Account takeover in Oracle Agile PLM 9.3.6 (Security component) lets a low-privileged, remotely authenticated attacker fully compromise the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8) and results in complete takeover of the Agile PLM instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full application takeover in Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible via the User and User Group component, where a low-privileged authenticated user with HTTP network access can escalate to complete compromise of confidentiality, integrity, and availability. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's Critical Patch Update of July 2026, exploitation requires only valid low-level credentials and low attack complexity, making it attractive for insider or credential-theft abuse. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible for an authenticated low-privileged attacker reaching the Experience Manager component over HTTP. Rated CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact, this flaw was disclosed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account/system takeover in Oracle Communications Service Catalog and Design (versions 8.0.0.7.0 through 8.3.0.2.0), Solution Designer component, lets a low-privileged attacker with network HTTP access fully compromise the product. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable,' meaning any authenticated user can escalate to complete control. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a low-privileged, network-based attacker fully compromise the module over HTTP with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle classifies it as easily exploitable and rates the outcome as complete takeover of Oracle HRMS (UK). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as a networked, low-complexity flaw requiring only minimal privileges it warrants prompt patching in the July 2026 Critical Patch Update.
Privilege escalation to full component takeover in Oracle E-Business Suite (Oracle Applications DBA, ADPatch component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Oracle Applications DBA subsystem, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Disclosed in Oracle's July 2026 Critical Patch Update, this is easily exploitable per Oracle's own rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a strong patching priority.
Full compromise of Oracle WebCenter Enterprise Capture is possible when a low-privileged, network-authenticated attacker abuses a flaw in the Client Bundle component reachable over HTTP, resulting in complete takeover with high confidentiality, integrity, and availability impact. It affects Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. Oracle rates it easily exploitable (CVSS 8.8), with no public exploit identified at time of analysis and no CISA KEV listing.
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker with network access over HTTP targets the Client Bundle component. Per Oracle's July 2026 Critical Patch Update, successful attacks result in complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full compromise of Oracle Advanced Outbound Telephony (a component of Oracle E-Business Suite) is possible when a low-privileged user with HTTP network access exploits an easily-exploitable flaw in the Internal Operations component, per the July 2026 Oracle Critical Patch Update. Successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact across all supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Account takeover in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access fully compromise the module. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning a valid low-privilege EBS account is the only real barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-but-low privilege requirement make it a strong patching priority.
Takeover of the Oracle Installed Base component in Oracle E-Business Suite (Create Item Instance function) is possible by a low-privileged, remote attacker over HTTP against versions 12.2.3 through 12.2.15. Oracle's July 2026 Critical Patch Update rates this at CVSS 8.8 with full confidentiality, integrity, and availability impact, meaning any authenticated EBS user account can fully compromise the Installed Base module. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Takeover of Oracle Enterprise Asset Management (the eAM module of Oracle E-Business Suite, Internal Operations component) is possible by a low-privileged, authenticated network attacker sending crafted HTTP requests. Oracle rates this CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.3 through 12.2.15, and describes exploitation as easy. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Account takeover in Oracle Applications Framework (Search Bean component) affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, allowing a low-privileged, authenticated attacker with HTTP network access to fully compromise the Applications Framework. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and results in complete takeover of the component. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Full compromise of Oracle WebCenter Content is possible in versions 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component of Oracle Fusion Middleware), where a low-privileged, network-adjacent attacker sending crafted HTTP requests can escalate to complete takeover of the product with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 (CVSS 3.1) and describes it as 'easily exploitable,' meaning any authenticated user with minimal privileges can seize the system. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'takeover' outcome make it a priority patch.
Privilege-based full compromise of Oracle WebCenter Content (Web Content Management component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-authenticated attacker take over the entire product over HTTP. Oracle rates it CVSS 3.1 8.8 with High confidentiality, integrity, and availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and 'takeover' outcome make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Full compromise of Oracle JD Edwards EnterpriseOne Procurement and Subcontract Management (version 9.2) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.8 and Oracle explicitly characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the Procurement component (confidentiality, integrity, and availability all high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authenticated-yet-low-barrier profile makes it a strong patch priority for JD Edwards operators.
Privilege-escalating takeover of Oracle PeopleSoft Enterprise CS Student Records (Campus Solutions) 9.2.38, specifically the Australian Features component, allows a low-privileged attacker with only HTTP network access to fully compromise the module. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8), a single valid low-level application account is enough to achieve complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed via the Oracle Critical Patch Update of July 2026.
Full product takeover in Oracle PeopleSoft Enterprise CS Student Financials 9.2.38 (Billing component) allows a low-privileged, authenticated attacker with HTTP network access to compromise the application, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) indicates easy exploitation yielding complete confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Account takeover in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Integration and Interfaces component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. The Oracle CPU July 2026 advisory rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, and Oracle labels it 'easily exploitable,' meaning any authenticated user can escalate to complete control of the application. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single required privilege make it a strong patching priority for higher-education and enterprise PeopleSoft deployments.
Full compromise of Oracle Transportation Management 6.5.3 (Supply Chain suite, Install component) is possible for a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability loss - Oracle describes the outcome as a 'takeover' of the product. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Full compromise of Oracle Managed File Transfer (MFT Runtime Server) allows a low-privileged, network-authenticated attacker to take over the product via HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects Fusion Middleware MFT versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 8.8 with full confidentiality, integrity, and availability impact, and is rated by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Account takeover in Oracle Managed File Transfer (MFT Runtime Server) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the product. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV. The issue was disclosed by Oracle in the July 2026 Critical Patch Update.
Full takeover of Oracle SOA Suite is possible through the Integration Business Insight component, where a low-privileged attacker with network HTTP access to affected deployments (versions 12.2.1.4.0 and 14.1.2.0.0) can fully compromise confidentiality, integrity, and availability. Oracle rates this CVSS 8.8 and disclosed it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, but the low attack complexity and "easily exploitable" language make it a high-priority patching target. Any authenticated user of the middleware stack - not just administrators - can reach the flaw.
Account takeover in Oracle WebCenter Content: Imaging (Core component of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the Imaging service. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as 'easily exploitable' and results in complete takeover of the product. No public exploit identified at time of analysis, and it is not on CISA KEV.
Account takeover in Oracle JD Edwards EnterpriseOne Solution Advisor 9.2 lets a low-privileged, network-authenticated attacker fully compromise the Solution Advisor component over HTTP. Oracle rates the flaw 8.8 (High) with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning a foothold with minimal application privileges can escalate to complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector warrant prompt patching in the July 2026 Oracle Critical Patch Update.
Product takeover in Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 allows an authenticated low-privileged attacker with HTTP network access to fully compromise the Human Resources component, gaining high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle rates the flaw as easily exploitable, but no public exploit identified at time of analysis and it is not listed in CISA KEV. The bug is addressed in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker sending crafted requests over the WebLogic T3 or IIOP protocols. Successful exploitation yields complete takeover of the Imaging service with high confidentiality, integrity, and availability impact (CVSS 8.8). This was disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Unified Directory (OUD Core component of Oracle Fusion Middleware) is possible when a low-privileged attacker sends malicious traffic over LDAP to affected versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this 8.8 (CVSS 3.1) and characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the directory server, breaching confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing LDAP interface make it a high-priority patch item.
Full product takeover in Oracle GoldenGate Microservices affects releases 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1, where a low-privileged attacker with HTTP network access can compromise the entire GoldenGate instance. Oracle rates this CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and flags it as easily exploitable, meaning a single authenticated foothold escalates to complete control. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Fusion Middleware, Core component) lets a low-privileged attacker with only HTTP network access compromise the entire server. Successful exploitation delivers high confidentiality, integrity, and availability impact (CVSS 3.1 8.8), effectively granting control of the WebLogic instance. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Content Server component) allows a low-privileged, network-based attacker over HTTP to take over the application, impacting confidentiality, integrity, and availability. Affected releases are 12.2.1.4.0 and 14.1.2.0.0, and the flaw is rated CVSS 3.1 8.8 and characterized by Oracle as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Full takeover of Oracle Coherence (Fusion Middleware Core component) is possible by a low-privileged attacker with TCP network access to an affected instance, per Oracle's July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, carrying a CVSS 3.1 base score of 8.8 with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 'easily exploitable' rating combined with complete-compromise impact makes it a priority patch.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network HTTP access to fully compromise confidentiality, integrity, and availability of the server. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's July 2026 Critical Patch Update, the flaw requires only low-level authenticated access and no user interaction, making it attractive for post-authentication lateral movement. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged, remote attacker with HTTP network access to fully compromise the server, per the Oracle July 2026 Critical Patch Update. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and Oracle rates the flaw 'easily exploitable' with high confidentiality, integrity and availability impact (CVSS 3.1 8.8). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-network vector make it a high-priority patch item.
Full database takeover in Oracle Database Server's RDBMS component allows an authenticated, low-privileged user with only network access via Oracle Net to fully compromise the database, per Oracle's July 2026 Critical Patch Update. The flaw affects versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, carrying a CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege bar make it a high-priority patch.
Privilege escalation to full takeover in Oracle GoldenGate Service Manager lets a low-privileged attacker with HTTP network access fully compromise the product across versions 19.1.0.0.0-19.29.0.0, 21.3-21.21, and 23.4-23.26.1.0.0. Oracle rates this easily exploitable with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Product takeover in Oracle Bills of Material (Bill Issues component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access fully compromise the module, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 8.8 with high impact across confidentiality, integrity, and availability, meaning an authenticated user can read, alter, and destroy Bills of Material data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle EBS is a recurring high-value target for post-authentication attacks.
Full compromise of Oracle Enterprise Manager Base Platform is possible through the Self Update Framework component in versions 13.5 and 24.1, where a low-privileged attacker with network access over HTTPS can escalate to complete takeover of the platform. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Full product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a low-privileged, authenticated attacker with network access over HTTPS to fully compromise the platform via the Metadata Plugin component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8, the flaw is described by Oracle as 'easily exploitable' and requires only an existing low-privilege account and no user interaction. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.
Product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Enterprise Config Management component) allows an authenticated low-privileged attacker with network access over HTTPS to fully compromise the platform. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw requires only low privileges and no user interaction, making it readily exploitable once an attacker holds any valid EM account. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Full compromise of Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP by an unauthenticated remote attacker who lures a legitimate user into interacting with malicious content. Rated CVSS 3.1 8.8 with high confidentiality, integrity and availability impact, the flaw can lead to full takeover of the WebCenter Content instance. Disclosed via Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Content (Content Server component of Oracle Fusion Middleware) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker sending crafted HTTP traffic can compromise confidentiality, integrity, and availability, but the attack requires human interaction from a user other than the attacker (UI:R). No public exploit has been identified at time of analysis, and the flaw is fixed in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by a remote, unauthenticated attacker over HTTP, provided a legitimate user is lured into a triggering interaction. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, successful exploitation yields takeover of the WebCenter Content instance. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and network vector make this a priority patch item.
Full takeover of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP, but only after luring a legitimate user into interacting with attacker-controlled input (UI:R). The CVSS 3.1 base score is 8.8 with High impact to confidentiality, integrity and availability, meaning a successful attack yields complete compromise of the product. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, so exploitation is theoretical rather than confirmed.
Full compromise of Oracle Flow Manufacturing (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via HTTP, per Oracle's July 2026 Critical Patch Update. Any authenticated EBS user can leverage the flaw to take over the module, exposing and altering confidential manufacturing data (high confidentiality, integrity, and availability impact, CVSS 8.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle EBS is a recurring target for opportunistic and targeted attackers.
Privilege-escalation-to-takeover in Oracle Warehouse Management (Internal Operations component of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the module. Because CVSS scope is unchanged but all three impacts (C/I/A) are High, a successful attack results in complete takeover of Oracle Warehouse Management. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw 8.8 and characterizes it as 'easily exploitable' with a result of complete product takeover across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low complexity and low-privilege prerequisite make it a strong patching priority for EBS operators.
Privilege escalation to full takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a low-privileged attacker with HTTP network access compromise the Experience Manager component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8 and reported through Oracle's coordinated disclosure (July 2026 CPU), with no public exploit identified at time of analysis and no CISA KEV listing. Any authenticated user of the affected component can potentially seize control of the entire product instance.
Full compromise of Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite, is possible by a low-privileged remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS versions 12.2.3 through 12.2.15, the flaw is rated CVSS 8.8 and yields complete takeover of the OPM Regulatory Management module (high confidentiality, integrity, and availability impact). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patching target.
Account or application takeover of Oracle Applications Framework - the presentation-layer component of Oracle E-Business Suite - is possible when a low-privileged, authenticated attacker reaches the vulnerable Search Bean over HTTP. Affected releases span 12.2.3 through 12.2.15, and a successful attack yields full confidentiality, integrity, and availability compromise of the framework (CVSS 3.1 8.8). This was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.