Type confusion (CWE-843) in Microsoft SQL Server 2025 enables authenticated, low-privileged network attackers to disclose sensitive server-side information. The CVSS vector (AV:N/PR:L/C:H) confirms that any authorized database user - regardless of their data access permissions - can potentially trigger the flaw remotely with no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the high confidentiality impact and low access complexity make patching a meaningful priority for organizations running SQL Server 2025.
Denial of service in the Microsoft Windows DHCP Server role allows a remote, unauthenticated attacker to exhaust server resources and knock the service offline over the network. The flaw affects a broad range of supported Windows Server releases (2012 through 2025, including Server Core installations) and carries a CVSS 7.5 rating driven entirely by availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Information disclosure in Microsoft Windows Remote Desktop (RDP) allows a remote, unauthenticated attacker to read out-of-bounds memory over the network, potentially leaking sensitive process data from affected systems. The flaw (CWE-125) affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H1 and Server 2025, and is patched by Microsoft. There is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with a low EPSS probability (0.89%).
Information disclosure in the Windows Remote Desktop Protocol (RDP) stack allows an unauthenticated, remote attacker to read uninitialized memory contents over the network, affecting virtually all supported Windows client and server releases from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-908, use of uninitialized resource) carries CVSS 7.5 with a pure-confidentiality impact (C:H/I:N/A:N) and requires no authentication or user interaction. There is no public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with a partial technical impact; the EPSS score of 0.89% (55th percentile) indicates modest near-term exploitation likelihood.
Information disclosure in the Windows Remote Desktop Protocol (RDP) stack lets a remote, unauthenticated attacker read uninitialized memory over the network, potentially leaking sensitive data such as memory contents or fragments of prior sessions. It affects a broad range of Windows client and server builds from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Reported by Microsoft with a patch available; no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.89%.
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) lets a remote, unauthenticated attacker read out-of-bounds memory across a wide swath of Windows client and server builds (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through Server 2025). The root cause is an off-by-one error (CWE-193) that overreads adjacent memory, potentially leaking sensitive process data; CVSS is 7.5 with confidentiality-only impact and no code execution. There is no public exploit identified at time of analysis, and the low EPSS (0.89%) plus CISA SSVC exploitation status of 'none' indicate no observed exploitation yet.
Denial of service in the Windows Domain Controller role on Windows Server 2025 (including Server Core) and Windows 11 24H2/25H2/26H1 lets a remote, unauthenticated attacker crash or hang authentication services by triggering an untrusted pointer dereference over the network. Because the CVSS vector is PR:N/UI:N with A:H and no confidentiality or integrity impact, a single crafted network exchange can disrupt directory and logon services domain-wide without credentials. No public exploit identified at time of analysis, and it is not on CISA KEV; Microsoft has released a patch.
Denial of service in Microsoft Windows HTTP.sys allows remote unauthenticated attackers to exhaust system resources and make affected hosts unresponsive over the network. The flaw stems from missing resource limits/throttling (CWE-770) in the kernel-mode HTTP protocol stack, affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available via MSRC.
Denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows a remote, unauthenticated attacker to crash the service and disrupt authentication across all supported Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The flaw stems from an excessive-size memory allocation (CWE-789) triggerable over the network with no privileges or user interaction, and while a vendor patch is available, there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is limited to availability (A:H) with no confidentiality or integrity loss, but LSASS failure can force system instability or reboots, affecting domain authentication and logon.
Denial of service in Windows Active Directory (spanning Windows 10, Windows 11, and Windows Server 2012 through 2025) lets a remote, unauthenticated attacker send crafted network traffic that drives an AD service into an infinite loop, exhausting CPU and rendering domain services unavailable. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high availability impact and no confidentiality or integrity loss, this is a pure availability threat against domain controllers. Microsoft has released a patch; there is no public exploit identified at time of analysis and no CISA KEV listing.
Network denial of service in the Windows Internet Key Exchange (IKE) protocol implementation allows an unauthenticated remote attacker to crash affected systems by triggering a heap-based buffer overflow. All impact is to availability only (CVSS 7.5, A:H, no confidentiality or integrity loss), making this a reliability/uptime threat against IPsec/VPN-facing Windows 10, Windows 11, and Windows Server hosts rather than a code-execution vulnerability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a meaningful patching priority for internet-exposed IPsec endpoints.
Denial of service in Microsoft Active Directory Federation Services (AD FS) allows a remote, unauthenticated attacker to crash the service by triggering a stack-based buffer overflow over the network (CVSS 7.5, availability-only impact). Because AD FS brokers single sign-on and federated authentication, a successful attack can knock out login for every downstream application that relies on it. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in Microsoft Active Directory Federation Services (AD FS) allows a remote, unauthenticated attacker to crash the service by sending crafted network input that overflows a stack buffer (CWE-121). Because AD FS commonly fronts single sign-on for Microsoft 365, Azure AD, and federated web applications, an outage cascades into loss of authentication for every relying-party application. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; a Microsoft patch is available, and the CVSS 3.1 score is 7.5 (availability-only impact).
Remote denial of service in Microsoft Active Directory Federation Services (ADFS) allows an unauthenticated network attacker to crash the service via a stack-based buffer overflow (CWE-121). The flaw affects the ADFS role across Windows Server 2012 through 2025 (and the underlying Windows 10 1607/1809 servicing components), carries a CVSS 7.5 availability-only score, and was reported by Microsoft with a patch available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in the Windows HTTP/2 network stack allows a remote, unauthenticated attacker to exhaust server resources and render affected services unavailable across a broad range of Windows client and server releases (Windows 10/11 and Windows Server 2016 through 2025). Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.5 CVSS reflects high availability impact with no confidentiality or integrity loss.
Denial of service in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker crash the service by triggering a stack-based buffer overflow (CWE-121) over the network. The flaw affects AD FS as shipped across a broad range of Windows client and server builds (Windows 10/11 and Windows Server 2012 through 2025). Microsoft - the reporting party - has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in Windows Cryptographic Services affects a broad sweep of supported Microsoft platforms, from Windows 10 (1607) and Server 2012 through Windows 11 26H1 and Server 2025. A memory-leak flaw (CWE-401) lets a remote, unauthenticated attacker send network traffic that fails to release memory over time, degrading or exhausting the affected service until availability is impacted. There is no public exploit identified at time of analysis, exploitation is not yet observed (SSVC: none), and EPSS is low (0.78%), but a vendor patch is available and Automatable is 'yes', warranting prompt patching.
Information disclosure in the Windows Network Policy Server (NPS) SNMP component allows a remote, unauthenticated attacker to read out-of-bounds memory over the network and disclose sensitive process data. The flaw affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. It was reported by Microsoft, a vendor patch is available, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Information disclosure in the Windows Kernel allows a remote, unauthenticated attacker to read out-of-bounds memory and leak sensitive data across all currently supported Windows client and server builds (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025). The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N, high confidentiality impact only). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege, no-interaction profile makes it a broadly applicable patch-now item.
Buffer over-read in Microsoft SQL Server 2025 exposes server memory contents to low-privileged authenticated attackers over the network, resulting in high confidentiality impact with no integrity or availability consequences. Both the Cumulative Update 6 (CU 6) and General Distribution Release (GDR) servicing tracks on x64-based systems are confirmed affected per vendor CPE data. No public exploit has been identified and CISA has not listed this in KEV; SSVC assessment corroborates no active exploitation at time of analysis, placing this in a measured but real priority category for environments handling sensitive SQL data.
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows a remote, unauthenticated attacker to read out-of-bounds memory over the network, potentially leaking sensitive process data such as memory addresses that defeat ASLR, session state, or credential fragments. The flaw (CWE-126, buffer over-read) affects a broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11 including 26H1. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none; EPSS estimates a modest 0.67% (48th percentile) probability of exploitation.
Information disclosure in the Windows Remote Desktop Protocol (RDP) stack across Windows 10, Windows 11, and Windows Server 2012 R2 through 2025 lets a remote, unauthenticated attacker read memory beyond intended bounds and leak sensitive data over the network. Microsoft has published a patch and CVSS 3.1 rates it 7.5 (high) for the confidentiality-only impact. There is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as 'none' with only partial technical impact, so this is a patch-on-schedule issue rather than an emergency.
Information disclosure in the Windows Remote Desktop Client (mstsc/RDP client component) lets a remote attacker read memory beyond an intended buffer boundary, leaking potentially sensitive process data over the network. The flaw affects a broad span of supported Windows client and server releases from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. There is no public exploit identified at time of analysis, EPSS risk is modest (0.64%), and CISA's SSVC framework marks exploitation as 'none' — a patch is available from Microsoft.
Remote code execution in the Microsoft Windows DHCP Server role (Windows Server 2012 through 2025, plus Windows 10 1607/1809) arises from a double-free (CWE-415) condition that an authorized, network-adjacent attacker can trigger to run arbitrary code in the DHCP service context. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N) indicates a network-reachable but high-complexity attack requiring low-level privileges, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation appears theoretical rather than active for now.
Improper authentication in Windows Admin Center (versions prior to 2.6.5.16) enables an authenticated low-privilege attacker over a network to bypass authentication controls and access sensitive information beyond their authorized scope. The flaw is classified as CWE-287 (Improper Authentication) and affects all Windows Admin Center 1809.0 installations below the patched release. No public exploit code has been identified and CISA has not listed this in KEV, indicating no confirmed active exploitation at the time of analysis.
Credential disclosure in Visual Studio Code (including GitHub Copilot integration) exposes user credentials to network-positioned attackers across all versions prior to 1.128.1. Rooted in CWE-522 (Insufficiently Protected Credentials), the flaw enables a remote unauthenticated attacker to capture credentials when a user performs a triggering action, potentially granting access to GitHub or Microsoft services. No active exploitation is confirmed (SSVC: Exploitation none; not in CISA KEV), and the EPSS score of 0.60% reflects low observed exploitation probability at time of analysis.
Information disclosure in the Windows Media component of Microsoft Windows (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025) allows a remote, unauthenticated attacker to read sensitive information over a network. CVSS 3.1 scores this 7.5 (C:H/I:N/A:N), reflecting a pure confidentiality breach with no integrity or availability impact. There is no public exploit identified at time of analysis, and SSVC rates exploitation as none with partial technical impact; EPSS is a modest 0.58% (44th percentile).
Denial of service in libsoup's WebSocket permessage-deflate implementation lets a remote, unauthenticated attacker crash applications by sending a small, highly compressed 'decompression bomb' that expands without bound during inflation, exhausting memory and triggering an Out-of-Memory kill. All Red Hat Enterprise Linux 6 through 10 ship the affected libsoup HTTP/WebSocket library, and client connections are especially exposed because the decompressed-size guard (max_total_message_size) is disabled by default for clients. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Remote code execution in the Windows Print Spooler components stems from an improperly synchronized race condition (CWE-362) that an authenticated, network-adjacent attacker can win to run code with full system impact. Microsoft (the reporter) has shipped fixes across the entire supported Windows and Windows Server line, but exploitation requires low privileges and a hard-to-hit timing window, so this is a real-but-non-trivial priority rather than a drop-everything emergency. There is no public exploit identified at time of analysis, EPSS is low at 0.53% (41st percentile), and CISA SSVC scores exploitation as none.
Elevation of privilege in the Windows SMB implementation allows an authenticated network attacker to win a race condition and gain higher privileges on affected systems, spanning Windows 10, Windows 11, and Windows Server 2012 through 2025. The flaw is a concurrency defect (CWE-362) reported by Microsoft with a vendor patch already released; there is no public exploit identified at time of analysis. Note a data conflict: the description and CVSS impacts describe privilege elevation with full confidentiality/integrity/availability impact, while the intelligence tags also label it 'Information Disclosure' — the CVSS vector should be treated as authoritative.
Arbitrary code execution in andreimarcu linx-server (a self-hosted file/media sharing service) versions 1.0 through 2.3.8 can be triggered by a remote attacker abusing a Cross-Site Request Forgery flaw in the uploadPutHandler function, per NVD and MITRE. Because the upload endpoint lacks anti-CSRF protection, an attacker can forge upload requests that ride an authenticated victim's session to achieve code execution. No public exploit has been identified in the provided data, though a third-party vulnerability report is referenced; the flaw is not listed in CISA KEV and no EPSS score was supplied.
Stored cross-site scripting in EasyAdminBundle (Symfony admin generator) versions 5.0.0 through 5.0.12 allows a lower-privileged user with access to a form using FileField or ImageField to upload a browser-executable .html or .svg file that EasyAdmin then links to inline, executing attacker-controlled JavaScript in a viewing administrator's authenticated session. Impact includes session/CSRF-token theft and privilege escalation; it is explicitly NOT remote code execution because filenames come from Symfony's guessExtension(). There is no public exploit identified at time of analysis and it is not in CISA KEV; a vendor patch is available in 5.0.13.
Insecure deserialization in the SAP Change and Transport System Attach Tool (ctsattach) lets an authenticated, low-privileged attacker achieve remote code execution by supplying a crafted archive that a victim then processes through the tool's library. Successful exploitation yields high confidentiality and integrity impact - attackers can read sensitive data and take control of the host and its processes - with low availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause and 7.6 CVSS make this a meaningful patch priority for SAP landscapes.
Elevation of privilege in the Windows Network File System (NFS) component affects a broad range of Microsoft platforms - Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025 - where an authorized attacker can win a time-of-check/time-of-use (TOCTOU) race condition over the network to gain higher privileges. The CVSS 3.1 vector (AV:N/AC:H/PR:L) indicates a network-reachable but high-complexity flaw requiring low-level existing privileges, with full high impact to confidentiality, integrity and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a Microsoft (MSRC) patch is available.
Elevation of privilege in the Windows Media component of Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an authenticated attacker to win a race condition and gain higher privileges over a network, with total loss of confidentiality, integrity, and availability. The flaw was reported by Microsoft and a patch is available; SSVC currently rates exploitation as none and no public exploit identified at time of analysis. Note a data conflict: the description characterizes this as network privilege escalation while vendor tags label it 'Information Disclosure' - verify intended impact with the MSRC advisory.
Remote denial of service in libsoup, the GNOME HTTP client/server library, allows unauthenticated attackers to crash any application using libsoup's WebSocket support by sending a single malformed control frame. The parser fails to enforce RFC 6455's 125-byte limit on PING/PONG/CLOSE control frames and mishandles the oversized payload instead of cleanly closing the connection, causing an internal processing crash. Red Hat reports the flaw across RHEL 6 through 10; no public exploit has been identified at time of analysis and no EPSS score was provided.
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on the c2pa Rust SDK (≤0.84.0), the c2patool command-line utility (≤0.16.5), or the @contentauth/c2pa-web JavaScript SDK (≤0.7.0) by supplying malformed input that the library fails to validate. Because exploitation requires no authentication and no user interaction, an application that ingests attacker-controlled assets or manifests can be reliably knocked offline. There is no public exploit identified at time of analysis, and the low EPSS (0.41%) with CISA SSVC exploitation status of 'none' indicates no observed activity yet, though the flaw is assessed as automatable.
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that ingests attacker-supplied C2PA-signed assets. The flaw stems from improper input validation (CWE-20) in the Rust c2pa SDK, the @contentauth/c2pa-web JS SDK, and the c2patool command-line utility; exploitation requires no user interaction and no authentication (CVSS 7.5, A:H). No public exploit code has been identified and it is not in CISA KEV, though CISA's SSVC framework flags it as automatable, meaning a working exploit could be scaled easily.
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS SDK (@contentauth/c2pa-web ≤0.7.0), and the c2patool command-line utility (≤0.16.5) - allows a remote attacker to gain unauthorized read access to sensitive credentials due to insufficient protection of stored secrets (CWE-522). The CVSS 3.1 vector (AV:N/PR:N/UI:N, C:H) rates it 7.5 High with no authentication or user interaction required. There is no public exploit identified at time of analysis, CISA SSVC lists exploitation as none, and EPSS is low at 0.39% (31st percentile), so no active exploitation is evidenced.
Information disclosure in Fortinet FortiAuthenticator (6.5 all versions and 6.6.0–6.6.2) lets a remote unauthenticated attacker read out-of-bounds memory via a specially crafted request, exposing sensitive in-memory data. The CVSS temporal metrics (E:F, RC:C) indicate a functional, confirmed exploit is understood by the vendor, and an official fix is available (RL:O). No CISA KEV listing is present, so this is not confirmed as actively exploited despite the mature exploit signal.
Privilege escalation in Microsoft Azure CycleCloud allows a network-authenticated low-privileged attacker to elevate their access level by exploiting a missing authorization check (CWE-862). All Azure CycleCloud versions from 1.0.0 up to 8.9.1 are affected, with version 8.9.1 serving as the patched release. Publicly available exploit code exists per SSVC assessment, though EPSS probability remains low at 0.37% (29th percentile), suggesting limited but non-zero exploitation interest.
Elevation of privilege in the Windows Media component of Windows 11 (versions 24H2, 25H2, and 26H1) allows an authorized attacker to win a race condition and gain higher privileges over a network. The CVSS 3.1 base score is 7.5 with full confidentiality, integrity, and availability impact, though the high attack complexity reflects the timing precision needed to exploit the flaw. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in the pyasn1 Python ASN.1 library (versions prior to 0.6.4) allows a remote attacker to exhaust CPU and crash applications by supplying crafted BER, CER, or DER encoded data. The shared BER decoder parses long-form tags without bounding the tag ID size, so a malicious tag forces construction of an arbitrarily large integer whose processing scales quadratically, and on Python 3.11+ triggers unhandled ValueError exceptions in integer-to-string error formatting. No public exploit identified at time of analysis, though the fix commit ships proof-of-concept test cases; not listed in CISA KEV.
Denial of service in NVIDIA Triton Inference Server for Linux allows remote unauthenticated attackers to trigger uncontrolled resource consumption, exhausting server resources and rendering the model-serving endpoint unavailable. The flaw carries a CVSS 7.5 with a pure availability impact and no confidentiality or integrity effect; it was reported by NVIDIA, and there is no public exploit identified at time of analysis. No special access is required, but the concrete resource-exhaustion trigger is not detailed in the available data.
Denial of service in the pyasn1 Python ASN.1 library (all versions prior to 0.6.4) allows remote attackers to exhaust CPU by submitting a small crafted OBJECT IDENTIFIER or RELATIVE-OID whose arcs are decoded in quadratic time, so any application that calls decode() on untrusted ASN.1 data can be stalled per call; re-encoding such values triggers the same blow-up. Rated CVSS 7.5 (availability-only) with no confidentiality or integrity impact; no public exploit identified at time of analysis, though the fix commit ships a regression test that effectively demonstrates the trigger. As a foundational dependency behind LDAP, SNMP, X.509/PKI and crypto tooling across the Python ecosystem, its broad transitive reach makes this notable despite the modest severity.
Uncontrolled resource consumption in the pyasn1 Python ASN.1 library (versions prior to 0.6.4) lets remote attackers hang applications that decode untrusted BER/CER/DER data. A REAL value only a few bytes long can encode an enormous exponent; when the decoded univ.Real object is later printed, logged, compared, or converted via prettyPrint(), str(), int(), or float(), pyasn1 performs exact big-integer exponentiation that consumes excessive CPU and memory. There is no public exploit identified at time of analysis, but the network/no-auth/no-interaction, availability-only profile makes this a straightforward denial-of-service primitive; the issue is fixed in version 0.6.4.
Denial of service in aMule 2.3.3 lets a remote eD2k server crash the client by sending a malformed OP_SERVERMESSAGE packet that overflows a stack buffer (CWE-121). The flaw is triggered client-side when parsing server-supplied message data, so any hostile or spoofed server the client connects to can terminate the application. No public exploit has been identified at time of analysis, and the issue is documented only as an upstream bug report (amule GitHub issue #445), not a released patch.
Denial of service in NVIDIA Triton Inference Server for Linux stems from a stack-based buffer overflow (CWE-121) reachable by remote, unauthenticated attackers over the network. Per the CVSS 3.1 vector, exploitation requires no privileges or user interaction and impacts only availability (A:H), with no confidentiality or integrity effect. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.
Denial of service in NVIDIA Triton Inference Server for Linux allows a remote, unauthenticated attacker to disrupt availability by triggering use of an expired (stale) file descriptor. The flaw impacts availability only (no data exposure or code execution) and, per CVSS PR:N/UI:N, requires no authentication or user interaction. There is no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; no EPSS score was provided in the input.
Heap corruption in Google Chrome's Ozone graphics/windowing layer (versions prior to 150.0.7871.125) lets a remote attacker who lures a victim to a crafted HTML page and coaxes them into specific UI gestures trigger a use-after-free with total technical impact. Chromium rates the underlying bug Critical, though the CVSS is 7.5 because exploitation hinges on user interaction and high attack complexity. There is no public exploit identified at time of analysis, EPSS risk is low (0.30%, 22nd percentile), and CISA SSVC records exploitation status as none.