Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attacker execute arbitrary OS commands by injecting CRLF characters that break the intended neutralization of command input. Rated CVSS 9.8 (network, no authentication, no user interaction) with total confidentiality, integrity, and availability impact; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS probability is modest at 0.50% (40th percentile).
Remote code execution in IBM webMethods Integration (on-prem) 10.15 and 10.11 allows an unauthenticated network attacker to run arbitrary code by submitting maliciously crafted serialized data that the platform deserializes without validation (CWE-502). Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full CIA impact (9.8 Critical), exploitation requires no credentials and no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the vendor (IBM) has released a patch, indicating a confirmed, fixable flaw.
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary OS commands by injecting shell-control environment variables into the MCP (Model Context Protocol) stdio launcher. The DANGEROUS_ENV_VARS blocklist in src/lfx/src/lfx/base/mcp/util.py omits SHELLOPTS, BASHOPTS, and PS4, letting an attacker abuse Bash's xtrace behavior to execute commands when a stdio-based MCP server subprocess is spawned. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector; a vendor patch is available, but no public exploit code or CISA KEV listing has been identified at the time of analysis.
Default-credential authentication bypass in the LazyOwn RedTeam/APT Framework (grisuno/lazyown) before 0.2.154 lets any network-reachable attacker log into the C2 dashboard using the hardcoded operator credentials 'LazyOwn'/'LazyOwn', gaining full operator-level control of the command-and-control server. The framework ships these defaults in payload.json and core/payload_schema.py and passes them unchanged into lazyc2.py's HTTP Basic authentication. No public exploit identified at time of analysis, but the credentials are trivially known from the source code, and the CVSS base score is 9.8 (Critical).
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the inference server by abusing the /update_weights_from_disk endpoint, which falls back to torch.load(..., weights_only=False) and thus deserializes attacker-controlled pickle streams embedded in .bin model-weight files. Because SGLang's HTTP serving API is typically exposed without authentication, an attacker able to reach the endpoint and influence the loaded weights path can achieve code execution as the serving process. This is a CWE-502 deserialization flaw rated CVSS 9.8; a vendor security advisory (GHSA-wf98-gv64-5wrf) and a public technical disclosure exist, though EPSS remains low (0.26%, 18th percentile) and it is not in CISA KEV - no public exploit identified at time of analysis beyond the disclosure write-up.
Authentication bypass in Rocket.Chat's SAML SSO before 8.7.0 (and the 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, 7.10.14 branch fixes) lets a remote unauthenticated attacker log in as any user, including administrators, via an XML Signature Wrapping attack. The parser validated that a signature was cryptographically correct against the trusted IdP certificate but never bound that signature to the samlp:Response/saml:Assertion actually processed, so forged identity attributes wrapped alongside a genuine signature were accepted. There is no public exploit identified at time of analysis, but a HackerOne report and an upstream patch with signature-scope regression tests exist; EPSS/KEV data was not provided.
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the optional dumper subsystem, escaping the intended sandbox when DUMPER_SERVER_PORT is configured. The flaw is code injection (CWE-95) triggered via inference requests, carrying a CVSS 9.8 with SSVC noting proof-of-concept exploit code and automatable exploitation. Currently there is publicly available exploit code exists per the CERT/CC disclosure, though EPSS remains low at 0.17% (7th percentile), and it is not listed in CISA KEV.
Privilege escalation via user impersonation affects Apache JSPWiki through version 2.12.3, where the UserManager component fails to properly validate identity checks, letting attackers assume other users' identities and elevate their privileges. The flaw is classified as an authentication bypass (CWE-290) and carries a CVSS 9.8, though its EPSS score is low (0.16%, 6th percentile) and no public exploit has been identified at time of analysis. A vendor patch is available in version 2.12.4.
SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
OS command injection in dnsmgr version 2.15 and earlier lets an attacker execute arbitrary commands through the ping function in CheckUils.php, which passes unsanitized input into a system shell call (CWE-77). SSVC rates the technical impact as total and marks exploitation as proof-of-concept, so publicly available exploit code exists, though it is not on CISA KEV and EPSS is low (0.15%). The published CVSS is 9.8, but note the description characterizes the attacker as 'local' while the CVSS vector encodes AV:N - this discrepancy affects real-world exposure and should be resolved against the target deployment.
SQL injection in CodeAstro Membership Management System 1.0 lets remote unauthenticated attackers manipulate backend database queries through the 'id' parameter of /memberProfile.php, enabling extraction or modification of member records and potential full database compromise. The flaw is trivially reachable over the network (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) and a public technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV. EPSS is low at 0.14% (4th percentile), indicating no observed mass exploitation to date despite the maximal severity score.
SQL injection in CodeAstro Membership Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'id' parameter of /delete_membership.php, enabling full database compromise. The flaw carries a CVSS 9.8 rating with SSVC noting a public proof-of-concept and 'total' technical impact, though publicly available exploit code exists rather than confirmed active exploitation. Despite the critical severity, EPSS estimates only a 0.14% exploitation probability (4th percentile), reflecting the product's niche footprint.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' GET parameter of /print_membership_card.php. Because the endpoint accepts attacker-controlled input directly into a SQL statement, an attacker can extract, alter, or destroy membership records and potentially compromise the entire application database. A public technical write-up documenting the exact injection point exists (TaintRadar research repository), though there is no public exploit identified as weaponized and EPSS remains very low (0.14%, 4th percentile), indicating no observed widespread exploitation.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers inject arbitrary SQL through the membershipType parameter of renew.php, exposing the backend database to read, modification, and potential full compromise. Rated CVSS 9.8 with an unauthenticated network vector, though this is a niche PHP application and there is no public exploit identified at time of analysis. EPSS is very low (0.14%, 4th percentile), indicating little observed exploitation interest despite the high severity.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 lets attackers manipulate the backend database through the unsanitized 'id' parameter of the edit_type.php endpoint (CWE-89). The maximal CVSS 9.8 vector reflects full compromise of confidentiality, integrity, and availability, though the low EPSS score (0.14%, 4th percentile) indicates minimal observed exploitation activity to date. The flaw is documented in public research (TaintRadar) and VulDB, but no public weaponized exploit or active exploitation is confirmed.
SQL injection in CodeAstro Membership Management System 1.0 allows attackers to manipulate backend database queries through the unsanitized 'id' parameter of /edit_member.php, enabling extraction or modification of member records and potentially full database compromise. The flaw is a classic CWE-89 error where user-supplied input is concatenated directly into a SQL statement. Publicly available exploit code exists in a documented writeup, though the vulnerability carries a low EPSS probability (0.14%) and is not in CISA KEV, indicating no confirmed active exploitation.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers manipulate backend database queries through the unsanitized fromDate parameter in report.php and revenue_report.php. With no public exploit identified at time of analysis and a very low EPSS score (0.14%), the flaw carries a maximal CVSS 9.8 but appears to affect a niche PHP application; authentication requirements not confirmed beyond the PR:N stated in the CVSS vector, which indicates unauthenticated access. Successful exploitation permits full read/write access to membership and financial data.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of /delete_members.php. Per the supplied CVSS 3.1 vector (PR:N), no authentication is required, giving attackers full read/write/delete access to the underlying database. There is no public exploit identified at time of analysis, though a TaintRadar research write-up documenting the flaw is referenced; the EPSS score is low (0.14%, 4th percentile) and the CVE is not listed in CISA KEV.
SQL injection in UMAI Vision Traffic Analysis System (versions 29/30 up to but not including 34) lets remote unauthenticated attackers inject arbitrary SQL commands through unsanitized input, enabling full database compromise. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector, the flaw was reported by Turkey's national CERT (TR-CERT) and has a vendor patch available. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Heap-based buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls audio stream metadata corrupt heap memory through the latinToUTF8() character-encoding routine, with SSVC rating the technical impact as total (potential code execution, information disclosure, DoS or privilege escalation). The flaw is demonstrated by publicly available exploit code but is not listed in CISA KEV, so it reflects a POC-stage issue rather than confirmed active exploitation. The library is a widely-used hobbyist Arduino/ESP32 audio component, so exposure is concentrated in embedded maker and IoT projects rather than enterprise fleets.
Use-after-free memory corruption in SQLite 3.41's JSON extension (json.c, jsonCacheInsert) can be triggered when an application processes attacker-influenced JSON through SQLite's JSON1 functions, potentially leading to a crash (denial of service) or, if the freed heap object is reclaimed and controlled, memory disclosure or code execution in the host process. Because SQLite is an embedded library, real-world reach depends on whether the front-end application exposes JSON functions to untrusted input. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' - the 9.8 rating appears heavily influenced by an assumed network vector rather than demonstrated remote exploitability.
Out-of-bounds heap read in node-re2 prior to 1.25.2 allows process termination and limited heap memory disclosure when an attacker-influenced lastIndex value is used against a non-ASCII subject string. The flaw arises because lastIndex is validated against the UTF-8 byte length of the input but consumed as a UTF-16 code-unit offset - for any non-ASCII character, the UTF-8 byte count exceeds the UTF-16 unit count, creating a gap where a lastIndex passes the guard yet reads past the allocated buffer. The resulting crash is uncatchable by the Node.js process, making it an effective denial-of-service vector in any server application exposing this code path to external input. No active exploitation confirmed (not in CISA KEV); no public exploit code identified at time of analysis.
Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted untrusted input to the Web Authentication (WebAuthn) component. Rated High severity by Chromium and scored CVSS 9.6, it is a second-stage bug chained after an initial renderer exploit rather than a standalone remote compromise. No public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.34% (27th percentile).
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 151.0.7922.72 lets a remote attacker who lures a victim to a crafted HTML page trigger a type confusion (CWE-843) and potentially break out of the renderer sandbox. Google rates the Chromium severity High, and the CVSS 9.6 reflects a scope-changing bug requiring only that the victim open a page. There is no public exploit identified at time of analysis, EPSS is low at 0.31% (24th percentile), and CISA's SSVC marks exploitation as none.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and CVSS 9.6, the flaw is a CWE-843 type confusion; Google has shipped a fixed Stable channel build. There is no public exploit identified and no CISA KEV listing, and EPSS is low at 0.31% (24th percentile), indicating no evidence of active exploitation at time of analysis.
Sandbox escape in Google Chrome on ChromeOS (versions prior to 151.0.7922.72) stems from a heap buffer overflow in the Color component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the severity High and the CVSS score is 9.6 owing to the scope change into the host OS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.31% (24th percentile), consistent with a second-stage bug that requires a prior renderer compromise.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Ozone platform abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader host access. Rated Critical by Chromium with CVSS 9.6 and a scope-changed vector, though exploitation currently shows as none in CISA SSVC and EPSS is low (0.31%). Vendor patch is available; no public exploit or KEV listing has been identified at time of analysis.
Sandbox escape in Google Chrome's ANGLE graphics layer, fixed in stable release 151.0.7922.72, lets a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader access on the host. Rated Critical by Chromium and scored CVSS 9.6, the flaw stems from insufficient validation of untrusted input (CWE-20) processed by ANGLE and carries a scope-changing impact. There is no public exploit identified at time of analysis and EPSS is low at 0.31% (23rd percentile), but the Critical rating and sandbox-escape primitive make prompt patching important.
Sandbox escape in Google Chrome's Views UI framework (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Google rates the Chromium severity Critical (CVSS 9.6), and while a patch is available on the Stable channel, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.31%. Exploitation depends on chaining a prior renderer compromise, so this is one link in a full exploit chain rather than a standalone remote-code-execution bug.
Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from insufficient input validation in Dawn, Chromium's WebGPU implementation, and allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer/GPU-process sandbox (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; EPSS is low at 0.31% (23rd percentile), consistent with SSVC rating exploitation as 'none' despite a 'total' technical impact. Chrome rates the underlying Chromium bug as Critical.
Sandbox escape in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 151.0.7922.72, where an integer overflow can be triggered by a crafted HTML page to potentially break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, with a vendor patch already shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). Because sandbox escapes in ANGLE are typically chained with a renderer bug, this is a high-value component of a full-chain browser exploit rather than a standalone remote code execution.
Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who already controls a compromised renderer process break out of the sandbox through crafted input handled by the browser's Accessibility component. Rated High by Chromium and CVSS 9.6, it is a second-stage bug typically chained after an initial renderer exploit, giving an attacker a path to full compromise of the browser/host context. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and it is not on CISA KEV.
Sandbox escape in Google Chrome for macOS prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox and reach the more-privileged browser process by loading a crafted HTML page that abuses Chrome's MHTML handling. It is rated High by Chromium and carries a CVSS 9.6 (scope-changed) score, but exploitation is a second-stage step that presupposes prior renderer compromise. There is no public exploit identified at time of analysis, and EPSS is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process leverage a use-after-free in the Audio component to break out of the sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to scope change, this is a second-stage exploit primitive rather than an initial-access bug; no public exploit has been identified at time of analysis and EPSS is low at 0.29%. A vendor patch is available in Chrome 151.0.7922.72.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Chromium severity High with a CVSS 9.6, the flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; a vendor patch is available. There is no public exploit identified at time of analysis and EPSS is low (0.29%), consistent with SSVC showing no known exploitation.
Sandbox escape in Google Chrome's ANGLE graphics layer on macOS (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope change from renderer to host, it enables full compromise of the browser process. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome on macOS (versions prior to 151.0.7922.72) stems from an inappropriate implementation in ANGLE, Chrome's graphics abstraction layer, allowing a remote attacker to break out of the renderer sandbox via a crafted HTML page after the victim loads it. Rated High by Chromium and carrying a CVSS 9.6 (scope-changed), it enables an attacker to escalate from web content into higher-privilege execution on the host. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.29%, 21st percentile).
Sandbox escape in Google Chrome on Windows before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process leverage a use-after-free in the DataTransfer component (clipboard/drag-and-drop data) to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 driven by scope change and full CIA impact, though EPSS is low (0.29%) and there is no public exploit identified at time of analysis. It is not on CISA KEV and requires an existing renderer compromise plus user interaction, making it a second-stage bug in an exploit chain rather than a standalone entry point.
Sandbox escape in Google Chrome on Windows (versions prior to 151.0.7922.72) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity High and a fix is available in the Stable channel, but there is no public exploit identified at time of analysis and the EPSS probability is low (0.29%, 21st percentile). Exploitation requires user interaction (visiting a page) and, per the CVSS scope-change vector, success would elevate impact beyond the initially compromised component.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the browser's Input handling, which an attacker who has already compromised the renderer process can leverage via a crafted HTML page to break out of the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to scope change, it requires user interaction (visiting a malicious page) and a prior renderer foothold. There is no public exploit identified at time of analysis and EPSS is low (0.29%), reflecting a chained, non-trivial exploitation path rather than trivial mass exploitation.
Sandbox escape in Google Chrome for iOS before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating a contained renderer foothold into broader control (CVSS 9.6, scope-changed). Reported internally by the Chrome team under CWE-20 insufficient input validation; no public exploit identified at time of analysis, and EPSS is low at 0.29% (21st percentile), consistent with a chained bug that is not yet weaponized. Vendor-released patch is available in stable channel 151.0.7922.72.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome's ANGLE graphics layer on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the renderer sandbox and gain broader access on the device via a crafted HTML page. Rated High by Chromium and scored CVSS 9.6 largely because of the scope change from a successful escape. There is no public exploit identified at time of analysis, and EPSS is low (0.29%, 21st percentile), consistent with a bug that only becomes useful after a prior renderer compromise.
Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and the EPSS probability is low at 0.29%.
Sandbox escape in Google Chrome's Chromecast component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Rated High by Chromium and scored CVSS 9.6 due to scope change, it is a classic second-stage browser exploit chained after an initial renderer bug. No public exploit is identified at time of analysis and EPSS is low (0.29%), consistent with a bug requiring a prior renderer foothold rather than a single-shot drive-by.
Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though it requires a pre-existing renderer compromise as a chained prerequisite. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%).
Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and total confidentiality/integrity/availability impact, though there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with a second-stage bug that requires prior renderer compromise rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome for iOS before version 151.0.7922.72 allows a remote attacker to break out of the browser's security boundary when a victim opens a crafted HTML page. Rated High by Chromium and carrying a 9.6 CVSS due to a scope-changing, high-impact outcome requiring only user interaction, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). A vendor-released patch is available and CISA SSVC currently records exploitation status as none.