diff --git a/content/solr/vex/2026-07-18-cve-2025-48734.md b/content/solr/vex/2026-07-18-cve-2025-48734.md
index 39d566522..3e9943fc2 100644
--- a/content/solr/vex/2026-07-18-cve-2025-48734.md
+++ b/content/solr/vex/2026-07-18-cve-2025-48734.md
@@ -2,7 +2,7 @@
 cve: CVE-2025-48734
 category:
   - solr/vex
-versions: "3.6.0-10.0.0"
+versions: "3.6.0-9.10.1, 10.0.0"
 jars:
   - commons-beanutils-1.9.4.jar
 analysis:
@@ -15,4 +15,10 @@ CVE-2025-48734 allows an attacker to access the JVM ClassLoader (and potentially
 CVE-2025-48734 affects all Commons BeanUtils 1.x releases before 1.11.0. Solr has bundled
 commons-beanutils since Solr 3.6.0, and every release that includes it, through Solr 10.0.0, ships an
 affected 1.x version (1.7.0, then 1.8.3, 1.9.3 and 1.9.4 — all below 1.11.0). The affected range is
-therefore 3.6.0 – 10.0.0.
+therefore 3.6.0 – 9.10.1 plus 10.0.0.
+
+The fix has landed on all active development branches: Solr 9.11 (`branch_9x`), 10.1 (`branch_10x`),
+and `main` upgrade the bundled copy to commons-beanutils 1.11.0, and Hadoop 3.4.3 (shipped in 9.11)
+additionally dropped the shaded commons-beanutils it previously carried inside `hadoop-client-runtime`.
+So 9.11 and 10.1 are not affected, and the range is capped at 9.10.1 / 10.0.0 rather than an open
+`3.6.0 – 10.0.0` that would otherwise sweep in the fixed 9.11 release.