CVE-2026-12070

The EPSS score of 0.00235 for CVE-2026-12070 is misleading, and here's why you should look past it when assessing your actual risk. TeamDavid Webbox is specialized German enterprise software running in industrial environments—communication hubs that likely integrate with authentication systems, SMTP relays, and potentially OT networks. The low EPSS reflects the absence of honeypot visibility and researcher attention, not the difficulty of exploitation. If this software sits behind VPNs or on internal networks where nobody is actively monitoring, the sensor gap is a measurement problem, not a risk reduction. The vulnerability isn't a classic path traversal or buffer overflow. The @@COMMENTFILE mechanism in the scjob form field is a command-interpreting DSL that was never sandboxed—a feature built when developers assumed authenticated users were trusted operators. The parsing logic treats certain strings as directives, and the arbitrary file deletion happens because nobody audited whether that trust model still holds after the web interface was bolted on. For your assessment: First, assume authentication is a weaker barrier than the CVE suggests. Enterprise software accumulates service accounts, integrations, and expanded user populations over time. What was once "admin-only" often becomes "supply-chain-accessible." Second, treat this as a vulnerability genotype—the same architectural failure (mini-language parser in a web input layer without sandboxing) has appeared in ColdFusion, SharePoint, and similar niche enterprise systems. The @@COMMENTFILE parsing layer almost certainly handles sibling directives that haven't been fuzzed yet. File read, file move, or job status enumeration could be lurking in the same logic. The blast radius matters more than the CVSS 8.4 suggests. A communication hub in a German industrial environment touching Active Directory, SMTP relays, and possibly shop-floor systems means file deletion isn't just data loss—it's a way to delete authentication configs, disable logging, or create denial-of-service conditions. The question isn't just "can someone delete files?" but "what does that host reach, and what collateral damage becomes possible?"

Reviewed through automated stages and approved by a human before publication.