Rated, Triaged,
Attached to Nothing

I Started With Spoiled Food

On 12 October 2026, refrigeration failed across four competing French supermarket chains at once. Intermarché, Super U, E.Leclerc and Metro, plus independent stores, all in the same window. Around 150 Intermarché locations were affected. One Super U in Haguenau reported €220,000 of lost stock, one Intermarché €50,000. Some units were driven to 50°C, hot enough to start fires.

Danfoss, which makes the controllers involved, said the affected equipment was mostly the AK-SM800 and AK-SC355. Both are end of life. A bulletin in June 2023 closed out that product range, so no software or security update exists for them.

Separately, in August 2026, Claroty's Team82 published three vulnerabilities in the current AK-SM 8xxA line. The first, CVE-2025-41450, is an authentication bypass through a hidden date-based administrator login. It requires no credentials. Censys showed 2,765 of those devices reachable from the open internet.

My first question was the obvious one: if this works on supermarkets, what about hospital and pharmacy cold storage, where a temperature excursion is invisible in the vial? I started looking for evidence that anyone was tracking this class of equipment at all.

I did not find the answer I expected. I found something about the national vulnerability database instead.

What My Data Showed

For my own research I keep a local database of public vulnerability and threat feeds, so I can query them together rather than one web interface at a time. One of those feeds is the National Vulnerability Database, run by NIST. It is where most of the security industry goes to find out what a CVE affects, because it adds structured product identifiers to each vulnerability. Those identifiers are called CPE, and they are what lets a scanner connect "this vulnerability exists" to "and you are running the affected thing."

I went looking for refrigeration vendors and noticed something odd in passing: the Danfoss vulnerabilities from the Claroty disclosure were missing from my results. So I stopped looking at refrigeration and looked at the database itself.

My copy held 405,310 CVE records at the time of query. Removing the 18,473 marked Rejected, which are withdrawn identifiers rather than real vulnerabilities, leaves 386,837. I grouped them by the year the CVE was published and counted how many had no CPE product data.

Eight years at exactly zero, then a cliff. Every CVE published between 2016 and 2023 in my copy has product identification. Not most. All of them.

Why this is not just processing lag

My first thought was that newer vulnerabilities simply have not been processed yet, which would make the trend an artifact of age rather than a real change. The data rules that out, and it does so cleanly.

NVD assigns each CVE a status. Deferred means it is not scheduled for enrichment. Awaiting Analysis and Received mean it is still in the queue. For 2024, the share marked Deferred and the share with no product identification are the same number: 19.4% and 19.4%. For 2025, the same: 37.3% and 37.3%. There is no queue left for those years. Every vulnerability from 2024 and 2025 has already been dispositioned, either enriched or set aside.

Which means those figures are final. 19.4% of 2024 vulnerabilities and 37.3% of 2025 vulnerabilities will not get product identification. Deferred is not a waiting room. It is an outcome.

For 2026 the two numbers separate, 37.9% Deferred against 53.0% with no product data. That 15-point gap is the genuine backlog still being worked, so 2026 will settle somewhere between those two figures.

A Vulnerability That Belongs to Nothing

Here is what Deferred looks like in practice. I queried NVD's live API for CVE-2025-41450, the Danfoss authentication bypass, on 13 October 2026.

Read that combination again. The vulnerability has a severity score. It has a CISA decision about how urgently it should be handled. It is an authentication bypass requiring no credentials, in equipment with thousands of instances reachable from the internet, on a product line the vendor stopped supporting in 2023.

Someone rated how bad it is. Someone decided how urgently to treat it. Nobody recorded what it affects.

The same is true of CVE-2025-41451 and CVE-2025-41452 from the same disclosure, CVE-2025-52551 in the Copeland E2 line, and CVE-2026-15203 in Danfoss iC7 drives. All Deferred, all without product identification. One from the same research, CVE-2025-6519 in the Copeland E3, is marked Analyzed and does have product data.

How a vulnerability ends up here

NVD has published a prioritization policy, effective 15 April 2026. Enrichment is prioritized for three categories: vulnerabilities in CISA's Known Exploited Vulnerabilities catalogue, with a target of one business day; software used within the federal government; and critical software under Executive Order 14028. Everything else is labelled lowest priority. NVD states its backlog began in early 2024 and has not been cleared.

That policy is reasonable on its own terms. Finite staff, rising submissions, triage by risk. But follow what it implies for a specific kind of equipment.

One further detail worth stating, because it changes what Deferred means. NVD introduced the label in April 2025 and described it as applying to vulnerabilities published before 1 January 2018, as part of clearing historical backlog. In my copy, not one Deferred record was published before 2024. The 55,288 Deferred CVEs break down as 7,769 from 2024, 17,960 from 2025 and 29,559 from 2026, and those three figures sum exactly to the total. The pre-2018 group was moved to a different status in April 2026. The label now holds the current backlog.

The Equipment Class Nobody Is Watching

Having found the mechanism, I went back to the original question and measured the equipment class itself. Two independent checks, each with a control, because a result of zero is only meaningful if the method would have found something had it been there.

Check one: does this class ever reach KEV?

I extracted vendor names from the CPE identifiers in my NVD copy and counted vulnerabilities per building automation and refrigeration vendor, then joined against the KEV catalogue.

254 vulnerabilities. None of them have ever entered KEV. Honeywell and Johnson Controls are diversified well beyond building systems, so the conservative figure is the five pure-play vendors: 79 vulnerabilities across fifteen years, none in KEV.

Searching the whole KEV catalogue for twenty-two vendor and keyword patterns across this sector returned exactly three records. Siemens SIMATIC CP and Rockwell are industrial process control rather than building systems. One genuine building automation entry exists in the entire catalogue: Schneider Electric U.motion Builder, CVE-2018-7841, added April 2022.

The control for that search is the catalogue's own composition. Its largest contributors are Microsoft at 389 entries, Cisco at 100, Apple at 95, Adobe at 82 and Google at 75, running down through D-Link at 26, Synacor at 19 and QNAP at 11. Mass-market software, network edge devices, consumer hardware. Not one building automation vendor appears in the top 25.

Check two: has any tracked threat actor used it?

Alongside those feeds I keep structured research packets I build by hand for named threat actors, drawing on vendor reporting and government advisories. I have 107 of them. I counted how many mention each vendor and technology.

The first pass produced a handful of apparent hits that all dissolved under inspection, and the reasons are worth recording because they are the kind of thing that turns a null result into a false one.

Substring matches. "abb" appeared four times and "carel" once, both as fragments inside ordinary English words. Both went to zero once I required whole-word matches.

Name collisions. "Niagara" matched once, but as GOLD NIAGARA, a vendor alias for the group FIN7, not the Tridium Niagara building automation framework.

Wrong equipment class. Siemens, Schneider and Rockwell each matched, and all three matches are in the same single packet, covering an Iranian-linked group targeting programmable logic controllers in water, wastewater and energy facilities. That is industrial process control, not building systems.

And one that tells its own story. "Johnson Controls" matched once. Not as an access vector, but as a victim: the building automation vendor was itself breached through a hypervisor encryptor. The company that builds building control systems was compromised through VMware ESXi, like everyone else.

A detail I did not expect

Look at the date spans in the vendor table. Copeland has 32 vulnerabilities, every one published between September 2025 and February 2026, and nothing before. Danfoss has 10, every one inside a single two-month window in mid-2023, nothing before or after. Carel's most recent is July 2023. Automated Logic's is April 2022.

Those are not security histories. They are the shapes of individual research projects. Copeland's controllers did not become insecure in September 2025, when a security firm published ten findings against them. They became examined.

Which means the 254 figure is not a measure of how much is wrong with this equipment. It is a measure of how much of it has been looked at.

And the Danfoss count makes the point sharper still. Those 10 vulnerabilities are three from 2015 in a solar inverter product and seven from 2023 in an energy monitoring unit. Not one of them is in the AK-SM controller family involved in the French attack. That product line's vulnerabilities are the Deferred ones, which carry no product identifier, which is why they do not appear in a vendor count at all. In the national database, the equipment that failed across four supermarket chains has vulnerabilities attached to nothing.

What a Defender Can Actually Use

The instinct here is to write a detection rule, and I checked whether one was warranted. It is not, or not yet. A setpoint change on a refrigeration controller is a legitimate administrative action that an authorised engineer performs routinely, and the telemetry that would distinguish an authorised change from a malicious one largely does not exist in these environments. There is nothing to write a rule against.

What this analysis does support is narrower and more useful.

One further point for anyone running medical or pharmaceutical cold storage, which is where I started. That sector already mandates something retail does not have. CDC's vaccine storage requirements call for a digital data logger on every storage unit, with a buffered probe sited among the product, minimum and maximum recording, calibration against a certificate, and three years of log retention. A logger that is not on the network cannot be altered by an attacker who controls the refrigeration.

That independent record is the most valuable control in the room, and it is already required. The gap worth noting is that the existing regime is built around thresholds, an alarm when temperature leaves a band, while the harder problem is rate: a slow drift that stays inside the permitted range and still degrades the product. That is a measurement problem rather than a detection one, and it is where I would look next.

What I would want to know next

Three questions this analysis raises and does not answer.

Whether the pattern holds outside building automation. The enrichment policy is not sector-specific, so any equipment class without telemetry should show the same signature. Medical devices, industrial sensors and network appliances at the low end of the market are the obvious places to check.

Whether lifecycle status can be measured at scale. Both the Danfoss and Copeland product lines involved here were end of life, with no patch available at any price. No public dataset records support status for this class of equipment, which means "unfixable" is currently a judgement rather than a field.

And how much of the exposed population is running unsupported firmware. Claroty's figure of 2,765 internet-reachable Danfoss devices is a count of instances, not of versions. The share of those already past end of support is the number that would turn this from a structural argument into a forecast.

I came to this expecting to write about hospital refrigerators. The more durable finding was upstream of that: a vulnerability can now be scored, triaged by a federal agency, and left with no record of what it affects, and the equipment most likely to end up in that state is the equipment nothing else is watching either.

Vulnerability counts, status distributions and vendor figures from the author's own research, queried against a local database of public vulnerability and threat feeds maintained by the author. NVD corpus as queried October 2026: 405,310 records, 386,837 after removing those marked Rejected; records grouped by NVD publication date rather than by the year in the CVE identifier; CPE vendor names extracted from the configurations structure of each record; KEV join performed on CVE identifier against the CISA Known Exploited Vulnerabilities catalogue as ingested. All year cohorts in this corpus were fetched within the same window, 9 September to 13 October 2026. Annual totals cross-checked against Jerry Gamblin's 2025 CVE Data Review, which gives 39,962 published CVEs for 2024 and 48,185 for 2025 excluding rejected CVEs, and against publication-year counts at cve-explore.com; the 2026 surge is also the subject of Trend Micro's analysis of what it terms the "vulnpocalypse" (2026). Threat actor packet counts from 107 enriched research packets built by the author from vendor reporting and government advisories; counts are whole-word case-insensitive file matches, with the false positives described in Section 04 removed. CVE-2025-41450 status, metrics and absence of product data retrieved from the NVD API on 13 October 2026. NVD enrichment prioritization policy effective 15 April 2026, Deferred status introduction in April 2025 and its stated pre-2018 scope: NIST NVD programme documentation; Deferred rollout and its effect on CVSS, CWE and CPE data also reported by Socket, Dark Reading and SecurityWeek (April 2025). French supermarket refrigeration incident of 12 October 2026, affected chains, store counts and loss figures: contemporaneous French press reporting; Danfoss statement on the AK-SM800 and AK-SC355 being end of life and the June 2023 product bulletin as relayed in that reporting. CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, including the 2,765 Censys exposure figure: Claroty Team82 (9 August 2026) and CISA advisory ICSA-25-140-03 (20 May 2025). Copeland E2 and E3 vulnerabilities, the October 2024 E2 end-of-life declaration and firmware 2.31F01: Armis Labs, Frostbyte10 (September 2025). CAREL Boss-Mini: CISA advisory ICSA-24-172-02. Vaccine storage monitoring requirements, digital data logger specification and log retention: CDC Vaccine Storage and Handling Toolkit. No conclusion is drawn here about the entry route used in the French incident, which has not been published by any party. This field note represents independent research produced for educational purposes.