As of 2026-07-28, CVE-2026-50522 has substantial public exploitation evidence: listed in CISA KEV, listed in ENISA EUVD (exploited) and a proof of concept. Most recent observation: 2026-07-25.
Every public observation ESIP has recorded for this CVE, with its source and date. Follow any one to the original evidence.
| Observation | Source | Date | |
|---|---|---|---|
| Public proof-of-concept | GitHub PoC | 2026-07-25 | View → |
| Listed in ENISA EUVD (exploited) | ENISA EUVD (Exploited) | 2026-07-22 | View → |
| Listed in CISA KEV | CISA KEV | 2026-07-22 | View → |
This is one exposure signal: it describes an exposure class, not any one organization's assets. The MITRE ATT&CK techniques mapped to it:
No ATT&CK technique mapped.
The MITRE CWE weakness type classified for this exposure class:
| Remediation due date | 2026-07-25 |
|---|---|
| Required action | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| Known ransomware campaign use | None recorded |
ESIP's current exposure signal for this CVE, its lifecycle state, trend, velocity, and corroboration, is available through the commercial API.
Get the assessment →Public evidence is not the whole picture. Limited or absent observed evidence is not the same as safety.
Related CVEs: those that share an ATT&CK technique or CWE weakness with this one.
Data provided by ESIP / ZenzizenSec — www.exposuresignal.io · as of 2026-07-28