Unpublished or unresolved public entry for CVE-2026-12324

#!/usr/bin/env python3
"""
verify_cve_2026_12324.py

Purpose:
  Check whether CVE-2026-12324 has resolved into an actionable public record.

Output:
  UNKNOWN    -> no authoritative product/advisory metadata found yet
  VULNERABLE -> actionable public record found (reassess immediately)
  PATCHED    -> not used here unless a source explicitly states the CVE is withdrawn/not applicable/fixed-only

Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN
"""

import sys
import requests

DEFAULT_CVE = "CVE-2026-12324"
TIMEOUT = 15

SOURCES = [
    ("cve.org", "https://www.cve.org/CVERecord?id={cve}"),
    ("nvd", "https://nvd.nist.gov/vuln/detail/{cve}"),
    ("github_advisories", "https://github.com/advisories?query={cve}"),
    ("osv", "https://osv.dev/list?q={cve}"),
    ("first_epss", "https://api.first.org/data/v1/epss?cve={cve}"),
]


def fetch(url):
    try:
        r = requests.get(url, timeout=TIMEOUT, headers={"User-Agent": "noisgate-verifier/1.0"})
        return r.status_code, r.text[:200000]
    except requests.RequestException:
        return None, ""


def main():
    cve = sys.argv[1].strip() if len(sys.argv) > 1 else DEFAULT_CVE
    found_actionable = False
    explicit_not_found = 0
    checked = 0

    for name, template in SOURCES:
        url = template.format(cve=cve)
        status, body = fetch(url)
        if status is None:
            print(f"[WARN] {name}: request failed")
            continue
        checked += 1
        low = body.lower()
        print(f"[INFO] {name}: http={status} url={url}")

        # Heuristics for 'record exists and has meaningful metadata'
        if name == "first_epss" and '"data":[]' not in low and cve.lower() in low:
            found_actionable = True
        elif any(token in low for token in ["affected", "unaffected", "patched", "fixed", "product status", "references"]):
            if cve.lower() in low:
                found_actionable = True

        # Heuristics for empty/no-hit pages
        if any(token in low for token in ["no results", "not found", "page not found", "record cannot be found", '"data":[]']):
            explicit_not_found += 1

    if found_actionable:
        print("VULNERABLE")
        sys.exit(1)

    if checked == 0:
        print("UNKNOWN")
        sys.exit(2)

    # Current expected state for this CVE based on public data searched in the assessment
    print("UNKNOWN")
    sys.exit(2)


if __name__ == "__main__":
    main()