ISO 27001 Certificate
SOC 1 Type I Certificate
SOC 2 Type II Certificate
PCI DSS
HIPAA
RGPD
Internal validation & live display
Multiple badges & continuous verification
Faster underwriting decisions
ISOSOC2 Type 1SOC2 Type 2PCI DSSHIPAAGDPR

CVS Health is the leading health solutions company, delivering care like no one else can. We reach more people and improve the health of communities across America through our local presence, digital channels and over 300,000 dedicated colleagues – including more than 40,000 physicians, pharmacists, nurses and nurse practitioners. Wherever and whenever people need us, we help them with their health – whether that’s managing chronic diseases, staying compliant with their medications or accessing affordable health and wellness services in the most convenient ways. We help people navigate the health care system – and their personal health care – by improving access, lowering costs and being a trusted partner for every meaningful moment of health. And we do it all with heart, each and every day. Follow @CVSHealth on social media.

CVS Health A.I CyberSecurity Scoring

CVS Health

Company Details

Linkedin ID:

cvs-health

Employees number:

122,928

Number of followers:

965,649

NAICS:

62

Industry Type:

Hospitals and Health Care

Homepage:

cvshealth.com

IP Addresses:

0

Company ID:

CVS_1676450

Scan Status:

In-progress

AI scoreCVS Health Risk Score (AI oriented)

Between 800 and 849

https://images.rankiteo.com/companyimages/cvs-health.jpeg
CVS Health Hospitals and Health Care
Updated:
  • Powered by our proprietary A.I cyber incident model
  • Insurance preferes TPRM score to calculate premium
globalscoreCVS Health Global Score (TPRM)

XXXX

https://images.rankiteo.com/companyimages/cvs-health.jpeg
CVS Health Hospitals and Health Care
  • Instant access to detailed risk factors
  • Benchmark vs. industry & size peers
  • Vulnerabilities
  • Findings

CVS Health Company CyberSecurity News & History

Past Incidents
5
Attack Types
2
EntityTypeSeverityImpactSeenBlog DetailsIncident DetailsView
Aetna Life Insurance CompanyBreach10045/2023
Rankiteo Explanation :
Attack with significant impact with customers data leaks

Description: The Missouri Attorney General’s Office reported a data breach involving Aetna Life Insurance Company on December 1, 2023. The breach occurred on May 29, 2023, and compromised the personal information of 11,893 Missouri residents, specifically exposing Social Security Numbers. This incident highlights the vulnerability of personal data and the potential consequences of such breaches on individuals' privacy and security.

Aetna InternationalData Leak50206/2017
Rankiteo Explanation :
Attack limited on finance or reputation

Description: Aetna sufferd from a data security incident that exposed More than 500 Texans personal information online. The exposed information includes first name, last name, Aetna member identification number, provider information, claim payment amount, and in some cases procedure/service codes and dates of service. Social Security numbers, bank account information, or credit card details did not exposed in this incident. They launched the investigation and started notifying the affected individuals.

CVS HealthBreach80403/2021
Rankiteo Explanation :
Attack with significant impact with customers data leaks

Description: Over a billion customer records of Pharmacy giant CVS were leaked on internet in a cyber incident. The exposed data included customer email addresses, device IDs, and the order histories of CVS. Upon learning about the incident CVS Health immediately worked to secure the data and informed the impacted customers to remain alert.

CVS Caremark Part D Services, L.L.C.Breach25111/2023
Rankiteo Explanation :
Attack without any consequences

Description: The Washington State Office of the Attorney General reported a data breach involving CVS Caremark Part D Services, L.L.C. on February 23, 2024. The breach occurred on November 20, 2023, due to human error in mailing processes, affecting approximately 2,193 individuals' names and medical information.

CVSBreach2511/2023
Rankiteo Explanation :
Attack without any consequences

Description: On April 8, 2024, the Maine Office of the Attorney General reported a data breach involving CVS that occurred on January 1, 2023. The breach was an internal system breach affecting a total of 10 individuals, with consumer notification conducted electronically on January 10, 2023. Identity theft protection services were offered.

Aetna Life Insurance Company
Breach
Severity: 100
Impact: 4
Seen: 5/2023
Blog:
Rankiteo Explanation
Attack with significant impact with customers data leaks

Description: The Missouri Attorney General’s Office reported a data breach involving Aetna Life Insurance Company on December 1, 2023. The breach occurred on May 29, 2023, and compromised the personal information of 11,893 Missouri residents, specifically exposing Social Security Numbers. This incident highlights the vulnerability of personal data and the potential consequences of such breaches on individuals' privacy and security.

Aetna International
Data Leak
Severity: 50
Impact: 2
Seen: 06/2017
Blog:
Rankiteo Explanation
Attack limited on finance or reputation

Description: Aetna sufferd from a data security incident that exposed More than 500 Texans personal information online. The exposed information includes first name, last name, Aetna member identification number, provider information, claim payment amount, and in some cases procedure/service codes and dates of service. Social Security numbers, bank account information, or credit card details did not exposed in this incident. They launched the investigation and started notifying the affected individuals.

CVS Health
Breach
Severity: 80
Impact: 4
Seen: 03/2021
Blog:
Rankiteo Explanation
Attack with significant impact with customers data leaks

Description: Over a billion customer records of Pharmacy giant CVS were leaked on internet in a cyber incident. The exposed data included customer email addresses, device IDs, and the order histories of CVS. Upon learning about the incident CVS Health immediately worked to secure the data and informed the impacted customers to remain alert.

CVS Caremark Part D Services, L.L.C.
Breach
Severity: 25
Impact: 1
Seen: 11/2023
Blog:
Rankiteo Explanation
Attack without any consequences

Description: The Washington State Office of the Attorney General reported a data breach involving CVS Caremark Part D Services, L.L.C. on February 23, 2024. The breach occurred on November 20, 2023, due to human error in mailing processes, affecting approximately 2,193 individuals' names and medical information.

CVS
Breach
Severity: 25
Impact: 1
Seen: 1/2023
Blog:
Rankiteo Explanation
Attack without any consequences

Description: On April 8, 2024, the Maine Office of the Attorney General reported a data breach involving CVS that occurred on January 1, 2023. The breach was an internal system breach affecting a total of 10 individuals, with consumer notification conducted electronically on January 10, 2023. Identity theft protection services were offered.

Ailogo

CVS Health Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

🔒
Incident Predictions locked
Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

🔒
A.I. Risk Score Predictions locked
Access Monitoring Plan
statics

Underwriter Stats for CVS Health

Incidents vs Hospitals and Health Care Industry Average (This Year)

No incidents recorded for CVS Health in 2025.

Incidents vs All-Companies Average (This Year)

No incidents recorded for CVS Health in 2025.

Incident Types CVS Health vs Hospitals and Health Care Industry Avg (This Year)

No incidents recorded for CVS Health in 2025.

Incident History — CVS Health (X = Date, Y = Severity)

CVS Health cyber incidents detection timeline including parent company and subsidiaries

CVS Health Company Subsidiaries

SubsidiaryImage

CVS Health is the leading health solutions company, delivering care like no one else can. We reach more people and improve the health of communities across America through our local presence, digital channels and over 300,000 dedicated colleagues – including more than 40,000 physicians, pharmacists, nurses and nurse practitioners. Wherever and whenever people need us, we help them with their health – whether that’s managing chronic diseases, staying compliant with their medications or accessing affordable health and wellness services in the most convenient ways. We help people navigate the health care system – and their personal health care – by improving access, lowering costs and being a trusted partner for every meaningful moment of health. And we do it all with heart, each and every day. Follow @CVSHealth on social media.

Loading...
similarCompanies

CVS Health Similar Companies

GE HealthCare

Every day millions of people feel the impact of our intelligent devices, advanced analytics and artificial intelligence. As a leading global medical technology and digital solutions innovator, GE HealthCare enables clinicians to make faster, more informed decisions through intelligent devices, data

IQVIA

IQVIA (NYSE:IQV) is a leading global provider of clinical research services, commercial insights and healthcare intelligence to the life sciences and healthcare industries. IQVIA’s portfolio of solutions are powered by IQVIA Connected Intelligence™ to deliver actionable insights and services built o

IHH Healthcare

A world-leading integrated healthcare provider, IHH believes that making a difference starts with our aspiration to Care. For Good. Our team of 65,000 people commit to deliver greater good to our patients, people, the public and our planet, as we live our purpose each day to touch lives and trans

UNC Health

Our mission is to improve the health and well-being of North Carolinians and others whom we serve. We accomplish this by providing leadership and excellence in the interrelated areas of patient care, education and research. UNC Health and its 33,000 employees, continue to serve as North Carolina’s

Sharp HealthCare

Sharp HealthCare is a not-for-profit health care system based in San Diego, California, with four acute care hospitals, three specialty hospitals, three medical groups and a health plan. We provide medical services in virtually all fields of medicine, including primary care, heart care, cancer, orth

Jefferson Health

Thomas Jefferson University and Thomas Jefferson University Hospitals are partners in providing excellent clinical and compassionate care for our patients in the Philadelphia region, educating the health professionals of tomorrow in a variety of disciplines and discovering new knowledge that will de

St. Luke's Health System

As the only Idaho-based, not-for-profit health system, St. Luke’s Health System is dedicated to our mission “To improve the health of people in the communities we serve.” Today that means not only treating you when you’re sick or hurt, but doing everything we can to help you be as healthy as possibl

A Dasa é a maior rede de saúde integrada do Brasil. Faz parte da vida de mais de 20 milhões de pessoas por ano, com alta tecnologia, experiência intuitiva e atitude à frente do tempo. Com mais de 50 mil colaboradores e 250 mil médicos parceiros, existe para ser a saúde que as pessoas desejam e que

Optum

We’re evolving health care so everyone can have the opportunity to live their healthiest life. It’s why we put your unique needs at the heart of everything we do, making it easy and affordable to manage health and well-being. We are delivering the right care how and when it’s needed; providing suppo

newsone

CVS Health CyberSecurity News

November 13, 2025 08:00 AM
CVS Pharmacy union workers hold national day of action

Union workers at CVS pharmacies said they are holding a national day of action in response to working in unsafe conditions.

October 28, 2025 07:00 AM
CVS, Ad Partner Can't Shake Suit Over User Data Tracking

A California federal judge has refused to release CVS Pharmacy Inc. and a marketing partner from a putative class action accusing them of...

October 15, 2025 07:00 AM
CVS Health Completes Purchase Of Rite Aids, Adds 9 Million Customers

CVS Health has completed the acquisition of 63 Rite Aid stores in Idaho, Oregon and Washington and prescription files across 15 states that...

September 05, 2025 07:00 AM
CVS Health Faces HIPAA Probe Over Alleged Use of Patient Data for Lobbying and Political Advocacy

CVS Health is facing a probe into potential HIPAA violations related to the alleged use of patient data for lobbying purposes to prevent the...

August 04, 2025 07:00 AM
Powering AI-Driven Security with the Open Cybersecurity Schema Framework

by Rod Wallace on 04 AUG 2025 in AWS Security Hub, Customer Solutions, Open Source, Security, Security, Identity, & Compliance, Thought Leadership Permalink...

July 15, 2025 07:00 AM
Microsoft Plan to Help Rural Care Facilities Improve Cybersecurity Gains Traction

Microsoft's rural health program gives providers free access to cybersecurity assessments, cyber awareness training and tech product support.

July 01, 2025 07:00 AM
Meet The Washington Foster MBA Class Of 2026, Michael Streuling

An in-depth look into the personal and professional experiences of Michael Streuling from this year's Washington Foster Class of 2026.

May 30, 2025 07:00 AM
BostonCISO ORBIE Leadership Award recipient: CVS Health CISO Chandra McMahon on why the role is more strategic than ever — and advice for future leaders

Chandra McMahon is a seasoned cybersecurity executive and board member with over 30 years of experience leading complex security and technology programs.

May 15, 2025 07:00 AM
Rite Aid To Sell 1,000 Pharmacy Assets To CVS, Walgreens And Grocers

CVS Health, Walgreens and grocery store chains Kroger and Albertsons are among the pharmacy operators buying more than 1,000 Rite Aid...

faq

Frequently Asked Questions

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.

CVS Health CyberSecurity History Information

Official Website of CVS Health

The official website of CVS Health is http://CVSHealth.com.

CVS Health’s AI-Generated Cybersecurity Score

According to Rankiteo, CVS Health’s AI-generated cybersecurity score is 814, reflecting their Good security posture.

How many security badges does CVS Health’ have ?

According to Rankiteo, CVS Health currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Does CVS Health have SOC 2 Type 1 certification ?

According to Rankiteo, CVS Health is not certified under SOC 2 Type 1.

Does CVS Health have SOC 2 Type 2 certification ?

According to Rankiteo, CVS Health does not hold a SOC 2 Type 2 certification.

Does CVS Health comply with GDPR ?

According to Rankiteo, CVS Health is not listed as GDPR compliant.

Does CVS Health have PCI DSS certification ?

According to Rankiteo, CVS Health does not currently maintain PCI DSS compliance.

Does CVS Health comply with HIPAA ?

According to Rankiteo, CVS Health is not compliant with HIPAA regulations.

Does CVS Health have ISO 27001 certification ?

According to Rankiteo,CVS Health is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Industry Classification of CVS Health

CVS Health operates primarily in the Hospitals and Health Care industry.

Number of Employees at CVS Health

CVS Health employs approximately 122,928 people worldwide.

Subsidiaries Owned by CVS Health

CVS Health presently has no subsidiaries across any sectors.

CVS Health’s LinkedIn Followers

CVS Health’s official LinkedIn profile has approximately 965,649 followers.

NAICS Classification of CVS Health

CVS Health is classified under the NAICS code 62, which corresponds to Health Care and Social Assistance.

CVS Health’s Presence on Crunchbase

No, CVS Health does not have a profile on Crunchbase.

CVS Health’s Presence on LinkedIn

Yes, CVS Health maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/cvs-health.

Cybersecurity Incidents Involving CVS Health

As of December 11, 2025, Rankiteo reports that CVS Health has experienced 5 cybersecurity incidents.

Number of Peer and Competitor Companies

CVS Health has an estimated 30,928 peer or competitor companies worldwide.

What types of cybersecurity incidents have occurred at CVS Health ?

Incident Types: The types of cybersecurity incidents that have occurred include Data Leak and Breach.

How does CVS Health detect and respond to cybersecurity incidents ?

Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with immediately worked to secure the data, and communication strategy with informed the impacted customers to remain alert, and communication strategy with notifying affected individuals, and communication strategy with consumer notification conducted electronically..

Incident Details

Can you provide details on each incident ?

Incident : Data Breach

Title: CVS Data Leak Incident

Description: Over a billion customer records of Pharmacy giant CVS were leaked on the internet in a cyber incident.

Type: Data Breach

Incident : Data Breach

Title: Aetna Data Security Incident

Description: Aetna suffered from a data security incident that exposed more than 500 Texans' personal information online. The exposed information includes first name, last name, Aetna member identification number, provider information, claim payment amount, and in some cases procedure/service codes and dates of service. Social Security numbers, bank account information, or credit card details were not exposed in this incident. They launched an investigation and started notifying the affected individuals.

Type: Data Breach

Incident : Data Breach

Title: CVS Data Breach

Description: A data breach involving CVS was reported by the Maine Office of the Attorney General, affecting 10 individuals.

Date Detected: 2023-01-01

Date Publicly Disclosed: 2024-04-08

Type: Data Breach

Attack Vector: Internal System Breach

Incident : Data Breach

Title: Aetna Life Insurance Company Data Breach

Description: The Missouri Attorney General’s Office reported a data breach involving Aetna Life Insurance Company on December 1, 2023. The breach occurred on May 29, 2023, and compromised the personal information of 11,893 Missouri residents, specifically exposing Social Security Numbers.

Date Detected: 2023-12-01

Date Publicly Disclosed: 2023-12-01

Type: Data Breach

Incident : Data Breach

Title: CVS Caremark Part D Services Data Breach

Description: The Washington State Office of the Attorney General reported a data breach involving CVS Caremark Part D Services, L.L.C. on February 23, 2024. The breach occurred on November 20, 2023, due to human error in mailing processes, affecting approximately 2,193 individuals' names and medical information.

Date Detected: 2023-11-20

Date Publicly Disclosed: 2024-02-23

Type: Data Breach

Attack Vector: Human Error

Vulnerability Exploited: Mailing Processes

What are the most common types of attacks the company has faced ?

Common Attack Types: The most common types of attacks the company has faced is Breach.

Impact of the Incidents

What was the impact of each incident ?

Incident : Data Breach CVS153930322

Data Compromised: Customer email addresses, Device ids, Order histories

Incident : Data Breach AET132281022

Data Compromised: First name, Last name, Aetna member identification number, Provider information, Claim payment amount, Procedure/service codes, Dates of service

Incident : Data Breach AET411072725

Data Compromised: Social security numbers

Incident : Data Breach CVS1026072725

Data Compromised: Names, Medical information

What types of data are most commonly compromised in incidents ?

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Customer Email Addresses, Device Ids, Order Histories, , First Name, Last Name, Aetna Member Identification Number, Provider Information, Claim Payment Amount, Procedure/Service Codes, Dates Of Service, , Social Security Numbers, Names, Medical Information and .

Which entities were affected by each incident ?

Incident : Data Breach CVS153930322

Entity Name: CVS

Entity Type: Pharmacy

Industry: Healthcare

Size: Large

Customers Affected: Over a billion

Incident : Data Breach AET132281022

Entity Name: Aetna

Entity Type: Healthcare Insurance Provider

Industry: Healthcare

Location: Texas

Customers Affected: More than 500 Texans

Incident : Data Breach CVS910072525

Entity Name: CVS

Entity Type: Company

Industry: Healthcare

Customers Affected: 10

Incident : Data Breach AET411072725

Entity Name: Aetna Life Insurance Company

Entity Type: Insurance Company

Industry: Health Insurance

Location: Missouri

Customers Affected: 11893

Incident : Data Breach CVS1026072725

Entity Name: CVS Caremark Part D Services, L.L.C.

Entity Type: Company

Industry: Healthcare

Customers Affected: 2193

Response to the Incidents

What measures were taken in response to each incident ?

Incident : Data Breach CVS153930322

Incident Response Plan Activated: True

Containment Measures: Immediately worked to secure the data

Communication Strategy: Informed the impacted customers to remain alert

Incident : Data Breach AET132281022

Communication Strategy: Notifying affected individuals

Incident : Data Breach CVS910072525

Communication Strategy: Consumer notification conducted electronically

Data Breach Information

What type of data was compromised in each breach ?

Incident : Data Breach CVS153930322

Type of Data Compromised: Customer email addresses, Device ids, Order histories

Number of Records Exposed: Over a billion

Incident : Data Breach AET132281022

Type of Data Compromised: First name, Last name, Aetna member identification number, Provider information, Claim payment amount, Procedure/service codes, Dates of service

Number of Records Exposed: More than 500

Incident : Data Breach CVS910072525

Number of Records Exposed: 10

Incident : Data Breach AET411072725

Type of Data Compromised: Social Security Numbers

Number of Records Exposed: 11893

Sensitivity of Data: High

Personally Identifiable Information: Social Security Numbers

Incident : Data Breach CVS1026072725

Type of Data Compromised: Names, Medical information

Number of Records Exposed: 2193

Sensitivity of Data: High

How does the company handle incidents involving personally identifiable information (PII) ?

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by immediately worked to secure the data.

References

Where can I find more information about each incident ?

Incident : Data Breach CVS910072525

Source: Maine Office of the Attorney General

Date Accessed: 2024-04-08

Incident : Data Breach AET411072725

Source: Missouri Attorney General’s Office

Date Accessed: 2023-12-01

Incident : Data Breach CVS1026072725

Source: Washington State Office of the Attorney General

Date Accessed: 2024-02-23

Where can stakeholders find additional resources on cybersecurity best practices ?

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Maine Office of the Attorney GeneralDate Accessed: 2024-04-08, and Source: Missouri Attorney General’s OfficeDate Accessed: 2023-12-01, and Source: Washington State Office of the Attorney GeneralDate Accessed: 2024-02-23.

Investigation Status

What is the current status of the investigation for each incident ?

Incident : Data Breach AET132281022

Investigation Status: Launched

How does the company communicate the status of incident investigations to stakeholders ?

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Informed the impacted customers to remain alert, Notifying affected individuals and Consumer notification conducted electronically.

Stakeholder and Customer Advisories

Were there any advisories issued to stakeholders or customers for each incident ?

Incident : Data Breach CVS153930322

Customer Advisories: Informed the impacted customers to remain alert

Incident : Data Breach CVS910072525

Customer Advisories: Identity theft protection services were offered

What advisories does the company provide to stakeholders and customers following an incident ?

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Informed the impacted customers to remain alert and Identity theft protection services were offered.

Post-Incident Analysis

What were the root causes and corrective actions taken for each incident ?

Incident : Data Breach CVS1026072725

Root Causes: Human Error in Mailing Processes

Additional Questions

Incident Details

What was the most recent incident detected ?

Most Recent Incident Detected: The most recent incident detected was on 2023-01-01.

What was the most recent incident publicly disclosed ?

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-02-23.

Impact of the Incidents

What was the most significant data compromised in an incident ?

Most Significant Data Compromised: The most significant data compromised in an incident were customer email addresses, device IDs, order histories, , first name, last name, Aetna member identification number, provider information, claim payment amount, procedure/service codes, dates of service, , Social Security Numbers, , Names, Medical Information and .

Response to the Incidents

What containment measures were taken in the most recent incident ?

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Immediately worked to secure the data.

Data Breach Information

What was the most sensitive data compromised in a breach ?

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were claim payment amount, dates of service, last name, Social Security Numbers, Aetna member identification number, provider information, customer email addresses, Names, device IDs, Medical Information, first name, procedure/service codes and order histories.

What was the number of records exposed in the most significant breach ?

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 943.0.

References

What is the most recent source of information about an incident ?

Most Recent Source: The most recent source of information about an incident are Missouri Attorney General’s Office, Washington State Office of the Attorney General and Maine Office of the Attorney General.

Investigation Status

What is the current status of the most recent investigation ?

Current Status of Most Recent Investigation: The current status of the most recent investigation is Launched.

Stakeholder and Customer Advisories

What was the most recent customer advisory issued ?

Most Recent Customer Advisory: The most recent customer advisory issued were an Informed the impacted customers to remain alert and Identity theft protection services were offered.

cve

Latest Global CVEs (Not Company-Specific)

Description

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app_password parameter). Depending on local configuration, this password could be the extension, voicemail, user manager, DPMA or EPM phone admin password. This issue is fixed in versions 16.0.96 and 17.0.10.

Risk Information
cvss4
Base: 6.9
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.

Risk Information
cvss3
Base: 9.4
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Description

Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. MySQLSelectTool is intended to be a read-only SQL tool (e.g., for LLM agent querying, however, validation based on the first keyword (e.g., SELECT) and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can influence the tool input (e.g., via prompt injection through a public agent endpoint) may write arbitrary files to the DB server if the MySQL/MariaDB account has the FILE privilege and server configuration permits writes to a useful location (e.g., a web-accessible directory). This issue is fixed in version 2.8.12.

Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Description

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.

Risk Information
cvss3
Base: 8.4
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.

Risk Information
cvss3
Base: 5.4
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Access Data Using Our API

SubsidiaryImage

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=cvs-health' -H 'apikey: YOUR_API_KEY_HERE'

What Do We Measure ?

revertimgrevertimgrevertimgrevertimg
Incident
revertimgrevertimgrevertimgrevertimg
Finding
revertimgrevertimgrevertimgrevertimg
Grade
revertimgrevertimgrevertimgrevertimg
Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network Security

Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)

Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)

Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat Intelligence

Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Top LeftTop RightBottom LeftBottom Right
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
Users Love Us Badge