I went through CISA Advisories's September 29, 2026 report on this: CISA Adds One Known Exploited Vulnerability to Catalog.

I am working from that public report, then saying what I take from it. If this sits near your stack, read the original and any official notice before you move.

I am writing from CISA Advisories. That is the source. The framing is mine.