Mover #1 · Confirmed + public PoC
JCE editor extension for Joomla
CriticalConfirmedVerified
What changed
New public PoC detected on ExploitDB, on a CVE already in CISA KEV (added Jun 16)
Why it matters
Already on CISA KEV (government-confirmed exploitation), and a public PoC has now landed on ExploitDB. JCE has a long history as a mass-compromise vector for Joomla sites. Confirmed in-the-wild use plus public exploit code is the combination that precedes spray-and-pray campaigns. Patch now.
Mover #2 · KEV + EPSS accelerating
Splunk Enterprise (below 10.2.4 / 10.0.7)
CriticalConfirmedVerified
What changed
EPSS jumped 0.017 → 0.100 (+0.084 in 5 days · crossed into double digits)
Why it matters
Already KEV-confirmed, and exploitation probability just jumped roughly 6×, from under 2% to over 10% in five days. Splunk sits at the center of security operations; a compromise there hits the very tooling you'd use to detect everything else. KEV says it's being used now; the EPSS climb says broader exploitation is accelerating.
Mover #3 · Newly weaponized chain
CVE-2026-34415 · 34414 · 41459
Xerte Online Toolkits ≤ 3.15
HighActive
What changed
Now High confidence · escalating. One Metasploit module chains all three CVEs
Why it matters
One unauthenticated Metasploit module now weaponizes three Xerte CVEs at once, no credentials required. ESIP raised confidence to High this week. Unauthenticated plus weaponized is the profile to prioritize.