Operator SDK <0.15.2 RCE via insecure user_setup /etc/passwd
CVE-2025-7195 Published on August 7, 2025
Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images.
In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
Vulnerability Analysis
CVE-2025-7195 can be exploited with local system access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Timeline
Reported to Red Hat.
Made public. 34 days later.
Weakness Type
Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Products Associated with CVE-2025-7195
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-7195 are published in these products:
Affected Versions
operator-framework operator-sdk:- Before 0.15.2 is affected.
- Version v4.17.39-2 and below * is unaffected.
- Version v4.18.25-3 and below * is unaffected.
- Version v4.20.3-3 and below * is unaffected.
- Version sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83 and below * is unaffected.
- Version sha256:74010cf229f6fa17a927e56f63db06f9fe4ce61dce5e8bece77d05a082c49e3b and below * is unaffected.
- Version sha256:822fc16687164f666df5e498030bec3d3ab1e07d0a0576cc133a468e4ea01cf2 and below * is unaffected.
- Version sha256:b927fed57e3e7e0775ec810400a068b3edaa36b9450628d6e1af097011759e95 and below * is unaffected.
- Version sha256:9e839c3da194c00c7875340662b12caa026f5227f6325901fa6b311bd9cbfff3 and below * is unaffected.
- Version sha256:f23522e8d4bd2f14d07410a33437d3675b797788176beeb66c42f64006329cc2 and below * is unaffected.
- Version sha256:9592965d6225d4d2fe4da7efb83db1241aefc4933767c68f585ef6db9c1e413a and below * is unaffected.
- Version sha256:bf57dd52e5a0e6952921e3823fc7f71096c22965d466477ca57402899d1f4af5 and below * is unaffected.
- Version sha256:69533bf9db1b3c322257d5c6c3f058c87888b70993b08cb90c81c1b9df7c4073 and below * is unaffected.
- Version sha256:efb5ae4311c91dda0b3deae41996dc2e0b0ac8c98ff346cd38ea619d9226b95b and below * is unaffected.
- Version sha256:1c49bf643ea000a0f92a1d93114a4a866ff51f47947c6a7102fb8e200ae57e8a and below * is unaffected.
- Version sha256:3aca4b3b0ee0e2a80cb9f30c64d6f098ba44aa47b599d403a5a2e6215c23e4a2 and below * is unaffected.
- Version sha256:f33b87fa6e230bcea8a1ee1a8818aafb3ffb929fe728a62ee6d4a32a4bd45176 and below * is unaffected.
- Version sha256:b996388849ae27f7721c24987d19e8f0b561ba3c0d03496c89fe1d987a64fe7e and below * is unaffected.
- Version sha256:be638cfd0897aa7c66b1c56b8dee8ba9a30c3497dbfbf1e7855cecf4a00c73b0 and below * is unaffected.
- Version sha256:1a2ef170407505193e8d1ab4832ae0b945ec2fd9245c5a93134ce73f959ea34c and below * is unaffected.
- Version sha256:295cce4181249098c7903b70ef34afe257731e062c9cb944845663929ca8075c and below * is unaffected.
- Version sha256:7ef2d434ff3b461181f4fbead426143e21524bf70e42efb2e5f945f1a4b64b51 and below * is unaffected.
- Version sha256:1c49bf643ea000a0f92a1d93114a4a866ff51f47947c6a7102fb8e200ae57e8a and below * is unaffected.
- Version sha256:3aca4b3b0ee0e2a80cb9f30c64d6f098ba44aa47b599d403a5a2e6215c23e4a2 and below * is unaffected.
- Version sha256:f33b87fa6e230bcea8a1ee1a8818aafb3ffb929fe728a62ee6d4a32a4bd45176 and below * is unaffected.
- Version sha256:a14672d5ff7795881a8c4910c2d9453d0f4b4339cbf3ae3fd511d9394c74aa85 and below * is unaffected.
- Version sha256:be638cfd0897aa7c66b1c56b8dee8ba9a30c3497dbfbf1e7855cecf4a00c73b0 and below * is unaffected.
- Version sha256:1a2ef170407505193e8d1ab4832ae0b945ec2fd9245c5a93134ce73f959ea34c and below * is unaffected.
- Version sha256:295cce4181249098c7903b70ef34afe257731e062c9cb944845663929ca8075c and below * is unaffected.
- Version sha256:7ef2d434ff3b461181f4fbead426143e21524bf70e42efb2e5f945f1a4b64b51 and below * is unaffected.
- Version sha256:4730066d796726424abb881b2564bb7e313237ac877284c206c8aee3e3843b2e and below * is unaffected.
- Version sha256:3f9572ccbe6743da5484d80198c1304e4421d8017636aeb9a33c54aa9eb678e4 and below * is unaffected.
- Version sha256:c539381a8e40366653979a03c61d6bab734d4f91514a0af579d9be724bb141f3 and below * is unaffected.
- Version sha256:ad1dab83354acca5de8658f8a20db7a967c79740a58c4d80f52cfc3352e53298 and below * is unaffected.
- Version sha256:b58b9c3a7f55e640756439369f091398614fdf78b4de83454672968be976d6fd and below * is unaffected.
- Version sha256:56a7d375e7bca09b0d7f12c312414bd04c6a60b59119e9787cf55a9dc5f82626 and below * is unaffected.
- Version sha256:9ed27c8a1d6775d0d80f8595ec1a0a20e4fe24c41872eee2350cc5f269e22960 and below * is unaffected.
- Version sha256:9eb31a2d6f8cc479b72f5b20a144c2fcf1e9db20c86c1ea52e648c08c633bc2c and below * is unaffected.
- Version sha256:746daa9bb14b25657d06f1f812597c9af23bfc3609f5886073350b1ceb76a0a1 and below * is unaffected.
- Version sha256:e268332aeeeebd1d10688d513fa422c1ddf6d2e448f558ddae25ac719dc4f608 and below * is unaffected.
- Version sha256:5f920fdd7a8222e575e3be8108f35053199041f51ea5aef10afdf16270d2c2e5 and below * is unaffected.
- Version sha256:495c95d1a2df101e0bf9c0eaa3caeb575f596d6098782c3a0a1dcb0342589886 and below * is unaffected.
- Version sha256:2e11b27b9d6884dcb846865d632c141a038f85163b0c4db63a1f29cb8d277125 and below * is unaffected.
- Version sha256:36c26ae9529d584fbd4ed24376ff8a83fd583190d4b13461a484e8f49c3ac3b3 and below * is unaffected.
- Version sha256:840fbf02ac4883ef94a41476eb3ab46ffd105726ccd4b02b9b48b6606dcfd8f8 and below * is unaffected.
- Version sha256:b815590412ff4a47e299f5d30703bc292ba70744d58f4a90eabcf4089e50e2d5 and below * is unaffected.
- Version sha256:b7e11d679f6ff14b57eded3b92ce3924103b75fd7b3dbbd1c9e18dd365e9ec55 and below * is unaffected.
- Version sha256:f77f857e0fc5b2fb0044f20f13e251b9fe4d751c51483a8bd9072ed65eaab49f and below * is unaffected.
- Version sha256:4e92e3c853e155b7c60bec1b43fd3844956740bfd447b297a4fe04a817921e81 and below * is unaffected.
- Version sha256:a01b582bf6eb19385e30a2c74957b111f71242059500c3c568c8e0dd1d6683a9 and below * is unaffected.
- Version sha256:37c6415ccd9a7a41d99d67ebe5ffd33c54d723c23e9cb744ea0626a9ab5b7854 and below * is unaffected.
- Version sha256:125a0d04b6b5c6c2338ef18b53860d4118f005c1d0f3691f32baccce4ce9b21b and below * is unaffected.
- Version sha256:7e2deb1a27aa0b83ae76b48abf19d386600275812f4fa7edd1ff38c1989e02dc and below * is unaffected.
- Version sha256:b5acaa9339172b8de24e974f5d8093d3fd7285805f9304d6aff74af9fafc9a20 and below * is unaffected.
- Version sha256:d91bf204588e019c68be8a3c8b07c6a72014fc7f192f9c91f9153882816d4fb4 and below * is unaffected.
- Version sha256:88a9b2224d69eeaa5916f413a32d1779819a06e3003ca147554278d1c637aceb and below * is unaffected.
- Version sha256:125a0d04b6b5c6c2338ef18b53860d4118f005c1d0f3691f32baccce4ce9b21b and below * is unaffected.
- Version sha256:2e4e2180d5912535ac4914569e5e592a501260199cf5371b7d0ac9aec290d0e8 and below * is unaffected.
- Version sha256:bf1433c1b724907496c3ffbe697e1ae3b1c92cdfd1e2836a652eba80c335cb54 and below * is unaffected.
- Version sha256:2e4e2180d5912535ac4914569e5e592a501260199cf5371b7d0ac9aec290d0e8 and below * is unaffected.
- Version sha256:6db1528b64024bc8ef5bcd4be824e28bfc42723a00987bb8c0e9e76a7645b2ab and below * is unaffected.
- Version sha256:bf1433c1b724907496c3ffbe697e1ae3b1c92cdfd1e2836a652eba80c335cb54 and below * is unaffected.
- Version sha256:05847c2e995e681bdcc3f809e76f512767f40ac4498c14fad4afb4cae83f33d1 and below * is unaffected.
- Version sha256:c13595e478ea28b6ba8d146d5a93c6f271babf253653d914139000e5af34d022 and below * is unaffected.
- Version sha256:b2bf3ec7254afae3ff1fb0713e336cd4b58fc734f6439ccdc0bb659e939db885 and below * is unaffected.
- Version sha256:e11fa23f27e11118273b98b57137f42dbbea9b18df0a55e674662cb12522bae5 and below * is unaffected.
- Version sha256:b4e6f98aaf08e97ce0eb68952ee9f5528944cfb38e90274e948b66e2f6ef048c and below * is unaffected.
- Version sha256:59f1ee894fc44d0c3bd9e802b70b7d0a8b021ae703c77468898172d6d36d5a27 and below * is unaffected.
- Version sha256:adf9a3a3a51290b9ab62877c3fcbc96ada222ac757480c1ff13cb4dd521088f6 and below * is unaffected.
- Version sha256:e3b54d5763bdae0de90ea53588d4fa8bf5476ba75c0423d40b334286017c7655 and below * is unaffected.
- Version sha256:066f59015024fd839705ad52d1ce8a10e500040c3905b98bd5533e5dd0e268d7 and below * is unaffected.
- Version sha256:91249fb15a33c0bf8b5bf3c0f236fd4fe272b9221f4fcfa6608e97ba5062c5f3 and below * is unaffected.
- Version sha256:b4568ee6f890f98c1ac67b7115931a0f16bb1d69f3863ce554efddf64ce7b765 and below * is unaffected.
- Version sha256:13b0299a3e045cc02e6d864398e3676b1dc038504fab8993a92b8b8fdff252c6 and below * is unaffected.
- Version sha256:1a8aa05a3f37eff50915cdec070605872f17f86463285dcae212ab4094816452 and below * is unaffected.
- Version sha256:13454f2f70870d6765f740f36582cdf8139c9ed4c0c38e5f8981eea1374771ad and below * is unaffected.
- Version sha256:2e3bcf4dcee937c986ee53ada32dc1ee7e5bdcbd161bfbc942cd6061507f13b3 and below * is unaffected.
- Version sha256:645d5fca647a051a1a23a25f577aa4a7d6520611c97c5232868a49e41156af9e and below * is unaffected.
- Version sha256:d3850e64b6707d4fa8c87efd652e4b06ee122c58fe43040b371295626f7d3784 and below * is unaffected.
- Version sha256:a73d74c5aad19c476d2f6be7bde6763675d68342021e9654dffe4303cf8d2a2c and below * is unaffected.
- Version sha256:0d8ff43ca27a8ca5017fc136f9708c743043b72479bced7ce7a91c1057d92339 and below * is unaffected.
- Version sha256:8d131c609dea271df0cf754e7d28cdb79ad45012c5359f61b13713f9467c8e32 and below * is unaffected.
- Version sha256:0282d53fe18c9f427fc9af81fe64ceecd84cc4aee60878b0a0dfec76f3c6b2a9 and below * is unaffected.
- Version sha256:07fade8638107be11d2eb1fe76cd0e051627d85a28aa00e677e82764d94b9bee and below * is unaffected.
- Version sha256:37a3e93d30c7d2bcf8cd60dc52a9230bcb14baf10a13e3e01cdcb800eced0eec and below * is unaffected.
- Version sha256:b54faa0244881b4712b1803873cf6db3a7b33ef8a906c13328c3244d72aa54bd and below * is unaffected.
- Version sha256:70cc9a59178ea9d801fb8a06ac6bee6cf3b04ab6cefd9c66b52cb3cc88300f0e and below * is unaffected.
- Version sha256:9631af295811dc8923a9b11fe9c59146521ca3c09e914561f804cf2cbdb48d7a and below * is unaffected.
- Version sha256:2dd678e13edff8659bc429b59d9a4a8129c4dca61da8a2e623eabfadc99c35bd and below * is unaffected.
- Version sha256:1587bf92b7369eaefbf2828c324ceb585b3591c397fd1ecd59804875ab7cf64f and below * is unaffected.
- Version sha256:7a1e2d4864765f19d3e82990d547c5afd352bb69e8eede1903999bcca13f25d7 and below * is unaffected.
- Version sha256:8ed89037982928b39705d3554f51012c537bef9994e2895511a8a356d735fb2a and below * is unaffected.
- Version sha256:8b739d8102a7af6efbf3435d44efd5d00798782109c106d91aeef9f5d766db2b and below * is unaffected.
- Version sha256:37e578ff98671dcbadae9e613512600c8ecf9c1017bce3ce00ddba78239485cd and below * is unaffected.
- Version sha256:08df676115e46d1dea0c175df6e56f4501aa79d9590ed9790e1d218994999839 and below * is unaffected.
- Version sha256:65faa431e4154804f3b3330e37bf97ebfc4a5fbe2ece950e54a50827dd1848e7 and below * is unaffected.
- Version sha256:6b47f30899b9eaef4a08de84be1c785a2d5e189914d270f3a50968238690ad8f and below * is unaffected.
- Version sha256:7b82430d91bd92f7103b73f39e1eeee300b036cf2dcd24bba4d8a6c73585636e and below * is unaffected.
- Version sha256:78215ea775ed2c537d7a22f9c5107e0e07089c85f19ba9c3cc7ba40af3efc9bc and below * is unaffected.
- Version sha256:823e0e164ee8b775d43da7e14858ab3af2d4a02d1ab61b8e9059374db8aed53e and below * is unaffected.
- Version sha256:5cae35740c21d6d3c5d72986edc2b160091b8892bce21d9e0e5a6a1cf92dba26 and below * is unaffected.
- Version sha256:4e8b2ecb4e17c95e6ff584a05f1d0563285aeb5c1a84bf99faddfa408da1a1f0 and below * is unaffected.
- Version sha256:27b15f29e01661f7b6857e5da669d4b81f9f1cbcd97e186603552455d82d3152 and below * is unaffected.
- Version sha256:6e62b04f43e61a08cebddd4155ad7240a876ce96c4f2f950556559bfc99e8c78 and below * is unaffected.
- Version sha256:12451b0a143da79ef8012629abdf852c94a2388e0fc35cf0d550493a430b5d67 and below * is unaffected.
- Version sha256:42bf30dbe0a237936719b62aa1087075e7b387998d2143c2a16a7b7c9960e9fc and below * is unaffected.
- Version sha256:cc6996d1f74c05e15f829b5ee7c230e6c1969ee17f9ce653ca5aa9fa8e8e2fcc and below * is unaffected.
- Version sha256:f4a5e16ed21a930a510b5f695a645be2cb6bff1487f5865650fe3c0759e25689 and below * is unaffected.
- Version sha256:88ee659ec3dee8762aef89123cab66c71e58cf473af2b1f3c9abfff65d645c50 and below * is unaffected.
- Version sha256:f1c8c40ee99ee53c66bba5a4d81c87f1396097316f31dec48a1646701f41f232 and below * is unaffected.
- Version sha256:8c9693993390434902aef2af7beb58823b8646dad7f3ac317ec7e7faafde9767 and below * is unaffected.
- Version sha256:e6fb7a9352e05748be5085eb685af6ecd4ac6c466fac27f6391b1e801f79c7c8 and below * is unaffected.
- Version sha256:c2f92235f218700f0d19cda4ae7e2d58689f82f4d31e1e97aa446ae6658a7c64 and below * is unaffected.
- Version sha256:57f81dbdd41c7ffba5d245a3cfff9192051443da9e77da67a54df4459f472a5a and below * is unaffected.
- Version sha256:81406e5a67aa735204cbb02891f9074ce834e13d9c0225d2ee679dd49e3f3d73 and below * is unaffected.
- Version sha256:87f98b47c63d90a92b3f38ea964d1351832a54e288b39af82a534b577c42b43c and below * is unaffected.
- Version sha256:8c03adf5bf39500da25a90054356ea16d1c7ec4ecd5d76784af6792db256cd9b and below * is unaffected.
- Version sha256:4203be47980aac5ac4f0df5cf1452684b65efb0c3b99fba663e215b9d4ee45ba and below * is unaffected.
- Version sha256:924467600e2487103c8a1d4cd83df9afd3ae4ac8c0bb5442fe85f22b96c77d1a and below * is unaffected.
- Version sha256:befb8628ba9619d150958d10500a775dee304a87e7bd2dca62f43a9eb19f44ab and below * is unaffected.
- Version sha256:2e5849819b5220b3b7c2185a1fe85b6d02151bc44aa5e582f7f0090d77cbb591 and below * is unaffected.
- Version sha256:6ddcc11d8dccc02a79c55d157326c715c160a53382e5d74fa3329e55d58fdbfd and below * is unaffected.
- Version sha256:4f3cec816be976a96538d11c74ca76ecbbaab65099f5f712d8d2f4c3bfbe527b and below * is unaffected.
- Version sha256:b0b7b38bcb61288eaf3a7f7339ed0b2f4dbbf463f71ee6f64400dbecbf995d31 and below * is unaffected.
- Version sha256:04037c00520f7f909565b6461455f0878a54d9f879b328708872c7f03bd24175 and below * is unaffected.
- Version sha256:875e86d19b02583156eb12fc726b5089a377403088389997383c0c986e3b2fc1 and below * is unaffected.
- Version sha256:fa22abd3771012d249add9357a05ac7adb6d41783f09fb0920cbc340a3134739 and below * is unaffected.
- Version sha256:c7705b99cc2d009d2e0f09fd5051f8b971af863384c2b71e4923f52f3430febf and below * is unaffected.
- Version sha256:c934f1d948599bb2ab0f3dbf567b965dac1f2253c51b922cb6df5584592f0685 and below * is unaffected.
- Version sha256:a8135ff473a1f8fa10a7e58258a6e355e58d6df2a89caf9c15d7c2c437d5cb8f and below * is unaffected.
- Version sha256:52b41ec0e8f6f6e5f39aa2f1c173eef364fcae6e78a8c6091f0c6b3583221034 and below * is unaffected.
- Version sha256:b2ec7b94fa8e3e95fbe9195f0ae886d85fa6edc592949b6d28eb67e5e5cd1654 and below * is unaffected.
- Version sha256:f408b197483b49725f11757d3adac645353cfdafffff59298aca57bc012a538d and below * is unaffected.
- Version sha256:55e3e523175182a9f5536e3d331ad57596b5d28d51e7177efb875d16fa81ecc2 and below * is unaffected.
- Version sha256:8903e0bced0e11a54fcba807bda0e5e4a4ca3072c62b3e1a8262df657e5de955 and below * is unaffected.
- Version sha256:0c3219a8065376f68178b94273c691afa37d5b2ab49f26e1f8167624a1487965 and below * is unaffected.
- Version sha256:2cc37571ac6b16b0f64917fd0724f1b9551cbf3b0fcd6974d8290d2a72a38a82 and below * is unaffected.
- Version sha256:44cc96e8349dffd1258b7e1a2e3b80616a3452c6c15f3b34e1d8de66ddcaa4cc and below * is unaffected.
- Version sha256:cdef73e0cbd481a89d5d73958b497ec03fae71eabf99baf54fa8cc85c212e6f5 and below * is unaffected.
- Version sha256:ce4d79d310a644286872f9026bab2fe0725b4fc9baf230b407bc5eb5326c8136 and below * is unaffected.
- Version sha256:adb7d9f0c0b064f4525eb2d78c3f233ccfcb0fcc0fe90e4fc284c1db54e547a4 and below * is unaffected.
- Version sha256:06cffda6829fdcc6ecb2b2da7dfa2bf090f0755867e2569f7ce14d1d57f6080a and below * is unaffected.
- Version sha256:b5c2f9936dee5d3a61215b9745b6204963213399a087e1e2502d79de8d2b7194 and below * is unaffected.
- Version sha256:9ce5157811f6d08cd803b1daad2b4d30cb1bf334a044b4676186321c322957f9 and below * is unaffected.
- Version sha256:f0475eb47712991a30abb4ae9af9bec4849f4b04a2c5edae9586f570c78aaff6 and below * is unaffected.
- Version sha256:1690d6c99f4626289bcdd78c8521edffb61c91da1a45aa2eb2b6ab2af137b7c1 and below * is unaffected.
- Version sha256:f4615211c16cc89f94043e2588400957b8fd225f233c86096542ac1364678cf4 and below * is unaffected.
- Version sha256:c8dce4a25f10645edc649576e995b2b6619c8bc39c2c30d3cffbe3a3c3a86b35 and below * is unaffected.
- Version sha256:852442ee591c566acde876d1101b89f6009f186f6f705bb128754b2ed0043d46 and below * is unaffected.
- Version sha256:37d0208891259e9d725fb4146d023c1f0cd0dafbff8e322b7c12621ea25f8c85 and below * is unaffected.
- Version sha256:2bd4927011a029a1dd7ba2baa2fdc759d431550879eddc8813d89cb44cdb2767 and below * is unaffected.
- Version sha256:d40189f09ff39240e5e49412c1314d9911fcb957459c7496b215da8c9f758b8e and below * is unaffected.
- Version sha256:d2cc16ec9cc1f40da3b1967bc9a7b208062c5bc4a2753213ae2c41c62c5115aa and below * is unaffected.
- Version sha256:c786effa06598ecb80690644d1c9075588e123ad200db05686568a80a1feeb56 and below * is unaffected.
- Version sha256:b14c3a7c4cc6531ed0d9701fe1b07ddc8c85e702ef8b058f0eaaadb1e8852a04 and below * is unaffected.
- Version sha256:20c7a4f70f6000f204a3c53c153aaa3c08be94c98c09b90f538b2a19156a00e0 and below * is unaffected.
- Version sha256:bdfb055790f5c58fd4d5699cdcb07151f4be909d920f3243d4610b74183a961d and below * is unaffected.
- Version sha256:95172347459900115fd67d22daa025b8545a9ee9ec05d1098f9196710c720d76 and below * is unaffected.
- Version sha256:116f99072859f76161266a538d92d7e19e3b463fc18e6084cf7faf7a6b311116 and below * is unaffected.
- Version sha256:ea4c2c1e333eb04d8d5514d255336aa7f0d20fa462b595ebcadcf2929acf9909 and below * is unaffected.
- Version sha256:ca0284c10827905e1576ea0a01bb09425acbf96d30b2e556b34e22e2d0115196 and below * is unaffected.
- Version sha256:c988f8015f90581e97bb97210853d417b7f090e62d39a0469865e1628a9dbbd3 and below * is unaffected.
- Version sha256:74b1659b62a5d75ef62f8fc46701445a51a1e78e8d7d96ccccab47cdd67acacb and below * is unaffected.
- Version sha256:f0fc8196ffce6f355f06c0157a38e36109eaa9be1f3e91ad71fdd72bc33ee509 and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.