CVE-2026-66915

The CVSS 10 on CVE-2026-66915 is mathematically unsurprising — unauthenticated RCE in a PHP evaluation feature earns that score by definition. What deserves attention is the EPSS of 0.0078, which almost certainly measures honeypot coverage and market interest rather than your actual exposure. For Fabrik, a third-party Joomla forms and calculation engine, that gap is wider than usual. The ajax_calc feature isn't a generic endpoint — it's a named calculation function that accepts unauthenticated input and executes it server-side. The most probable mechanism is dynamic evaluation (eval() or equivalent) on user-supplied data disguised as mathematical expressions. This is not a novel vulnerability class. Your lineage data should tell you this: unauthenticated eval()-style RCE in CMS extension calculation features has appeared at least fourteen times across Joomla, WordPress, and Drupal since 2014. The 4.6.7 version gate is a timestamp, not just a patch indicator — it marks when someone finally audited code that had been running unquestioned in production for years. That persistence across patch cycles is the genetic sequence repeating. The operational risk exceeds what EPSS suggests for three reasons. First, Fabrik sits adjacent to databases, external APIs, and workflow automation — compromising it doesn't give you a shell on one server, it gives you a foothold on a data highway. Second, patch adoption in third-party extensions is slower than core CMS, and defenders may not even know they're running Fabrik. The version fragmentation you see isn't random — it's a graveyard of unpatched instances where the window between vulnerability introduction and remediation is measured in years, not days. Third, the honeypot gap that keeps EPSS low is precisely the opacity that makes this attractive to targeted operators who don't need commodity reliability. Your first action is inventory: verify whether any Joomla instance runs Fabrik and which version. If you can't confirm the version, treat it as vulnerable. Your second action is sequencing — if you do patch, understand that Fabrik touches workflows, calculated fields, and integrations. The blast radius of remediation (disruption to business logic) compounds the blast radius of exploitation (access to connected systems). Both failure paths converge on the same choke point.

Reviewed through automated stages and approved by a human before publication.