CVE-2026-18634

The CVSS 8.4 rating and EPSS score of 0.00259 are telling you two different stories about this deserialization vulnerability in what appears to be a Windows Group Management System (GMS). The 8th percentile exploit probability suggests threat intelligence feeds don't see active development or proof-of-concept, while the 8.4 treats this as serious. Here's how to think about that gap. First, pressure-test the 'local attacker' constraint. In enterprise environments using Active Directory, this framing is doing enormous work in the EPSS calculation — and it may not reflect reality. A compromised workstation with a service account that has logon rights to the GMS host, a management agent running with elevated privileges, or a scheduled task spanning network boundaries are all 'local' in the sense of not being remote unauthenticated — but none require physical keyboard access. If this GMS is domain-joined and holding trust relationships, the blast radius of a successful exploit extends into every system that host can reach through AD delegation patterns, not just the console session. Second, the 'unauthorized actions' phrasing is dangerously vague. Deserialization bugs collapse three distinct blast radius profiles into a single CVSS score: code execution on a management server (domain compromise), denial of service, or data tampering. These are not equivalent risks. The position of the target in your infrastructure graph matters more than the raw severity number. Third, examine the patch diff if available. A constructor-level fix — proper type checking or allowlist enforcement at object instantiation — suggests the vendor understood the exact sink. A wrapper-level fix — input sanitization before reaching the deserializer — follows a pattern historically bypassed within six months of disclosure. If the patch is access-control-only, the vulnerable code still exists, just wrapped in a gate that may have its own bypass conditions under edge-case service account configurations. Finally, map your service accounts. Determine whether this GMS component is actually invoked only by authenticated local sessions, or whether management agents, monitoring runners, or integration services with elevated privileges can reach it across network boundaries. If you can't definitively answer this, treat the 'local only' constraint as unconfirmed and weight the EPSS accordingly.

Reviewed through automated stages and approved by a human before publication.