Mover #1 · EUVD-confirmed exploitation
SonicWall SMA1000
CriticalConfirmedVerified
Weakness: CWE-918 Server-Side Request Forgery (SSRF); CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
What changed
ENISA EUVD confirmed exploitation on September 3; the signal crossed into Confirmed.
Why it matters
A pre-authentication SSRF in the SonicWall SMA1000 appliance, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. Act now.
Mover #2 · EUVD-confirmed exploitation
SonicWall SMA1000 (command injection)
CriticalConfirmedVerified
Weakness: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
What changed
ENISA EUVD confirmed exploitation on September 3; the signal crossed into Confirmed.
Why it matters
A post-authentication OS command injection in the SonicWall SMA1000, paired with the SSRF above (CVE-2026-83548), now government-confirmed as exploited. Confirmed at critical severity. Act now.
Mover #3 · EUVD-confirmed exploitation
Kestra orchestration
CriticalConfirmedVerified
Weakness: CWE-287 Improper Authentication; CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
What changed
ENISA EUVD confirmed exploitation on September 3; the signal crossed into Confirmed.
Why it matters
An authentication bypass to command injection in the Kestra orchestration platform, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. Act now.
Mover #4 · Newly weaponized
Start_EPI command injection
HighActiveHigh
Weakness: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
What changed
A weaponized exploit landed on ExploitDB (entry 52660).
Why it matters
An unauthenticated command injection in the Start_EPI function, now weaponized on ExploitDB. Active and escalating. Review against your inventory.
Mover #5 · Newly weaponized
Unsanitized file-upload API
HighActiveHigh
Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
What changed
A weaponized exploit landed on ExploitDB (entry 52659).
Why it matters
A path traversal through an unsanitized filename parameter on a file-upload API, now weaponized on ExploitDB. Active and escalating. Review against your inventory.
Mover #6 · Newly weaponized
Wolf CMS
HighActiveHigh
Weakness: CWE-434 Unrestricted Upload of File with Dangerous Type
What changed
A weaponized exploit landed on ExploitDB (entry 52672).
Why it matters
A file-upload RCE in the Wolf CMS FileManager, now weaponized on ExploitDB. Active and escalating. Review against your inventory.