CVE-2026-68758

CVE-2026-68758 carries a CVSS 6.5 with an EPSS score of 0.00258—an unambiguous signal that automated exploitation is effectively nonexistent in the near term. The authentication requirement compounds this: realistic exploitation demands not just an account, but specific conditions that the vendor declines to articulate. For most security teams, this should land well below unauthenticated vulnerabilities or those with active exploitation tooling. But here's what the metrics miss: this is a support information disclosure, and support interfaces have a documented history as privilege accumulation points. They get carved out for debugging convenience and rarely receive the same security scrutiny as core functionality. Over product versions, they accumulate access to credentials, session tokens, internal API endpoints, and configuration that enables subsequent exploitation. The EPSS captures what's being exploited now—it doesn't model potential severity chains or the position this disclosure holds in an attack graph. The 'specific conditions' qualifier is the most important thing to push back on. It could describe a rare edge case requiring precise timing, or it could mean any authenticated user under normal operation. These are opposite risk profiles, and without clarity, you can't determine if compensating controls suffice. More critically: when vendors can't articulate reproduction steps, it's often because the code path itself is poorly understood—support functionality that accreted privileged access over versions without adversarial review. The 'sediment layers' problem. Your priority decision shouldn't be binary. Instead, treat the vagueness as a vendor communication failure and ask: what does this support information actually contain, and does it connect to credential stores, internal APIs, or cross-system configuration? If the blast radius extends beyond simple information disclosure, the EPSS low score becomes almost irrelevant. Historical precedent shows support information disclosures consistently punch above their CVSS weight when chained with other access—regardless of whether anyone is building automated exploits today.

Reviewed through automated stages and approved by a human before publication.