# Hermes Labs: CVSS public-record correction

For security reporters, researchers, and technical editors. Updated September 19, 2026.

## Summary

Hermes Labs reported a score/vector inconsistency in the public CISA enrichment record for CVE-2026-14216. CISA confirmed that it republished the score as 6.5, correcting the stored 5.3 value. The vector and Medium severity category remained unchanged. The public issue and correction commit document the outcome; the accompanying open-source checker lets readers replay the before and after records locally.

This is a public-data correction, not a newly discovered vulnerability or a CISA endorsement of Hermes Labs. The fixture replay does not reproduce the original corpus-wide audit.

## Primary sources and replay

- CISA acknowledgement: https://github.com/cisagov/vulnrichment/issues/333#issuecomment-5526230961
- Official correction diff: https://github.com/CVEProject/cvelistV5/commit/fa52a90c974f64966065f0beb9f4ffcefaf1208f
- Checker, before/after fixtures, and replay instructions: https://github.com/hermes-labs-ai/hermes-labs-cvss-consistency
- Selected case trace: https://hermes-labs.ai/case-studies/cisa-vulnrichment-score-consistency/trace.json

## Citation and image

Suggested citation: Hermes Labs. “Hermes Labs CISA CVSS Consistency Correction.” September 8, 2026. https://hermes-labs.ai/case-studies/cisa-vulnrichment-score-consistency

Cite the CISA acknowledgement and correction diff for the independently recorded outcome.

Preview image: https://hermes-labs.ai/case-studies/cisa-vulnrichment-score-consistency/opengraph-image.png

Caption: Hermes Labs CVSS record-consistency correction; this is a publisher illustration.

Reporting questions and requests for additional public source material: https://hermes-labs.ai/?lead_origin=case-study-cisa#contact