{"uuid": "896bd4f5-6124-4871-bb9f-6bcb11f9746b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-29927", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/117203447693098376", "content": "This week exploitation attempts arrived in same-day cohorts across unrelated flaws.\nAdversaries escalated a Next.js authorization bypass, CVE-2025-29927, across the final three days of the period, from no more than three daily sources to 495 across a partial final day, still climbing when the window closed. It is rated CVSS 9.1 and absent from CISA's Known Exploited Vulnerabilities catalog, so a KEV-driven queue never raises it. On 30 August adversaries checked for nine legacy Citrix flaws in a single day, running matched source sets against eight of them and producing fewer than 1,000 attempts in total. A cohort that ends within the day never sustains enough volume to cross a rate threshold. Count distinct sources per product family per day.\nCustomers get the full weekly brief. Our public At The Edge one-pager is attached + \ud83d\udd17 https://www.greynoise.io/resources/at-the-edge-clear-083126", "creation_timestamp": "2026-09-02T20:58:07.295386Z"}