cve recordexploit reported

CVE-2025-29927

CVSS—

Severitynone

Weakness—

EPSS99.2%99.9th percentile

Exploited1 KEV source

patch window

Called exploited 7 days after disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

CVE publishedMar 21, 2025
First KEV listingMar 28, 20257d
Last sightingSep 6, 20261.4y

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Uniondoes not list it
VulnCheck KEVcommercial researchlisted Mar 28, 2025
CIRCLaggregator, mirrors the abovelisted Apr 24, 2025, not counted

Sources1 of 3

Listings differ by—

Strongest claimconfirmed

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

reported exploitationSep 6, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2025-2
reported exploitationSep 4, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2025-2
reported exploitationSep 4, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationSep 3, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2025-2
reported exploitationSep 3, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationSep 2, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2025-2

76 public reports collected from VulnCheck and CIRCL, first on Mar 28, 2025. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2025-29927

CVE-2025-29927May 7, 2026high

Cloud Worm PCPJack Steals Credentials and Evicts TeamPCP Artifacts

A newly identified cloud worm, dubbed PCPJack, is actively targeting exposed cloud infrastructure to steal credentials and remove any artifacts associated with the threat actor group TeamPCP. SentinelLabs researchers discovered the framework, which operates as a credential theft toolset that propagates across cloud environments.