A published CVE is kind of late in the game even.