Full takeover of Oracle Commerce Platform 11.4.0 is possible by a remote unauthenticated attacker who reaches the Dynamo Application Framework component over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation compromises confidentiality, integrity, and availability of the platform (CVSS 3.1 8.1), though Oracle rates it difficult to exploit (AC:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full takeover of Oracle Scripting, the scripted-interaction module of Oracle E-Business Suite (Internal Operations component), is possible by a remote unauthenticated attacker over HTTP in supported releases 12.2.3 through 12.2.15. Because the CVSS vector carries high confidentiality, integrity, and availability impact (8.1), a successful attack yields complete compromise of the module rather than mere data exposure, though the high attack complexity (AC:H) means exploitation is not trivial. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list.
Full takeover of the Oracle Applications Technology Stack is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Client System Analyzer component, which is reachable over HTTP by unauthenticated network attackers. Exploitation is rated difficult (high attack complexity) but a successful attack yields complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content is possible in the Content Server component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker reaching the server over HTTP can achieve complete takeover with full confidentiality, integrity, and availability impact. The flaw carries a CVSS 3.1 base score of 8.1, tempered by high attack complexity (AC:H) that makes reliable exploitation difficult. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so risk is currently theoretical pending patch application from the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Content Server component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker with HTTPS network access can achieve complete takeover of the product. The CVSS 3.1 base score is 8.1 with high confidentiality, integrity, and availability impact, though the flaw is rated difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Full takeover of Oracle Access Manager (Fusion Middleware) is possible via a network-based HTTP attack against the Authentication Engine component in supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated remote attacker (PR:N) can achieve complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), though Oracle rates the attack complexity as high (AC:H), meaning exploitation is difficult and likely requires specific conditions or timing to succeed. This was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Coherence is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects the Core component across Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and yields complete loss of confidentiality, integrity and availability (CVSS 3.1 8.1). Exploitation is rated high-complexity, and no public exploit has been identified at time of analysis.
Full takeover of Oracle Coherence is possible when a remote, unauthenticated attacker reaches the product over TCP and successfully exploits a hard-to-trigger flaw in the Core component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.1). Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cross-site scripting in DayuanJiang next-ai-draw-io 0.4.13 lets a remote unauthenticated attacker inject arbitrary script through the mcp parameter, executing in the victim's browser when they open a crafted link. The 'arbitrary code' claim and RCE tag in the source data most plausibly refer to arbitrary JavaScript in the browser (CWE-79 reflected XSS) rather than server-side code execution. EPSS is low (0.29%, 21st percentile), there is no CISA KEV listing, and no public exploit is confirmed, though third-party GitHub writeups referencing this CVE exist.
Data compromise in Oracle Installed Base (Create Item Instance component) of Oracle E-Business Suite versions 12.2.4 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all data accessible to the Installed Base module. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided in the source data.
Unauthorized data compromise in Oracle Work in Process (a manufacturing module of Oracle E-Business Suite) 12.2.14 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Work in Process application. Oracle rates it 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Broad data compromise in Oracle E-Business Suite Secure Enterprise Search (Search Integration Engine) affects EBS versions 12.2.3 through 12.2.15, where a network attacker with only low-level authenticated access over HTTP can read, create, modify, or delete all data accessible to the Secure Enterprise Search component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) rates it 8.1 High, reflecting low attack complexity and full confidentiality and integrity impact without availability loss. No public exploit identified at time of analysis, though the vendor's 'Authentication Bypass' tagging suggests weak access-control enforcement in the affected component.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact) and tagged as an authentication-bypass-class issue by the reporter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Customers Online (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Oracle rates this CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and the intelligence tag 'Authentication Bypass' suggests horizontal privilege escalation past intended access boundaries. No public exploit identified at time of analysis, and the flaw is fixed in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Applications Framework (12.2.3 through 12.2.15), a core component of Oracle E-Business Suite, allows a low-privileged authenticated attacker with HTTP network access to read, create, modify, or delete all data accessible to the framework via the Graph/Charting component. The Oracle-assigned CVSS 3.1 base score is 8.1 (C:H/I:H) with no availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor-supplied 'Authentication Bypass' tag suggests low authentication barriers relative to the damage achievable.
Data compromise in Oracle Financials Common Modules (Common Components) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact) and tags it as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Cash Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, it was reported by Oracle and disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though low attack complexity and network reachability make it a notable patch priority for EBS operators.
Data compromise in Oracle Sales Offline (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; not listed in CISA KEV.
Unauthorized data compromise in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all iReceivables-accessible data. Oracle rates it CVSS 3.1 8.1 (High) with High confidentiality and integrity impact but no availability impact, and the vendor/community has tagged it as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a strong patching priority for exposed EBS deployments.
Data compromise in Oracle EDI Gateway (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all EDI Gateway-accessible data, including critical data. Rated CVSS 8.1, the flaw is disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass-class issue; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Process Manufacturing Financials (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Content Manager (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, modify, or delete all Content Manager-accessible data. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity damage without service disruption. No public exploit identified at time of analysis and it is not listed in CISA KEV; the Oracle-supplied 'Authentication Bypass' tag conflicts with the PR:L vector and should be treated cautiously.
Unauthorized data compromise in Oracle WebCenter Content (Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all content-server-accessible data. Oracle rates this 8.1 (High) with confidentiality and integrity fully impacted but no availability effect, and the intelligence tags flag an authentication-bypass angle. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the July 2026 Oracle Critical Patch Update.
Compromise of Oracle Product Workbench (a Security component of Oracle E-Business Suite) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the application, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and affects EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it 'easily exploitable.'
Takeover of Oracle Workflow in Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible when an unauthenticated attacker reaches the Workflow Notification Mailer over SMTP. The high-difficulty flaw (CVSS 3.1 base 8.1, AC:H) yields full compromise of the Workflow component with confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated remote attacker fully compromise affected instances by abusing the proprietary T3 and IIOP remote protocols. Supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are vulnerable, and successful exploitation yields complete confidentiality, integrity and availability loss. No public exploit identified at time of analysis; the flaw is rated high complexity (CVSS 8.1) and was disclosed in Oracle's July 2026 Critical Patch Update.
Adjacent-network compromise of Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated attacker on the same physical communication segment read, create, delete, or modify all Coherence-accessible data. Rated CVSS 3.1 8.1, the flaw - tagged as an authentication bypass by the reporter (Oracle) - yields high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis and not listed in CISA KEV; disclosed via the Oracle July 2026 Critical Patch Update.
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify critical HRMS (France) data. Rated CVSS 3.1 8.1 (High) with High confidentiality and integrity impact and no availability impact, Oracle characterizes it as easily exploitable with no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle's disclosure notes low attack complexity.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Oracle rates it CVSS 3.1 8.1 (C:H/I:H) and describes it as easily exploitable, though availability is unaffected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Data compromise in Oracle Flow Manufacturing (Oracle E-Business Suite 12.2.13-12.2.15, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (high) with full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV; disclosure is via Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (High) with high confidentiality and integrity impact but no availability impact, it was reported by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Improper authorization in Gitea before 1.27.0 lets an administrator-deactivated user (IsActive=false) silently reactivate their own account by signing in through an OAuth2/OIDC source that issues no refresh token - notably GitHub, or any OIDC source without offline_access. The reactivation gate added in PR #38009 uses an empty stored refresh token as its signal for 'disabled by auto-sync cron,' but for these sources every user has an empty refresh token, so an administrator's deliberate deactivation is indistinguishable from a cron disable and gets undone on the next login, granting a full session (including regained admin rights, since deactivation does not clear IsAdmin). No public exploit code is packaged, but a detailed, reproducible proof-of-concept is published in the vendor advisory; not listed in CISA KEV.
Branch protection bypass in Gitea versions prior to 1.27.0 allows a user with write (non-admin) access to merge unauthorized code into a protected branch by exploiting a stale approval flag. When a pull request is retargeted from an unprotected branch to a protected one via ChangeTargetBranch, Gitea fails to re-evaluate the stored official=true flag on existing approvals, so an approval that was never valid under the protected branch's whitelist still satisfies its required-approvals gate. Publicly available exploit code exists (a detailed step-by-step PoC in the GHSA advisory); no public exploit identified as actively used and it is not in CISA KEV.
Full application takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to compromise confidentiality, integrity, and availability once a legitimate user is tricked into interacting with attacker-influenced content. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.0 (AV:N/AC:L/PR:L/UI:R) and is addressed in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full takeover of Oracle Process Manufacturing Logistics (a module of Oracle E-Business Suite) is possible for a high-privileged attacker who reaches the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.0 elevated by a scope change (S:C), meaning successful attacks may significantly impact additional Oracle products beyond the vulnerable module. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, though exploitation is rated difficult (AC:H) and requires existing high privileges (PR:H).
Full compromise (takeover) of Oracle Communications Converged Application Server 8.3 is possible via its Security component, where a high-privileged attacker with TLS network access can achieve confidentiality, integrity, and availability loss that also crosses a trust boundary to affect additional products (scope change). CVSS 3.1 scores this 8.0 despite high attack complexity and a high-privilege prerequisite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS value was supplied.
Full compromise of Oracle Sales Offline (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible for an already high-privileged attacker who reaches the Internal Operations component over HTTP, and because the flaw carries a scope change (S:C) a successful attack can significantly impact additional products beyond Sales Offline itself. The issue is rated CVSS 3.1 8.0 but Oracle characterizes it as difficult to exploit (AC:H) and requiring elevated privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the module when a legitimate user is lured into interacting with attacker-supplied content. Per the CVSS vector (PR:L/UI:R), exploitation requires an existing low-level account plus victim interaction, but a successful attack yields high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). No public exploit identified at time of analysis; disclosed via Oracle's July 2026 Critical Patch Update.
Account and system takeover in Oracle WebCenter Content (Fusion Middleware Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to fully compromise the product when a legitimate user is tricked into interacting with attacker-supplied content. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.0 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' framing make it a high-priority patch item.
Account/instance takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product after luring a victim user into an action. Oracle rates it CVSS 3.1 8.0 with High impact to confidentiality, integrity, and availability, and the ecalert tag flags Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged, network-authenticated attacker who lures a victim into a triggering action can achieve complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). Oracle rates the flaw as easily exploitable over HTTP but conditions it on human interaction from a second party. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account/system takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker with HTTP network access fully compromise the platform, provided a legitimate user is lured into interacting with attacker-supplied content. Oracle rates it CVSS 3.1 8.0 with full Confidentiality, Integrity, and Availability loss and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'takeover' outcome and low complexity make it a high-priority patch item.
Authorization token theft in Kubeflow Community Distribution before 26.03-rc.1 lets a low-privileged tenant hijack other users' sessions across the Dashboard, Pipelines API, and Notebooks, resulting in full account and data takeover. Any user holding the kubeflow-edit/Contributor role in any namespace - a role automatically granted when Automatic Profile Creation is enabled - can abuse overly broad Istio permissions to capture the auth tokens of other UI/API users. CVSS is 8.0 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Atlassian Sourcetree for Mac and Windows 3.4.11-3.4.12 enables an authenticated attacker to execute arbitrary code on a victim's machine via code injection (CWE-94), achieving full confidentiality, integrity, and availability compromise. The attack requires low-privilege authentication and user interaction - consistent with a scenario where a victim opens or processes attacker-controlled repository content within the application. No public exploit identified at time of analysis; EPSS at 0.30% (22nd percentile) reflects low current exploitation probability, and the vulnerability was responsibly disclosed through Atlassian's Bug Bounty program rather than discovered in active exploitation.
Full takeover of Oracle Access Manager is possible via its Authentication Engine component, letting a low-privileged attacker on the same physical/adjacent network segment as the server completely compromise the identity platform. Affected releases are Oracle Fusion Middleware OAM 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 8.0 with high confidentiality, integrity, and availability impact. Oracle rates it 'easily exploitable' but no public exploit identified at time of analysis, and it is not on CISA KEV.
Full compromise (takeover) of the Oracle Public Sector Financials (International) module in Oracle E-Business Suite is possible via its Authorization component, affecting supported versions 12.2.3 through 12.2.15. A high-privileged attacker with network access over HTTP can, under difficult-to-exploit conditions, breach the module and, because of a scope change, significantly impact additional connected products. There is no public exploit identified at time of analysis and the issue is not on CISA KEV.
Full takeover of Oracle Access Manager (Authentication Engine component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is possible for a low-privileged attacker positioned on the same physical/adjacent network segment as the host running OAM. Per the CVSS vector (AV:A/AC:L/PR:L), exploitation is low-complexity and requires only some level of existing authenticated access plus adjacent network reachability, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.
Integrity and availability compromise in the Oracle Identity Manager Connector (Generic Unix Connector component) of Oracle Fusion Middleware allows an unauthenticated attacker positioned on the adjacent physical communication segment to modify, create or delete connector-accessible data and to cause a complete, repeatable denial of service. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, and because of a scope change the attack may significantly impact additional integrated products beyond the connector itself. There is no public exploit identified at time of analysis; the flaw is rated CVSS 3.1 8.0 despite high attack complexity.
Data compromise in Oracle Enterprise Command Center Framework V16 (a component of Oracle E-Business Suite) lets an unauthenticated attacker positioned on the adjacent hardware communication segment read, create, delete, or modify all data the framework can access, with a scope change extending impact to additional Oracle products. Oracle rates it CVSS 3.1 8.0 (AV:A/AC:H), reflecting high confidentiality and integrity impact but a difficult, non-remote attack path. This was reported through Oracle's own Critical Patch Update process with no public exploit identified at time of analysis.
Arbitrary code execution in DayuanJiang next-ai-draw-io 0.4.13 arises from a path traversal flaw in the bundled MCP (Model Context Protocol) server, allowing an attacker who can influence a request to the mcp-server component to write or access files outside the intended directory and ultimately run code on the host. The affected product is a niche open-source AI-assisted draw.io diagramming application. No public exploit has been confirmed, though a third-party technical writeup exists; EPSS is low (0.43%, 35th percentile) and the flaw is not in CISA KEV.