Citadel
System boundaries / enterprise services
OPERATION INDEXOP-001 / July 2026 - Present
OPERATION
ACHERON
01CitadelIDENTITY /
02BastionIDENTITY /
03VanguardIDENTITY /
OPENING BRIEF
A high-impact zero-day research operation combining independent human analysis with Proteus-assisted source mapping, validation and attack-chain development across three complex software systems.
This page records only information safe for public release. It does not expose active hypotheses, report details or unpatched behavior.
THREE INDEPENDENT RESEARCH FRONTS.
Bastion
Access boundaries / analysis workflows
Vanguard
Runtime behavior / application resilience
PUBLIC SCOPE
RESEARCH SURFACES
- 01Repository and collaboration surfaces
- 02Automation and CI/CD workflows
- 03Identity and authorization boundaries
- 04Enterprise-facing integrations
RESEARCH DIRECTIVES
OPERATING RULES
- D-01Prioritize cross-boundary behavior with realistic attacker reachability.
- D-02Validate impact against documented product behavior and supported configurations.
- D-03Keep active hypotheses and disclosure-sensitive details outside the public log.
REPORTED FINDINGS / DETAILS CONTROLLED
FINDING REGISTER
01 CRITICAL02 HIGH03 MEDIUM
ACR-001
CITADEL / SERVER COMPROMISE / COMPLEX CHAINCRITICAL
Sophisticated server compromise chain
A critical multi-stage chain with system-level impact was reported. Technical details remain restricted during coordinated disclosure.
ACR-002
CITADEL / SSRF / FILE DISCLOSURE / COMPLEX CHAINHIGH
File disclosure via SSRF chain
A high-severity multi-stage chain resulting in restricted file disclosure was reported. Technical details remain restricted during coordinated disclosure.
ACR-003
CITADEL / APPLICATION-LAYER DOSMEDIUM
Authenticated application-layer DoS
A medium-severity availability issue reachable by an ordinary authenticated user was reported. Technical details remain restricted during coordinated disclosure.
ACR-004
VANGUARD / SERVER OOM / UNAUTHENTICATEDHIGH
Unauthenticated server OOM
A high-severity server availability issue reachable without authentication was reported. Technical details remain restricted during coordinated disclosure.
ACR-005
BASTION / ACCESS CONTROL / DATA EXPOSUREMEDIUM
Unauthenticated analysis-data exposure
A medium-severity access-control issue exposing restricted analysis data was reported. Technical details remain restricted during coordinated disclosure.
ACR-006
VANGUARD / ACCESS CONTROL / CONTENT EXPOSUREMEDIUM
Unauthenticated protected-content exposure
A medium-severity access-control issue exposing protected server-rendered content without authentication was reported. Technical details remain restricted during coordinated disclosure.
Titles describe only the broad impact area without naming affected products or exposing reproduction details.
CHRONOLOGICAL RECORD
OPERATIONAL LOG
7 public entries / latest first
07
Sophisticated server compromise chain reported
The Citadel front produced a critical multi-stage server compromise chain with system-level impact. Technical details remain restricted during coordinated disclosure.
06
Authenticated application-layer DoS reported
The Citadel front produced a medium-severity application-layer denial-of-service issue reachable by an ordinary authenticated user. Technical details remain restricted during coordinated disclosure.
05
Unauthenticated server OOM reported
The Vanguard front produced a high-severity server out-of-memory issue reachable without authentication. Technical details remain restricted during coordinated disclosure.
04
File disclosure via SSRF chain reported
The Citadel front produced a high-severity multi-stage SSRF chain resulting in restricted file disclosure. Technical details remain restricted during coordinated disclosure.
03
Unauthenticated analysis-data exposure reported
The Bastion front produced a medium-severity access-control issue exposing restricted analysis data without authentication. Technical details remain restricted during coordinated disclosure.
02
Unauthenticated protected-content exposure reported
The Vanguard front produced a medium-severity access-control issue exposing protected server-rendered content without authentication. Technical details remain restricted during coordinated disclosure.
01
Operation Acheron opened
The scope and research heuristics were defined, and construction of the Proteus research corpus began under operation identifier OP-001.
PUBLIC OUTCOMES
NO RELEASED RESULTS YET.
Public CVEs, advisories and writeups will be linked here after disclosure.
VYNTRA RESEARCH