CVSS—
Severitynone
Weakness—
EPSS29.2%98.2th percentile
Exploited2 KEV sources
patch window
Called exploited 6 days after disclosure.
Measured from the CVE publication date to the earliest of 2 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing6d
- Last KEV listing43d
- Last sighting6mo
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federaldoes not list it
- EUVDENISA, European Unionlisted Jan 27, 2026
- VulnCheck KEVcommercial researchlisted Dec 15, 2025
- CIRCLaggregator, mirrors the abovelisted Jan 27, 2026, not counted
Sources2 of 3
Listings differ by43 d
Strongest claimconfirmed
2 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationwww.levelblue.com/blogs/spiderlabs-blog/ttp-briefing-q2-2026
- reported exploitationblog.qualys.com/vulnerabilities-threat-research/2026/07/08/f
- reported exploitationwww.trendmicro.com/vinfo/gb/security/news/cybercrime-and-dig
- reported exploitationblackpointcyber.com/wp-content/uploads/2026/04/2026-Annual-T
- reported exploitationwww.sentinelone.com/blog/fortigate-edge-intrusions/
- reported exploitationwww.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-c
11 public reports collected from VulnCheck and CIRCL, first on Dec 15, 2025. Each links to its original source. We have not verified them.
