident : AI-driven cyberattack MCK1773109656

Root Causes: Unauthenticated SQL injection vulnerability, publicly exposed API endpoints, insecure database interactions

Corrective Actions: Patched vulnerability, secured API documentation, took development environment offline

What corrective actions has the company taken based on post-incident analysis ?

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Patched vulnerability, secured API documentation, took development environment offline.

Additional Questions

General Information

Who was the attacking group in the last incident ?

Last Attacking Group: The attacking group in the last incident was an CodeWall (security researchers).

Incident Details

What was the most recent incident detected ?

Most Recent Incident Detected: The most recent incident detected was on 2024-02-29.

What was the most recent incident resolved ?

Most Recent Incident Resolved: The most recent incident resolved was on 2024-03-01.

Impact of the Incidents

What was the most significant data compromised in an incident ?

Most Significant Data Compromised: The most significant data compromised in an incident were 46.5 million chat messages, 728,000 confidential client files, 57,000 user accounts and 95 writable system prompts.

Response to the Incidents

What containment measures were taken in the most recent incident ?

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Took development environment offline and secured API documentation.

Data Breach Information

What was the most sensitive data compromised in a breach ?

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were 46.5 million chat messages, 728,000 confidential client files, 57,000 user accounts and 95 writable system prompts.

What was the number of records exposed in the most significant breach ?

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 47.3M.

Lessons Learned and Recommendations

What was the most significant lesson learned from past incidents ?

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Risks of AI systems interacting with insecure databases, potential for large-scale data manipulation via AI-driven attacks.

What was the most significant recommendation implemented to improve cybersecurity ?

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Secure API endpoints, implement authentication for database access and monitor AI system interactions for anomalies.

References

What is the most recent source of information about an incident ?

Most Recent Source: The most recent source of information about an incident is CodeWall research.

Investigation Status

What is the current status of the most recent investigation ?

Current Status of Most Recent Investigation: The current status of the most recent investigation is Resolved.

Initial Access Broker

What was the most recent entry point used by an initial access broker ?

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Unauthenticated SQL injection in Lilli’s API.

cve

Latest Global CVEs (Not Company-Specific)

Description

A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the component TTF File Handler. Performing a manipulation results in out-of-bounds read. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Risk Information
cvss2
Base: 5.0
Severity: LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
cvss3
Base: 4.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
cvss4
Base: 5.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!get_macro_mem_COM. Opening a crafted V7 file may lead to information disclosure from the affected product.

Risk Information
cvss3
Base: 7.8
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cvss4
Base: 8.4
Severity: LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CSaveData::_conv_AnimationItem. Opening a crafted V7 file may lead to arbitrary code execution on the affected product.

Risk Information
cvss3
Base: 7.8
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cvss4
Base: 8.4
Severity: LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information disclosure from the affected product.

Risk Information
cvss3
Base: 7.8
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cvss4
Base: 8.4
Severity: LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a crafted V7 file may lead to information disclosure from the affected product.

Risk Information
cvss3
Base: 7.8
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cvss4
Base: 8.4
Severity: LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Access Data Using Our API

SubsidiaryImage

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=mckinsey' -H 'apikey: YOUR_API_KEY_HERE'

What Do We Measure ?

revertimgrevertimgrevertimgrevertimg
Incident
revertimgrevertimgrevertimgrevertimg
Finding
revertimgrevertimgrevertimgrevertimg
Grade
revertimgrevertimgrevertimgrevertimg
Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network Security

Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)

Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)

Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat Intelligence

Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Top LeftTop RightBottom LeftBottom Right
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
Users Love Us Badge