#jvn

The SiteGuard flaw is being exploited, the fix erases the proof, and the vector says local rather than remote

JPCERT says a completed update may delete the traces of compromise, so the vendor wants diagnostics collected first. And JVN's own CVSS vector describes a local attacker with low privileges, which is not the story the headlines tell.