CVE-2026-44963

The 9.4 CVSS score on CVE-2026-44963 needs different handling than your typical critical vulnerability. Here's why: the EPSS sits at 0.02351, meaning roughly 2.3% probability of exploitation in the next 30 days — well below thresholds that trigger emergency patching at most organizations. Don't treat this as a scoring error. CVSS measures what could happen if exploited; EPSS measures what's actually happening. Both can be right simultaneously. The more important question is what you're protecting. This vulnerability affects a Backup Server, and that context changes everything. A compromised backup server doesn't just give you code execution on one system — it gives attackers the keys to every recovery point across your domain, the ability to corrupt backups so recovery becomes impossible, and persistence that survives standard remediation because your persistence IS the backup. The blast radius radiates outward to every system the backup infrastructure touches. On the 'authenticated domain user' prerequisite: treat this as an insider threat scenario, not an access control barrier. In most enterprise environments, domain users are abundant, and lateral movement to domain credentials is a solved problem for attackers. The CVSS treats 'authenticated' as a meaningful hurdle; organizational reality often makes it nearly free. Your risk model should assume this prerequisite is met. Prioritize in this order: First, verify that your backup infrastructure has compensating controls — network segmentation, strict service account least privilege, enhanced monitoring on backup server authentication events. Second, validate your patching pipeline can safely apply the fix to backup infrastructure without breaking recovery jobs. Third, patch — but recognize that a failed patch on backup infrastructure is itself a catastrophic event. The operational fragility of backup servers means remediation planning matters as much as the remediation itself. The EPSS-CVSS gap here isn't a reason to ignore either signal. It's a reason to weight asset criticality above the CVE score, because on a Backup Server, the blast radius of exploitation far exceeds what any scoring system can capture.

Reviewed through automated stages and approved by a human before publication.