🔍 源码独立审计

对 （未定位到源码） 源码进行独立审计（置信度 60%）。

🧬 根因独立理解

<p><strong>摘要：</strong>CVE-2026-16232 是 Check Point SmartConsole 登录流程中的一个身份验证绕过漏洞，CVSS 评分为 9.1，属严重级别。未经身份验证的远程攻击者可利用该漏洞获取应用登录令牌，并以完全管理权限认证进入管理平面，进而修改安全策略与安全配置。Check Point 已确认该漏洞正在被利用，且影响了极少数客户。本文将从根因、影响与缓解三个维度进行深度技术剖析。</p> <h2>📌 漏洞概述</h2> <p>CVE-2026-16232 是 Check Point SmartConsole 组件中的一个不当身份验证（Improper Authentication）漏洞。SmartConsole 是 Check Point 统一安全管理客户端，用于策略编辑、日志查看、设备管理等操作。该漏洞允许未认证的远程攻击者在无需任何凭据的情况下，通过特制的网络请求绕过 SmartConsole 登录认证流程，获取一个合法的应用登录令牌，并以此令牌调用管理接口，最终获得具有完全管理员权限的会话。</p> <ul> <li><strong>CVE 编号：</strong>CVE-2026-16232</li> <li><strong>CVSS v3.x 评分：</strong>9.1（Critical）</li> <li><strong>攻击向量：</strong>网络远程（AV:N）</li> <li><strong>攻击复杂度：</strong>低（AC:L）</li> <li><strong>所需权限：</strong>无（PR:N）</li> <li><strong>影响范围：</strong>Check Point Multi-Domain Security Management、Check Point Quantum Security Management</li> <li><strong>利用条件：</strong>攻击者可访问管理服务器 IP，且未配置 Trusted Clients 限制（或限制不当）</li> <li><strong>漏洞类型：</strong>CWE-287：Improper Authentication（身份验证不当）</li> </ul> <p>值得注意的是，该漏洞已被 CISA 列入已知被利用漏洞目录（CISA-KEV），且 Check Point 官方确认已有在野利用。由于未公开漏洞细节，目前尚无公开的 Exploit-DB 完整利用代码，但社区中已出现针对相关配置审计的辅助工具（如 GitHub 仓库 Check-Point-Trusted-Access-Review），可用于检测环境中是否存在与 CVE-2026-16232 关联的错误配置。</p> <h2>🔬 漏洞根因分析</h2> <p>从漏洞命名和 CWE-287 分类来看，CVE-2026-16232 的根因在于 SmartConsole 登录流程对身份验证凭证的验证逻辑存在缺陷，导致攻击者可以绕过正常的用户名/密码或证书验证，直接获取应用会话令牌。结合 Check Point 官方公告提及的“Trusted Clients”配置，我们可以推断该漏洞与 SmartConsole 的 RPC/HTTPS 服务在处理登录请求时的认证状态校验不严格有关。</p> <p>SmartConsole 与管理服务器之间的通信通常基于 Check Point 专有的 RCP（Check Point 的远程调用协议）或 HTTPS 之上的管理 API。在正常流程中，客户端首先向管理服务器的登录端口发送认证请求，服务器验证用户凭据（如密码、Radius、AD/LDAP 等）后，返回一个短期有效的登录令牌（Login Token）。后续所有管理操作均需携带该令牌，以此表明请求已通过身份验证。</p> <p>然而，该漏洞的关键在于：攻击者可能通过某种方式（例如篡改客户端发送的认证请求中的用户名字段、利用特殊空值或编码异常，或直接调用一个未受保护的令牌签发接口）使服务器错误地认为认证已经成功，从而签发一个具有超级管理员权限的令牌。由于该漏洞无需任何预认证信息，且攻击复杂度低，攻击者只需要构造一个精心设计的请求包发往管理服务器的监听端口（通常是 TCP 443 或 19009 等），即可触发认证绕过。</p> <p>更深入的分析指向一个常见的不当认证模式：服务器在处理登录请求时，若用户提交的用户名或密码字段为空、格式异常或包含特定控制字符，部分实现会跳过实际的密码校验，直接进入授权阶段。另一个可能是在多域环境（Multi-Domain Security Management）中，域名解析逻

🛤️ 漏洞触发链路

🧪 PoC 复现

从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。

📋 代码元数据语言md来源WadesWeaponShed/Check-Point-Trusted-Access-Review针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明

# Check Point Trusted Access Review

PLEASE ALWAYS APPLY VENDOR PATCHES AS QUICKLY AS POSSIBLE

Local web app for conducting a Check Point Trusted Access Review with trusted Check Point Management API commands. Most checks are review-only. Any available remediation action requires explicit operator approval.

This scanner is built specifically to look for configuration issues around CVE-2026-16232 (https://support.checkpoint.com/results/sk/sk185169),
CVE-2026-62144 (https://support.checkpoint.com/results/sk/sk185152),
and CVE-2026-62145 (https://support.checkpoint.com/results/sk/sk185153)

It will allow you scan and remediate uses of ANY as well as scan logs looking for potential bad actors.

This tool is not created or supported by Check Point and should be used at your own risk.

## Self-Contained Releases

Prebuilt versions are available under [`dist/`](dist/) for users who do not want to install Node.js,
npm,Git,or the source code:

- **Windows x64:** [`dist/windows-x64/`](dist/windows-x64/) contains the standalone `.exe` and a matching ZIP.
- **macOS Apple Silicon:** [`dist/macos-apple-silicon/`](dist/macos-apple-silicon/) contains the distributable `.app` ZIP,extracted app,and standalone arm64 executable.

The self-contained releases include the Node.js runtime,web interface,backend,
and direct PDF report generator. They bind only to `127.0.0.1`,prefer port `4000`,automatically try `4001`,`4002`,and higher ports when needed,and open the selected local URL in the default browser.

For GitHub,
publish the platform ZIPs—and optionally the Windows `.exe`—as **GitHub Release assets**. Users should not download `node_modules` or the source tree merely to run a self-contained release. See [`dist/README.md`](dist/README.md) for the artifact layout.

The current app is aligned to the Check Point Gateway and Management Hardening Administration Guide.

This tool is not created or supported by Check Point and should be used at your own risk.

The app runs locally,
logs in to a Check Point Security Management Server or MDS,scans available Management API evidence,and presents guide-aligned hardening checks. Most checks are review-only;specific remediation actions are offered only when explicitly implemented and require operator approval. Checks that require network design review,Gaia Portal,Gaia API,SSH/Clish,identity provider settings,
or out-of-band management inspection are marked for manual validation.

## What It Checks

The scanner currently covers these hardening-guide areas:

- Security Gateway stealth rule review.
- Implied rules and implied-rule logging review.
- Management Server protected-segment and administrative source restriction review.
- SmartConsole trusted client restriction evidence.
- Administrator account,
MFA,password,idle timeout,expiration,and lockout review.
- MFA and external Identity Provider administrative authentication review.
- Least-privilege integration credential review.
- Dynamic updates / AutoUpdater consent evidence.
- cpdiag / diagnostics and telemetry consent evidence.
- Gaia OS hardening review inventory for gateways.
- SNMP,syslog,Expert mode,LOM,
and advanced implied-rule replacement manual checks.
- Security Feature Usage review for licensed blades and feature expiration evidence.

## Workflow

1. Log in with a Check Point Management API user.
2. Click **Scan Hardening Posture**.
3. Review pass,remediation-required,needs-review,manual,
and unknown findings.
4. Use the evidence and guide section references to drive operator validation.

For MDS environments,
enable **MDS Scan** on the login form. This exposes two fields that matter:

- **Domain** selects the Management API domain context for domain-level policy and object checks.
- **Global MDS Object Name** names the actual MDS object used for Gaia `run-script` checks against the box itself. This is required when the login host is the MDS IP but the selected API domain is a CMA/domain,
because commands such as `run-script` must target the MDS object name,not the MDS IP or the CMA/domain IP.

When **MDS Scan** is enabled,the app creates two Check Point Management API sessions:

- A domain/CMA session logs in with the selected **Domain** and is used for domain-level objects,policy packages,access rules,administrators,trusted clients,
and other normal domain checks.
- An MDS/global session logs in to the same Management host without a domain and is used only for Gaia `run-script` commands that target the **Global MDS Object Name**. This is necessary for checks that inspect the MDS server operating system itself,such as management server interface/default-route discovery,Gaia administrator settings,Gaia password policy,SNMP,
and management server syslog forwarding.
- A Global domain session is also opened when available. This is used when a domain policy is installed under a Global Policy layer and the app needs to read Global parent access rules above the domain placeholder.

In `mgmt_cli` terms,the domain checks behave like commands that include `--domain "<Domain>"`,
while MDS host checks behave like `mgmt_cli -r true run-script targets.1 "<Global MDS Object Name>" ...` executed in the global MDS context.

Some MDS checks intentionally evaluate more than one management plane. For example,**Restrict Administrative Source IP Addresses** evaluates both the MDS/global management host IP and the selected Domain/CMA IP. For each IP,
it attempts to resolve the matching object in the selected domain,checks network objects and address ranges containing the IP,follows groups containing those objects,and then collects access rules that reference them. If the matching domain rule is under a Global Policy parent layer,
the app reads the Global access rulebase up to `Placeholder for domain rules` and includes those Global rules in the same Policy Package evidence table with a `GLOBAL RULES` marker.

For Smart-1 Cloud,enable **Smart-1 Cloud context URL** on the login form and enter the Management host with its context path,
for example:

```text
tenant-name.maas.checkpoint.com/context-id/web_api
```

The app preserves that path and sends API requests to:

```text
https://tenant-name.maas.checkpoint.com/context-id/web_api/<command>```

This matches the `mgmt_cli` Smart-1 Cloud context structure:

```bash
mgmt_cli -m tenant-name.maas.checkpoint.com --session-id <sid>
--context context-id/web_api <cli_command>```

When **Smart-1 Cloud context URL** is enabled,checks that require direct access to a customer-owned Management Server Gaia object are skipped. In practice,this removes the **Management Plane Protection** checks such as **Protect Management Server Behind A Firewall** and **Restrict Administrative Source IP Addresses**,
because the management server is hosted by Check Point and does not exist as a normal customer-managed Gaia object in the tenant domain.

The scan summary shows the current scan time and the previous scan recorded by the local app,
including the Management API username that ran it. This history is kept in memory and resets when the local Node process restarts.

### Large Environment Mode

The login form includes **Large environment mode** for MDS or large multi-gateway environments. This mode does not skip checks or change evidence collection. It lowers scan pressure against the Management API by throttling concurrent API requests and Gaia `run-script` tasks during a full scan.

Default standard scan behavior:

- Management API collection commands run as fast as the local Node process schedules them.
- Gaia `run-script` collection is limited by `RUN_SCRIPT_CONCURRENCY`,
which defaults to `8`.
- Administrator last-login audit queries use `show-logs` and are serialized by `SHOW_LOGS_CONCURRENCY`,which defaults to `1`.
- `show-task` polling waits `750 ms` between polling attempts.

Large environment mode behavior:

- Management API scan calls are throttled by `LARGE_ENV_API_CONCURRENCY`,
which defaults to `10`.
- Gaia `run-script` collection is limited by `LARGE_ENV_RUN_SCRIPT_CONCURRENCY`,which defaults to `3`.
- `show-logs` administrator last-login lookups remain serialized by `SHOW_LOGS_CONCURRENCY` to avoid parallel audit-search pressure.
- `show-task` polling waits `LARGE_ENV_TASK_POLL_INTERVAL_MS`,
which defaults to `1250 ms`.
- Gaia `run-script` task output polling uses `TASK_POLL_ATTEMPTS`,
which defaults to `20`. This is helpful when Smart-1 Cloud or remote gateways accept the `run-script` request before the decoded `show-task details-level full` output is ready.
- Security Gateway Stealth Rule checks use `show-access-rulebase` first in Large environment mode and Smart-1 Cloud mode. This avoids one `where-used details-level full` call per gateway,
which can be expensive or time out in large/MDS/Smart-1 Cloud environments.

These values can be tuned with environment variables before starting the local backend:

```sh
LARGE_ENV_API_CONCURRENCY=8 LARGE_ENV_RUN_SCRIPT_CONCURRENCY=2 LARGE_ENV_TASK_POLL_INTERVAL_MS=1500 TASK_POLL_ATTEMPTS=20 TASK_POLL_INTERVAL_MS=1000 SHOW_LOGS_CONCURRENCY=1 CP_LOG_API_TIMEOUT_MS=120000 CP_VPN_API_TIMEOUT_MS=120000 VPN_COMMUNITY_PAGE_LIMIT=50 npm start
```

Administrator last-login checks query SmartConsole audit logins with a filter equivalent to `administrator:<name>
AND SmartConsole AND "Log In"`. `CP_LOG_API_TIMEOUT_MS` controls the timeout for these `show-logs` requests separately from normal Management API calls.

CVE IKE VPN community checks page `show-vpn-communities-star` and `show-vpn-communities-meshed` with `VPN_COMMUNITY_PAGE_LIMIT`,which defaults to `50`,and use `CP_VPN_API_TIMEOUT_MS`,
which defaults to `120000 ms`. This keeps Smart-1 Cloud and MDS scans from requesting very large `details-level full` VPN community payloads in one call.

Use this mode when scanning production MDS environments,busy management servers,
or deployments with dozens of gateways where protecting `fwm` / Management API responsiveness is more important than the absolute fastest scan time.

Some checks require operator review even when the automated high-risk condition is absent. SmartConsole trusted clients,administrator accounts,
and administrator password / idle timeout / expiration / lockout policy checks can be marked reviewed. In the same login session,the status changes to **Reviewed**. A new login changes the status back to **Needs review**,
while the last review approval remains visible with the logged-in Management API username and timestamp.

For the administrator password / idle timeout / expiration / lockout policy check,
operators can also mark the check reviewed while it is **Remediation Required**. The app warns that the operator is accepting settings Check Point does not recommend before recording that review.

The top summary combines **Remediation Required** and **Remediation Recommended** findings into one **Remediation Needed** count.

## Security Notes

- The app defaults to HTTPS when connecting to the Check Point management server.
- Do not enter the management server as `http://...`;
that would send the Check Point API login over cleartext HTTP.
- The browser talks to the local backend over `http://127.0.0.1:4000` by default,
or the next available local port.
- The username and password are sent from the browser to the local backend only on localhost.
- The backend sends the username and password to Check Point through the Management API login request.
- Passwords are not logged by the app.
- The Check Point session ID is stored only in server memory for the life of the local Node process.
- The **Allow self-signed certificate** option keeps TLS encryption but disables certificate validation. Use it only when needed.
- Remediation actions require explicit operator approval in the browser before the backend sends a change command.

## API Commands Used

The backend proxies these Check Point Management API commands:

- `login`
- `logout`
- `show-trusted-clients`
- `delete-trusted-client`
- `show-api-settings`
- `set-api-settings`
- `publish`
- `discard`
- `show-administrators`
- `delete-administrator`
- `show-default-administrator-settings`
- `set-default-administrator-settings`
- `show-smart-console-idle-timeout`
- `set-smart-console-idle-timeout`
- `show-login-restrictions`
- `show-cp-password-requirements`
- `set-cp-password-requirements`
- `show-simple-gateways`
- `show-global-properties`
- `set-global-properties`
- `run-script`
- `show-task`
- `insights/v3.0/show-suggestions-summary`
- `insights/v3.0/show-suggestions`

The Security Feature Usage check runs a Gaia `run-script` against each managed gateway target:

```sh
mgmt_cli run-script script-name "show license" targets.1 "GATEWAY_OBJECT_NAME" script "clish -c 'show license status'" --format json
mgmt_cli show-task task-id "<task-id>" details-level full --format json
```

The app decodes `task-details[].responseMessage`,
extracts known blade codes such as `FW`,`VPN`,`IPS`,and `URLF` from license feature/date rows,and also includes perpetual built-in blade codes from the top feature line (`FW`,`VPN`,`IA`). Appliance/model/term suffixes such as `3950-2Y` are ignored,and known blade codes are translated into human-readable blade names such as `IPS`,`URL Filtering`,
or `Anti-Bot`. Evidence is grouped by gateway with compact `License Feature`,`Expiration Date`,and `Enabled/Disabled` tables. The enabled state is read from `show gateways-and-servers details-level full` under `network-security-blades`;
missing blade keys are treated as disabled. Advanced DNS Security is marked for manual confirmation in the assigned Threat Profile because it is not exposed as a normal gateway blade flag.

The SmartConsole trusted clients check runs the equivalent of:

```sh
mgmt_cli -r true show trusted-clients --domain "System Data" details-level full --format json
```

The webapp logs in to the Management API domain `System Data`,
pulls trusted client `name`,`type`,and type-specific IP data,and displays them in an evidence table. It marks the check as **Remediation Required** when a returned object has `type` set to `any`.

When a trusted client object has `type` set to `any`,
the app offers the first remediation action. It looks up that object's actual `uid` and runs the equivalent of:

```sh
mgmt_cli delete trusted-client uid "<returned-any-object-uid>" --domain "System Data"
mgmt_cli publish --domain "System Data"
```

If publish fails after the delete command,
the app attempts `discard` in the same `System Data` session so the object is not left locked by an unpublished change.

The trusted clients evidence table also lets operators select one or more returned trusted client objects and delete them from the webapp. The app validates the selected `uid` values against the current `show-trusted-clients` output,
then runs the equivalent of:

```sh
mgmt_cli delete trusted-client uid "<selected-trusted-client-uid>" --domain "System Data"
mgmt_cli publish --domain "System Data"
```

For multiple selected clients,the delete command is run once per selected `uid`,followed by a single publish. If a delete or publish fails after changes begin,
the app attempts `discard` in the same `System Data` session.

The implied rules logging check runs the equivalent of:

```sh
mgmt_cli -r true show global-properties details-level full --format json
```

The webapp pulls every key/value pair inside the returned `firewall` object and displays it in a table. If `log-implied-rules` is `false`,
the check is marked **Remediation Required** and the row offers an inline remediation button that runs the equivalent of:

```sh
mgmt_cli set global-properties firewall.log-implied-rules true
mgmt_cli publish
```

The Management API Access check runs the equivalent of:

```sh
mgmt_cli -r true show api-settings --domain "System Data" --format json
```

The webapp displays the `accepted-api-calls-from` value. If it is `all ip addresses`,
the check is marked **Remediation Required** and offers the equivalent of:

```sh
mgmt_cli set api-settings accepted-api-calls-from "all ip addresses that can be used for gui clients" --domain "System Data" --format json
mgmt_cli publish --domain "System Data"
```

If API access is already limited to GUI clients,
the check displays the trusted clients evidence table for review.

The Policy Insights checks run read-only Access Control Insights calls:

```sh
mgmt_cli insights/v3.0/show-suggestions-summary --method POST --format json
mgmt_cli insights/v3.0/show-suggestions --method POST --format json
```

The detailed suggestions request is filtered for `unused-objects`,`tighten-rule`,`delete-disabled-rule`,
and `zero-hits-rule`,with a first-page limit of 50 suggestions.

The administrator account review runs the equivalent of:

```sh
mgmt_cli -r true show-administrators --domain "System Data" details-level full --format json
```

The webapp logs in to the Management API domain `System Data` for this collection step,then displays an evidence table with `Name`,`Permission Profile Name`,
`Authentication-Method`,and `expiration-date`. Expiration values are converted from `iso-8601` into a human-readable date and time. Administrators without an `expiration-date` key are shown as `Never`.

The MFA and Identity Provider Integration check uses `show default-administrator-settings` to display the default `authentication-method`,
then uses `show-administrators` to list administrators whose `authentication-method` is `check point password` or `os password`. If the default method or any administrator uses password-based authentication,the check is marked **Remediation Recommended**. Operators can mark the section reviewed,
and the same reviewed-by history pattern is shown. The check includes a setup-help button with SmartConsole and external IdP SAML configuration guidance.

The administrator account table lets operators select one or more returned administrator objects and delete them from the webapp. The app validates the selected `uid` values against the current `show-administrators` output,
then runs the equivalent of:

```sh
mgmt_cli delete administrator uid "<selected-administrator-uid>" --domain "System Data"
mgmt_cli publish --domain "System Data"
```

For multiple selected administrators,the delete command is run once per selected `uid`,followed by a single publish. If a delete or publish fails after changes begin,
the app attempts `discard` in the same `System Data` session.

The administrator password,idle timeout,expiration,
and lockout policy check runs the equivalent of:

```sh
mgmt_cli show default-administrator-settings --domain "System Data" --format json
mgmt_cli show smart-console-idle-timeout --domain "System Data" --format json
mgmt_cli show login-restrictions --domain "System Data" --format json
mgmt_cli show cp-password-requirements --domain "System Data" --format json
```

The webapp displays the returned settings in a `Setting`,
`Value`,and `State` table. Default administrator expiration set to `never`,disabled SmartConsole idle timeout,disabled admin account lockout,disabled automatic unlock,or `min-password-length` less than `10` are marked as needing remediation.

When the default administrator authentication method is `check point password`,
the `State` column recommends using an authentication method that supports MFA or an external Identity Provider.

For default administrator expiration,the `State` column displays the returned expiration detail: a formatted `expiration-date` value,
or the `expiration-period` plus `expiration-period-time-units` value when the type is `expiration-period`.

When default administrator expiration is set to `never`,
the app offers a recommended remediation action. It runs the equivalent of:

```sh
mgmt_cli set default-administrator-settings expiration-type "expiration period" expiration-period "4" expiration-period-time-units "months" --domain "System Data" --format json
mgmt_cli publish --domain "System Data"
```

If publish fails after the settings change,
the app attempts `discard` in the same `System Data` session so the setting is not left locked by an unpublished change.

When SmartConsole idle timeout is disabled,
the app offers a recommended remediation action. It runs the equivalent of:

```sh
mgmt_cli set smart-console-idle-timeout enabled true timeout-duration "10" --domain "System Data" --format json
mgmt_cli publish --domain "System Data"
```

If publish fails after the idle timeout change,the app attempts `discard` in the same `System Data` session.

When minimum password length is less than `10`,
the app offers a recommended remediation action. It runs the equivalent of:

```sh
mgmt_cli set cp-password-requirements min-password-length "10" --domain "System Data" --format json
mgmt_cli publish --domain "System Data"
```

If publish fails after the password requirement change,
the app attempts `discard` in the same `System Data` session.

## Install and Run

Running from source requires Node.js 18 or newer and the npm dependencies declared in `package.json`. Users of the self-contained releases do not need Node.js,npm,
or Git.

### macOS From Source

1. Install Node.js 18 or newer from [nodejs.org](https://nodejs.org/) or Homebrew.

   ```sh
   brew install node
   ```

2. Download or clone this project.

   ```sh
   git clone <repo-url>
cd "Check Point Trusted Access Review"
   ```

3. Install dependencies and start the local app.

   ```sh
   npm install
   npm start
   ```

4. Open the app.

   ```text
   http://127.0.0.1:4000
   ```

### Windows From Source

1. Install Node.js 18 or newer from [nodejs.org](https://nodejs.org/).

2. Download and extract the project ZIP,
or clone the repository with Git for Windows.

   ```powershell
   git clone <repo-url>
cd "Check Point Trusted Access Review"
   ```

3. Install dependencies and start the local app.

   ```powershell
   npm install
   npm start
   ```

4. Open the app in a browser.

   ```text
   http://127.0.0.1:4000
   ```

### Optional Port Change

By default the app prefers `127.0.0.1:4000` and automatically moves upward if the port is occupied. To require a specific port:

macOS:

```sh
PORT=4500 npm start
```

Windows PowerShell:

```powershell
$env:PORT = "4500"
npm start
```

Then open:

```text
http://127.0.0.1:4500
```

## Troubleshooting

The server prints request diagnostics to the terminal. A successful login attempt will show lines similar to:

```text
Local API request requestId=abc12345 route=/api/login
Login request received target=https://mgmt.example.com/web_api/login user=admin
Check Point API request starting command=login target=https://mgmt.example.com/web_api/login
```

If the browser shows a login error with a request ID but packet capture shows no outbound attempt to the management server,
compare the terminal `target=` value with your packet capture filter.

If there is no `Local API request` line at all,the browser is not reaching the local backend. Confirm the app is running and that you opened the correct local URL.

⚔️ EXP 利用代码

截至分析时，Exploit-DB 未收录该 CVE 的公开利用代码。可利用上述 PoC 进行验证，或关注 Exploit-DB 更新。

🕵️ 检测指纹

当前规则库未收录针对该 CVE 的专用检测规则。建议：

• 根据漏洞根因编写 Nuclei 检测模板
• 在 WAF/IDS 中配置针对漏洞特征的规则
• 关注漏洞指纹库更新

🤖 高危漏洞深度独立研究引擎生成 · 2026-08-02 12:02