Mover #1 · EUVD-confirmed exploitation
ICS (authentication bypass)
CriticalConfirmedVerified
Weakness: CWE-290 Authentication Bypass by Spoofing
What changed
ENISA EUVD confirmed exploitation on October 14 (added to CISA KEV October 13); the signal crossed into Confirmed.
Why it matters
An authentication bypass by spoofing in ICS before 25.1.3.0, now government-confirmed as exploited and corroborated by ENISA EUVD. A remote attacker can bypass authentication outright. Confirmed at critical severity. No waiting for further evidence.
Mover #2 · EUVD-confirmed exploitation
Command-injection flaw
CriticalConfirmedVerified
Weakness: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
What changed
ENISA EUVD confirmed exploitation on October 14 (added to CISA KEV October 13); the signal crossed into Confirmed.
Why it matters
A command-injection flaw, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. No waiting for further evidence.
Mover #3 · EUVD-confirmed exploitation
Palo Alto (management interface RCE)
CriticalConfirmedVerified
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
What changed
ENISA EUVD confirmed exploitation on October 15 (added to CISA KEV October 14); the signal crossed into Confirmed.
Why it matters
A remote code execution in the Palo Alto management interface, now government-confirmed as exploited and corroborated by ENISA EUVD. Management-plane RCE means full device control. Confirmed at critical severity. No waiting for further evidence.
Mover #4 · Newly weaponized
Grafana (SQL Expressions RCE)
HighActiveHigh
Weakness: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-94 Improper Control of Generation of Code ('Code Injection')
What changed
A public PoC landed (ExploitDB) and a Metasploit module followed.
Why it matters
The Grafana SQL Expressions experimental feature allows command and code execution, now weaponized with a public PoC and a Metasploit module. Active and escalating at high severity. Review against your inventory.
Mover #5 · Newly weaponized
OpenCTI (template injection RCE)
HighActiveHigh
Weakness: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
What changed
A Metasploit module landed (opencti_notifier_rce).
Why it matters
A server-side template-injection RCE in OpenCTI, now weaponized with a public Metasploit module. Active and escalating at high severity. Review against your inventory.
Mover #6 · Newly weaponized
OpenCTI (authentication bypass)
HighActiveHigh
Weakness: CWE-287 Improper Authentication
What changed
Weaponized by the same Metasploit module (opencti_notifier_rce) as CVE-2026-39980.
Why it matters
An improper-authentication flaw in OpenCTI, chained in the same public Metasploit module as CVE-2026-39980. Active and escalating at high severity. Review against your inventory.
Mover #7 · Confirmed, escalating fast
Cisco Secure Email (AsyncOS)
CriticalConfirmedVerified
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
What changed
EPSS probability jumped from 0.02 to 0.28 and keeps climbing, thirty-six days in.
Why it matters
A SQL injection in Cisco AsyncOS email parsing, confirmed exploited and still escalating at high velocity more than a month on. Treat as immediate.