CVE-2026-75627

The critical disconnect here isn't between CVSS and EPSS scores—it's between how the vulnerability works and how defenders will actually experience it. CVE-2026-75627 is a path prefix bypass in Bastillion's dispatcher validation logic. An attacker prepends arbitrary path segments to manipulate which filter chain the application applies, effectively selecting an authenticated context without valid credentials. This is not a spray-and-pray vulnerability; it requires understanding how the dispatcher normalizes and matches URI paths, then constructing a prefix that resolves to an authenticated route without triggering filters. The practical impact chain is severe—unauthenticated access leads to user enumeration, manager account creation, managed system registration, and direct SSH fleet control. But each step adds operational complexity, which likely explains the EPSS 0.00443 reading. However, dispatcher bypass vulnerabilities follow a predictable pattern: initial low exploitation, then rapid weaponization once the technique becomes public. The EPSS captures this moment; it won't capture the spike six months from now when every offensive toolkit includes this bypass. The blast radius is the real concern. Bastillion sits as a jump-host intermediary managing SSH keys, sudo configs, and fleet access for organizations that have lost visibility into their own infrastructure. Compromising it doesn't just grant application access—it inherits a master map to infrastructure the organization's own staff may not remember exists. An attacker gains access that persists beyond patching: registered SSH keys and trust relationships survive the authentication fix. Defenders face compounding challenges. Organizations adopted Bastillion precisely because they couldn't track access manually, meaning they lack the routing-layer expertise to validate a fix quickly. The audit logs show legitimate administrator behavior—manager creation, system registration—which defeats standard detection. The disclosed-but-unfixed window becomes a critical vulnerability window: the CVE exists, the patch exists, but deployment lags while attackers weaponize the technique against organizations lacking the capacity to respond. Prioritization should invert the usual calculus. High-severity vulnerabilities with low exploitability and massive blast radius deserve more defensive investment, not less—precisely because successful exploitation is catastrophic and because targeted attacks against specific deployments don't need scalable exploitability to be devastating.

Reviewed through automated stages and approved by a human before publication.