Do we know which "third party app" had the vulnerability?