A security vulnerability identified as CVE-2010-20125, affecting the DedeCMS content management system, has been reported as being actively exploited on the same day it was officially disclosed. The vulnerability was reserved on October 29, 2026, and subsequently published on October 30, 2026. Evidence of exploitation surfaced on that same date, marking a rapid transition from public disclosure to active abuse.
The nature of the flaw involves file inclusion within the DedeCMS platform, specifically linked to the plus directory. While the vulnerability has been documented in public records, it currently lacks a formal CVSS severity score. The Exploit Prediction Scoring System (EPSS) places the vulnerability at a 0.55% probability of exploitation, ranking it in the 46.3rd percentile for potential risk.
The claim that the vulnerability was exploited on the day of its disclosure is primarily supported by data from a commercial vulnerability research catalog. This source recorded the first instance of exploitation on October 30, 2026. An additional aggregation service, the Computer Incident Response Center Luxembourg (CIRCL), also reflects this timeline, though it functions as a mirror for other intelligence sources rather than an independent validator.
Despite these reports, the vulnerability has not yet been included in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog, nor has it been listed by the European Union Agency for Cybersecurity (ENISA) vulnerability database. Because the claim of active exploitation rests on a single primary research source, it remains uncorroborated by federal or international governmental security bodies.
The information regarding the exploit is currently based on two public reports collected by research entities. These reports provide links to the underlying evidence of the file inclusion issue, but the specific details of the exploitation methodology have not been independently verified by third-party security analysts.
Organizations utilizing DedeCMS are advised to monitor their environments for signs of unauthorized file access or suspicious activity within the plus directory. As with any file inclusion vulnerability, the risk typically involves the potential for remote code execution or unauthorized access to sensitive system files.
The rapid timeline between the publication of the CVE record and the reported exploitation underscores the ongoing challenge of patching cycles in widely used content management systems. Administrators should prioritize checking for official patches or vendor-provided mitigations to address the file inclusion flaw.
At this stage, no further details regarding the identity of the threat actors or the scale of the exploitation have been confirmed. Security teams should rely on official vendor advisories and reputable threat intelligence feeds to determine if their specific DedeCMS version is susceptible to the reported exploit.
