Threat actor is using the flaw to deliver Core Impact backdoor on vulnerable systems, security vendor says.