CVE-2026-28002

CVE-2026-28002 presents a classic prioritization puzzle: a blind SQL injection with CVSS 8.5 but an EPSS score of just 0.0026—fifteen times below the typical urgency threshold. The temptation is to treat this as a scoring anomaly to reconcile. Don't. The divergence is real and meaningful, and collapsing it into a single priority metric will cost you. Blind SQL injection is operationally expensive. Extracting a single credential hash typically requires 10,000–50,000 boolean inference requests or time-based delay measurements. This isn't a payload you run from a scanning tool and forget—it demands tooling, sustained access, and patience. That's why EPSS captures what it does: threat actors optimizing for volume won't bother, and the detection ecosystem reflects that absence. But read that carefully: EPSS models *observed* exploitation patterns, which correlate with opportunistic scanning. It says nothing about actors already positioned inside your perimeter, or those targeting your specific product stack with intention. The Booktics context adds a layer most analysts underspend time on. The version range 'n/a through 1.0.22' tells you something critical: this vendor almost certainly lacks the development hygiene that produces precise version ranges—binary analysis, fuzzing pipelines, static analysis integration. Vulnerabilities in this category tend to get found externally, often years after introduction. The unknown birthdate isn't just a data quality gap; it's an unmeasured exposure window. An attacker with patience doesn't care about EPSS. They've had years of quiet time. More concerning still: version 1.0.22 with an undefined birthdate signals potentially abandoned software. Abandoned code doesn't vanish from production—it lingers, often running in workflows the security team doesn't even know exist. The organizations still running this product probably aren't receiving security bulletins, and downstream integrations with payroll, CRM, or authentication systems may mean a single foothold collapses an entire network. The practical posture: treat the CVSS-EPSS gap as informative, not contradictory. For blind SQLi in niche or aging products, the EPSS floor is genuinely lower—but the ceiling (blast radius, dwell time, chaining potential) may be higher than either score captures. Prioritize based on product criticality and integration surface, not score alone. And verify whether Booktics is even actively maintained before assuming the patch will arrive.

Reviewed through automated stages and approved by a human before publication.