Ugh, this is even worse. The vuln was just disclosed a couple months ago, and so it was literally just a matter of time if not all systems were patched.

I can't for the life of me understand why these systems aren't air gapped, or at the very least network access is restricted to a small number of IPs or hardware keys.