Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege database access run arbitrary code on the server via external control of a file name or path (CWE-73). The CVSS 3.1 base score is 8.8 with high impact to confidentiality, integrity, and availability; publicly available exploit code exists, though the flaw is not on CISA KEV and EPSS remains very low (0.06%, 20th percentile), indicating minimal observed exploitation to date. Microsoft has released patched builds across all affected branches.
Authenticated remote code execution in Wing FTP Server 8.1.2 lets a domain administrator inject arbitrary Lua code by abusing the session serialization routine, which writes session values into Lua source without escaping closing delimiters. When the poisoned session is later reloaded through loadfile(), the attacker's Lua executes on the server. Publicly available exploit code exists (Exploit-DB 52589, VulnCheck advisory), but there is no evidence of active exploitation and EPSS is very low (0.09%).
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted network requests that trigger a loop with an unreachable exit condition (CWE-835), pinning CPU and rendering the application unresponsive. Publicly available exploit code exists, though there is no public exploit identified as being used in active attacks; EPSS is very low (0.04%, 12th percentile), consistent with the CISA SSVC 'Exploitation: none' assessment. Microsoft has released fixed runtime packages, and the flaw is availability-only with no confidentiality or integrity impact.
Pocket ID OIDC provider fails to validate user authorization state during refresh token exchange, allowing revoked, disabled, or unauthorized users to obtain fresh access tokens indefinitely. Affects all versions prior to 2.6.0. Publicly available exploit code exists via GitHub security advisory GHSA-w6p7-2fxx-4f44. Attack requires low privileges and user interaction (CVSS 8.5) but enables persistent unauthorized access even after administrative revocation actions. Fixed in version 2.6.0.
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an attacker to run code at a higher privilege level after a targeted user opens crafted input. The root cause combines improper input validation (CWE-20) with a heap-based buffer overflow (CWE-122), yielding total technical impact per CISA SSVC. Publicly available exploit code exists, but the vulnerability is not in CISA KEV and EPSS is low (0.11%, 30th percentile), indicating no observed widespread exploitation to date.
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through heap-based buffer overflow exploitation requiring user interaction with a malicious file. Attackers without initial privileges can achieve high-level code execution and data access by convincing a user to open a specially crafted document or application. Microsoft has released patches across all affected .NET versions per MSRC advisory, indicating this is a vendor-confirmed issue requiring immediate remediation for systems where users process untrusted .NET content.
Command injection in Siemens RUGGEDCOM ROX industrial router series allows high-privileged authenticated remote attackers to execute arbitrary commands with root privileges on the underlying operating system. Affects all MX5000/MX5000RE/RX1400/RX1500/RX1501/RX1510/RX1511/RX1512/RX1524/RX1536/RX5000 models running firmware versions below V2.17.1. The vulnerability exists in the Scheduler functionality of the Web UI due to improper input sanitization (CWE-78). CVSS v4.0 score of 8.9 reflects high impact across confidentiality, integrity, and availability with network attack vector but requires high-privilege authentication. No public exploit identified at time of analysis, and EPSS data not available for this recently published CVE.
Remote unauthenticated attackers can exhaust resources and bypass authentication controls in Siemens SIMATIC CN 4100 versions before V5.0, enabling denial of service conditions and unauthorized actions that compromise system availability and integrity. The vulnerability stems from improper connection validation (CWE-306), allowing network-based exploitation without any user interaction or privileges. Siemens has released V5.0 to address this flaw, documented in security advisory SSA-032379.
Siemens SIMATIC CN 4100 versions prior to V5.0 can be rendered unavailable through TCP SYN flood attacks, allowing remote unauthenticated attackers to exhaust system resources and cause complete service disruption. The CVSS 4.0 score of 8.7 reflects the high availability impact (VA:H) combined with network-accessible attack vector requiring no privileges or user interaction. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though SYN flood techniques are well-documented and trivial to execute.
Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected devices via specially crafted IPv4 packets, requiring manual restart for recovery. This vulnerability affects over 200 Siemens industrial automation products including SCALANCE switches/routers, SIMATIC PLCs, SINAMICS drives, and RUGGEDCOM devices. CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with network-accessible attack vector requiring low complexity and no privileges (AV:N/AC:L/PR:N). No public exploit code or CISA KEV listing identified at time of analysis, though the straightforward network-based attack and widespread product exposure warrant priority patching for operational technology environments where uptime is critical.
Hardcoded cryptographic keys in Siemens Teamcenter PLM software enable remote attackers to bypass authentication and gain unauthorized access to confidential product lifecycle management data. The vulnerability affects multiple Teamcenter versions (V2312, V2406, V2412, V2506, V2512) and is remotely exploitable without authentication (CVSS:4.0 AV:N/AC:L/PR:N). While no active exploitation or public POC has been identified at time of analysis, the straightforward nature of hardcoded credential extraction (AC:L) combined with the criticality of Teamcenter as an enterprise PLM platform housing intellectual property makes this a high-priority remediation target for manufacturing and engineering organizations.
Stored cross-site scripting (XSS) in Siemens Teamcenter allows authenticated attackers with low privileges to inject malicious JavaScript that executes in other users' browser sessions, enabling session hijacking, credential theft, or unauthorized actions within the product lifecycle management platform. Affects Teamcenter versions V2312 through V2512 with vendor patches released for all branches. CVSS v4.0 scores 8.5 (High) due to network attack vector with low complexity, though exploitation requires user interaction and authenticated access. No public exploit code or CISA KEV listing identified at time of analysis.
Information disclosure in SUBNET Solutions PowerSYSTEM Center (2020, 2024, and 2026) lets an authenticated user with only limited permissions call the REST API device-account-export endpoint to retrieve sensitive data that should be restricted to administrators. The flaw is a broken authorization (CWE-863) check, so a low-privilege operator can escalate their effective data access without any administrative role. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 6th percentile), consistent with CISA's SSVC rating of 'Exploitation: none.'
Schneider Electric EcoStruxure Panel Server can revert credentials to insecure default values under rare circumstances, allowing remote unauthenticated attackers to gain unauthorized access using known factory credentials. This CWE-1188 vulnerability enables complete confidential information disclosure (CVSS 8.2 High). Exploitation requires specific timing conditions (AT:P - Attack Timing: Present) to catch the window when credentials reset. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, suggesting targeted rather than widespread exploitation risk.
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). An authorized user holding only low-level site privileges can escalate to full server compromise over the network with no user interaction. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none'; EPSS sits at 0.50% (66th percentile), indicating modest near-term exploitation probability despite the high CVSS 8.8 score.
Remote code execution in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker (PR:L) to run arbitrary code over the network by submitting maliciously crafted serialized data that the server deserializes without validation. Microsoft has released a patch and no public exploit identified at time of analysis; EPSS is modest at 0.50% (66th percentile) and CISA SSVC rates exploitation as 'none' but technical impact as 'total'. The bug follows the well-known SharePoint deserialization RCE pattern (CWE-502), making it a high-value target for post-authentication lateral movement and full server compromise.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker to run arbitrary code across the network by submitting maliciously crafted serialized data (CWE-502). Any user holding low-privilege authenticated access to the SharePoint web application can achieve total compromise of the server (C:H/I:H/A:H). There is no public exploit identified at time of analysis, and the EPSS probability is modest at 0.50% (66th percentile), but the impact is total and a vendor patch is already available.
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) allows an authenticated attacker to run arbitrary code over the network by supplying maliciously crafted serialized data (CWE-502). Any user holding valid low-privilege credentials on the SharePoint farm can achieve total compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is a modest 0.50% (66th percentile).
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a remote, unauthenticated attacker inject unneutralized special elements into a downstream component (CWE-74) to defeat a built-in protection, provided a developer is lured into a triggering action (UI:R). With CVSS 8.8 and full confidentiality/integrity/availability impact, successful exploitation could subvert Copilot/editor security controls; however there is no public exploit identified at time of analysis, EPSS is low (0.06%), and CISA SSVC records exploitation status as none.
Remote code execution in Microsoft Data Formulator versions prior to 0.7 lets an unauthorized attacker run arbitrary code by inducing a user to interact with malicious content (CWE-94 code injection). The flaw is network-reachable and requires no authentication, but does require user interaction (CVSS 3.1 8.8, AV:N/UI:R). A vendor patch is available; there is no public exploit identified at time of analysis and EPSS probability is very low (0.06%).
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from a session fixation weakness (CWE-384) that a remote, unauthenticated attacker can leverage to hijack a victim's authenticated session after the victim is lured into interacting with an attacker-supplied session identifier. The flaw carries a CVSS 8.8 rating with total confidentiality, integrity, and availability impact, but currently has no public exploit identified at time of analysis and a low EPSS score of 0.06% (18th percentile). Microsoft self-reported the issue and has shipped a fix, while CISA's SSVC framework records exploitation as 'none' and non-automatable.
Privilege escalation in Windows Admin Center in Azure Portal (versions 1.0 up to but not including 2.6.7) lets an already-authenticated, low-privileged network user gain higher privileges by abusing improper access control (CWE-284). Microsoft reports a patch is available; there is no public exploit identified at time of analysis and EPSS probability is low (0.06%). Tagged as an authentication-bypass class issue, successful exploitation yields total control (high confidentiality, integrity, and availability impact) over the affected management surface.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker with low-privilege access to execute arbitrary code across the network by abusing insufficiently granular access controls (CWE-1220). The flaw carries a CVSS 8.8 rating with full confidentiality, integrity, and availability impact; however EPSS estimates only a 0.06% exploitation probability and CISA SSVC records no observed exploitation, so this is currently no public exploit identified at time of analysis. Microsoft has released patches for all affected editions.
Local privilege escalation in Fuji Electric TELLUS 5.0.2 arises because its installer registers a kernel-mode driver with permissions that grant read and write access to all users. A low-privileged local user can therefore interact with a privileged driver interface to read or corrupt kernel-controlled data, undermining the confidentiality, integrity, and availability of the host. No public exploit identified at time of analysis, and CISA SSVC currently marks exploitation status as none.
Command injection in Siemens RUGGEDCOM ROX industrial network devices enables authenticated remote attackers to execute arbitrary commands with root privileges during feature key installation. The vulnerability affects multiple ROX product lines (MX5000, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, RX5000) running firmware versions below V2.17.1. While exploitation requires low-level authentication and higher attack complexity (CVSS 4.0: AV:N/AC:H/PR:L), successful exploitation grants complete control over critical industrial network infrastructure. No public exploit identified at time of analysis, and EPSS data not available for this recently disclosed vulnerability.
Local code execution in Microsoft Word (Office 2016 through Office LTSC 2024, Microsoft 365 Apps, and Office for Mac) results from a type-confusion flaw (CWE-843) that lets an unauthorized attacker run arbitrary code with the victim's privileges. Microsoft rates it CVSS 8.4 with total technical impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 35th percentile). CISA SSVC records exploitation status as none and the issue is not automatable, indicating no observed in-the-wild activity.
Local code execution in Microsoft Office Word (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory-corruption flaw that lets an attacker run arbitrary code in the context of the user who opens a maliciously crafted document. Microsoft has released a patch, and no public exploit has been identified at time of analysis; EPSS is very low at 0.06% (18th percentile) and CISA SSVC records no known exploitation.
Local code execution in Microsoft Word (and Office 2016/2019, LTSC 2021/2024, 365 Apps, Office for Mac, and SharePoint Server) stems from an untrusted pointer dereference (CWE-822) that lets an attacker run arbitrary code with the victim's privileges when a malicious file is processed. Microsoft rates it CVSS 8.4 with total technical impact (high confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC marks exploitation as none and not automatable, indicating no observed real-world attacks yet.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory corruption (CWE-416) that lets an attacker run arbitrary code with the victim's privileges. Microsoft's CVSS vector rates it AV:L/PR:N/UI:N (base 8.4) with total technical impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.04%. A vendor patch is available from Microsoft (MSRC update guide).
Local code execution in Microsoft Word (and the Office suites that bundle it - Office 2016/2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) stems from a use-after-free memory-corruption defect that lets an attacker run arbitrary code in the context of the current user, typically by having the victim process a crafted document. Microsoft (the reporting party) has released a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile). SSVC rates exploitation as none but technical impact as total, so this is a patch-on-schedule item rather than an emergency.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps for Enterprise, Office for Android, and Office LTSC for Mac 2021/2024) stems from a heap-based buffer overflow that lets an attacker run arbitrary code with the victim's privileges. The flaw was reported by Microsoft, a vendor patch is available, and there is no public exploit identified at time of analysis; EPSS is very low at 0.04% and CISA SSVC records exploitation as none. Impact is total (full confidentiality, integrity, and availability loss) but exploitation is not automatable and, per typical Office file-parsing bugs, hinges on processing attacker-supplied content.
Arbitrary code execution in Siemens Simcenter Femap (all versions before V2512.0003) arises from a heap-based memory corruption bug triggered when the application parses a specially crafted IPT (Inventor part) file, letting an attacker run code in the context of the current user process. Discovered through ZDI (ZDI-CAN-27349, ZDI-CAN-27389) and published via a Siemens ProductCERT advisory and CISA ICS advisory, the flaw requires the victim to open a malicious file, so it is a local, user-interaction-dependent issue rather than a remotely reachable one. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA's SSVC marks exploitation as none.
Uninitialized pointer access in Siemens Solid Edge SE2026 enables arbitrary code execution when processing malicious PAR files. Attackers must deliver a crafted PAR file and convince users to open it (CVSS:4.0 AV:L/UI:P), achieving full compromise of the victim's workstation with high confidentiality, integrity, and availability impact. No active exploitation confirmed at time of analysis, though the local attack vector and user interaction requirement limit automated mass exploitation. EPSS data not available for risk calibration.
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attackers to execute malicious JavaScript in administrator sessions via crafted filenames. This stored XSS requires social engineering to trick authenticated users into selecting the attacker-supplied firmware file on the web-based management interface. Successful exploitation enables session hijacking and credential theft without requiring the malicious file to be uploaded. EPSS data not provided, no CISA KEV status confirmed, affecting industrial automation controllers widely deployed in critical infrastructure environments.
Spoofing in Microsoft Azure Machine Learning (versions 3.0.0 up to but not including 1.7.6) lets an unauthenticated network attacker inject improperly neutralized special elements into output rendered by a downstream component, enabling them to impersonate trusted content or identities against a victim who interacts with the malicious output. The CVSS 3.1 base score is 8.2 with a scope change and high confidentiality impact, but real-world urgency is tempered by an EPSS of just 0.05% (15th percentile) and CISA SSVC rating exploitation as 'none'. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Unauthorized file disclosure in Schneider Electric Saitel DP and EasyLogic T150 (formerly Saitel DR) Remote Terminal Units lets a low-privileged remote attacker read sensitive files outside intended directories via improper server-side file path handling. The advisory tagging also associates the flaw with an authentication-bypass angle, and the primary impact is confidentiality of files on the affected OT/ICS controllers. There is no public exploit identified at time of analysis, EPSS risk is very low (0.06%, 17th percentile), and CISA SSVC rates exploitation as none.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker with low-level site privileges to run arbitrary code across the network by submitting maliciously crafted serialized data (CWE-502). Microsoft has released a patch; there is no public exploit identified at time of analysis, and the EPSS score is low (0.31%, 55th percentile), with CISA's SSVC framework rating exploitation status as 'none' but technical impact as 'total'. The combination of authenticated-but-low privilege access and full compromise of confidentiality, integrity, and availability makes this a meaningful escalation-to-RCE risk in enterprise collaboration environments.
Improper authorization in Subnet Solutions PowerSYSTEM Center 2024 (6.0.x-6.1.x) and 2026 (7.0.x) lets an authenticated, low-privileged user delete device project groups they should not be able to remove, causing integrity loss to the managed device inventory. The flaw stems from missing permission enforcement on the project-group deletion function rather than an authentication bypass at the perimeter. There is no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC scores exploitation as 'none.'
Command injection in Zyxel WRE6505 v2 firmware V1.00(ABDV.3)C0 allows unauthenticated adjacent network attackers to execute arbitrary operating system commands via crafted HTTP requests to the CGI interface. This vulnerability affects an end-of-life product with no vendor support, meaning no security patches will be released. Exploitation requires adjacent network access (same LAN segment) but no authentication, making it exploitable by any device on the local network including compromised IoT devices or malicious insiders.
Improper access control in all versions of Intel Vision software allows a remote, unauthenticated attacker to trigger denial of service and, under low-complexity conditions, achieve remote code execution against the Ring 3 user-application layer. The CVSS 4.0 base score of 8.8 reflects high confidentiality impact with lesser integrity and availability effects; there is no public exploit identified at time of analysis, and EPSS is low at 0.20% (42nd percentile). Intel published advisory SA-01457 and CISA's SSVC framework rates exploitation as none but technical impact as total.
Cross-site scripting in the web-based management interface of Aruba Access Points running AOS-10 and AOS-8 Instant allows an unauthenticated attacker on the adjacent local network to inject arbitrary JavaScript that executes in an authenticated administrator's browser. Successful exploitation can lead to theft of session/user data and manipulation of device configuration by riding the victim admin's privileges. No public exploit has been identified at time of analysis, and EPSS is low (0.12%), consistent with the SSVC assessment of no observed exploitation.
Type confusion vulnerability in Windows Ancillary Function Driver for WinSock enables local authenticated users to escalate privileges to SYSTEM level on Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server 2012. Microsoft has released patches through their March 2026 security update cycle. The vulnerability requires low-privilege local access but no user interaction, making it a high-value target for post-compromise lateral movement and persistence. CVSS 7.8 reflects complete system compromise potential, though EPSS data and KEV status are not available for this future-dated CVE.
Heap-based buffer overflow in Windows Message Queuing (MSMQ) allows remote unauthenticated attackers on adjacent networks to execute arbitrary code with high impact to confidentiality, integrity, and availability across multiple Windows versions. Microsoft released patches via their May 2026 security update. The vulnerability requires adjacent network access (same subnet/VLAN) but no authentication, user interaction, or special configuration, making it exploitable against default Windows installations where MSMQ service is enabled. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis.
Remote code execution in superduper (Python library) through version 0.10.0 allows unauthenticated network attackers to execute arbitrary system commands by submitting malicious query strings with embedded Python code. The _parse_op_part() function in query.py uses unsafe eval() with inadequate context restrictions, enabling attackers to import modules (such as os) and achieve complete server compromise. EPSS score is low (0.07%, 20th percentile) and no active exploitation is confirmed (CISA KEV absent), but SSVC framework rates technical impact as total. User interaction is required (CVSS UI:R), reducing automated exploitation risk. Authentication requirements not confirmed from available data - CVSS vector shows PR:N (no privileges required) but UI:R suggests user-triggered queries.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an already-authenticated low-privileged user to elevate to SYSTEM across Windows 10, Windows 11 (21H2 through 26H1), and Windows Server 2022/2025. The flaw stems from external control of a file name or path (CWE-73) inside the kernel-mode WinSock support driver, yielding total confidentiality, integrity, and availability impact per CVSS 7.8. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and CISA SSVC records exploitation as none, but the total technical impact and near-universal Windows footprint make it a standard Patch Tuesday priority.
Path traversal in Azure Monitor Agent enables low-privileged local attackers to escalate to SYSTEM/root privileges via malicious file path manipulation. Microsoft has released security patches. Attack vector is local (AV:L) with low complexity (AC:L), requiring only basic local credentials (PR:L) but no user interaction. EPSS exploitation probability is 0.04% (4th percentile), indicating low likelihood of mass exploitation, though the attack is straightforward once local access is obtained.
Remote code execution in Optimate's neural_magic_training.py script allows authenticated attackers to execute arbitrary code via malicious PyTorch model files. The vulnerability stems from unsafe deserialization when loading model state dictionaries without PyTorch's weights_only=True security flag, enabling pickle-based arbitrary object execution. With an EPSS score of 0.06% and no confirmed exploitation, this represents a moderate risk primarily in environments where users can upload or specify model files.
Remote code execution in Snorkel machine learning library (≤v0.10.0) occurs when users load untrusted model files via MultitaskClassifier.load(). The vulnerability exploits insecure Python object deserialization through torch.load(), allowing attackers to embed malicious code in model weight files that executes upon loading. EPSS score of 0.06% (19th percentile) suggests low observed exploitation probability in the wild, though SSVC framework indicates total technical impact once exploited. No public exploit code or active exploitation confirmed at time of analysis, but exploitation requires only that a data scientist or ML engineer load a malicious .pkl model file.
Arbitrary code execution in Snorkel library (Python) through version 0.10.0 enables remote attackers to execute code by supplying malicious pickle files to the BaseLabeler.load() method. The vulnerability stems from unsafe deserialization using pickle.load() without input validation, allowing attackers to craft serialized objects that execute arbitrary commands during deserialization. With EPSS at 6th percentile, exploitation probability remains relatively low despite the critical CVSS score, and no active exploitation (KEV) or public proof-of-concept has been identified at time of analysis.
Arbitrary code execution in Snorkel machine learning library (≤v0.10.0) occurs when users load malicious model checkpoint files through the Trainer.load() method. The vulnerability stems from unsafe PyTorch deserialization that processes untrusted Pickle objects without the weights_only security parameter. Attackers can embed malicious Python code in model files distributed through repositories, shared datasets, or social engineering campaigns. Despite the 8.8 CVSS score indicating critical severity, EPSS scoring at 0.06% (19th percentile) suggests very low real-world exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis.