CVE-2026-15623
The most important detail in CVE-2026-15623 is the word 'legacy.' This isn't filler — it signals code that survived past its intended lifecycle because it was perceived as low-touch or forgotten, precisely the provenance of most SQL injection in modern products. The CVSS 9.4 captures maximum theoretical impact (full blind SQL, authenticated attacker), but it says nothing about how likely that path was to be found or tested. The EPSS of 0.00203 models commodity attacker behavior, but it was never designed to capture how sophisticated adversaries specifically target security tooling as pivot-zero for reconnaissance. In a SOAR platform that ingests your SIEM data, asset inventories, and investigation histories, a successful exploit doesn't yield data — it yields the map. An attacker can reconstruct your detection logic, asset fingerprints, and incident response playbooks through targeted queries rather than bulk exfiltration. The 'authenticated attacker' prerequisite sounds narrow until you map the actual user population: SOC analysts, threat hunters, automation service accounts, integration bots, and the occasional over-privileged admin that every mature SOAR deployment accumulates. The authentication bar is meaningfully lower in a platform built for investigation and automation than in a typical web application. The 'no customer action needed' patch notification is operationally convenient but creates a profound irony: customers have zero visibility into what legacy code paths exist in their managed instance, whether their specific configuration interacted differently with the affected endpoint, or whether their tenant was queried during the window between discovery and patch. For a platform that logs everything, the one query surface you cannot audit is this one. The compounding risk isn't just this CVE — it's that 'legacy dashboard widget API' is almost certainly not unique phrasing. The temporal exposure window matters: this endpoint may have been silently present in production for years before anyone realized it existed. That is the systemic debt that should keep practitioners uncomfortable, not the CVSS-EPSS tension, which is a measurement artifact rather than an operational constraint.
Reviewed through automated stages and approved by a human before publication.