CVE-2026-27825 was weaponized before EPSS and KEV could catch up

At a glance

What this is: NHI Mgmt Group's analysis, drawing on KELA's blog post: CVE-2026-27825 exposed the gap between public vulnerability scoring and criminal weaponization when a working exploit appeared six days after NVD publication.

Why it matters: Security and IAM practitioners need a way to prioritise exposure before KEV confirmation, because exploitation activity can emerge in criminal channels before formal intelligence catches up.

By the numbers:

• CVE-2026-27825 had a CVSS score of 9.1.
• EPSS rated the vulnerability at 2.3% probability of exploitation.
• The patch had been available since February 24, 2026.

Context

Vulnerability management breaks down when teams treat public scoring as the whole picture. CVE, CVSS, EPSS and KEV each answer a different question, but none of them is designed to watch the underground channels where exploit development starts. That leaves a disclosure-to-weaponization window that can be shorter than many remediation workflows.

The gap matters even more for MCP-related software because the attack surface is expanding faster than governance can stabilise. When a widely deployed MCP server is exposed through integrations with enterprise data, a vulnerability is not just a code defect; it becomes a path into AI-connected tooling and the identities that use it.

Key questions

Q: What should teams do first when a new CVE is already being exploited before KEV listing?

A: Treat active exploitation as the trigger, not KEV inclusion. Move the vulnerability into emergency triage, confirm whether exposed assets are affected, and prioritise remediation for internet-facing systems before lesser findings in the queue. If exploitation telemetry shows real attacker activity, the correct response is to re-rank risk immediately rather than waiting for formal catalogues to catch up.

Q: Why can EPSS stay low when attackers already have a working exploit?

A: EPSS can stay low because it estimates the probability of exploitation from observed signals, not whether an exploit exists. A working exploit may be new, niche, poorly weaponised, or seen in environments that do not feed the model. Security teams should still treat the issue as real when exploit code, exposed services, or active probing are present.

Q: What is the difference between CVSS and KEV when ranking third-party vulnerabilities?

A: CVSS measures the theoretical severity of a vulnerability based on impact and exploitability, while KEV indicates whether a vulnerability is known to be exploited in the wild. For prioritisation, CVSS helps compare technical severity, but KEV is often a stronger signal for immediate action because it reflects real-world attacker activity and current exposure.

Q: How should security teams prioritize remediation when an MCP server exposes critical vulnerabilities?

A: Security teams should treat MCP server weaknesses as high priority because they can become a direct bridge between AI systems and sensitive tools or data. Focus first on internet-exposed services, authentication, authorization, and input handling. Then validate where the server is deployed, what data it can reach, and whether compensating controls limit blast radius if compromise occurs.

Technical breakdown

Why CVE, CVSS, EPSS and KEV diverge

CVE is an identification system, CVSS is a severity model, EPSS estimates near-term exploitation probability, and KEV records confirmed in-the-wild use. Each instrument is valid on its own terms, but they do not measure the same phase of the threat lifecycle. CVSS can rate impact ceiling without proving current attacker interest. EPSS relies on visible signals and historical patterns, so it can miss activity that stays inside criminal forums. KEV is intentionally conservative because it waits for confirmation. The result is a blind spot between disclosure and formal confirmation. See the SSVC Guide.

Practical implication: Use these signals together, but do not treat any single one as a complete prioritisation answer.

Why exploit timelines shrink after public disclosure

Once a CVE lands on NVD with enough technical detail, attackers can use the patch description, affected version range and code changes as a roadmap. In modern environments, that process is accelerated by automated code analysis and exploit generation tooling. The issue is not just speed, but accessibility: the same disclosure that helps defenders also lowers the cost of exploit development for moderately capable criminal actors. That means the most important timing question is no longer whether a vulnerability is severe, but how quickly it can be turned into working code after publication. See the Zero-Day and Exploited Vulnerabilities Guide.

Practical implication: Prioritise patching based on disclosure timing and exploitability, not just severity score.

Why MCP servers expand the exposure surface

MCP servers sit between AI assistants and enterprise systems, so a flaw in that layer can turn a productivity integration into a high-trust access path. The security problem is not MCP itself, but the combination of fast adoption, exposed APIs and insufficient hardening around authorization and version control. In a setting like this, one vulnerable service can mediate access to Jira, Confluence or other enterprise data through connected agents. That is why MCP vulnerabilities deserve both application-security and identity-governance scrutiny. Read OWASP Agentic Applications Top 10.

Practical implication: Treat MCP-enabled services as privileged integration points and assess them with API and identity controls.

Threat narrative

Attacker objective: The attacker objective is to turn a newly disclosed MCP server vulnerability into a repeatable exploit path against unpatched enterprise deployments.

1. Entry began when a working exploit for CVE-2026-27825 emerged after public disclosure and spread through a criminal forum rather than a formal advisory channel.
2. Credential access was enabled by the vulnerability chain in mcp-atlassian, which exposed Atlassian-connected interfaces to attacker-controlled exploitation paths.
3. Impact was the creation and circulation of a proof-of-concept exploit that could be used against unpatched deployments before formal intelligence systems registered the threat.

Breaches seen in the wild

• LiteLLM MCP auth bypass 2026: An exploited LiteLLM MCP auth bypass and default sk-1234 master keys let attackers steal AI gateway master and provider API keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Formal vulnerability scoring is now necessary but insufficient. CVE, CVSS, EPSS and KEV each describe a real part of the risk picture, but none of them is built to observe the criminal channel where exploit development first becomes operational. That means the weakest assumption in many programmes is not patching discipline, but the belief that formal confirmation equals real exposure. Practitioners should treat underground exploit activity as a first-class intelligence input, not a later-stage validation step.

The six-day disclosure-to-weaponization window is the real control gap. The important failure mode is not simply delayed remediation; it is the period in which a vulnerability is exploitable before the organisation's prioritisation inputs recognise that it has been weaponized. That gap is especially dangerous when the affected system mediates access to enterprise data or AI-connected services. KEV prioritisation helps, but it cannot see what has not yet been confirmed publicly.

MCP adoption creates a new class of governance debt. When AI assistants rely on server-side connectors to reach business systems, the connector layer becomes part of the access control plane whether teams design it that way or not. The vulnerability is therefore not just application security debt; it is identity and privilege debt expressed through a new integration pattern. Organisations need to govern these servers as controlled trust brokers, not ordinary plugins.

Criminal forums are now part of the exploitation lifecycle. The case shows that forums like XSS.PRO are not only distribution venues after the fact, but operational spaces where weaponization happens before the formal ecosystem catches up. That changes what mature vulnerability intelligence looks like: it must include community monitoring, exploit chatter and proof-of-concept circulation. Without that layer, security teams are ranking severity, not observing threat momentum.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• The median time to fully patch a vulnerability in CISA's Known Exploited Vulnerabilities catalog rose to 43 days, according to Verizon's 2026 Data Breach Investigations Report.
• Read next: SSVC Guide

What this signals

Weaponization intelligence now needs its own control plane: teams should not wait for formal confirmation before adjusting remediation priority. The useful signal is the earliest credible evidence that a vulnerability has entered criminal distribution, because that is where the disclosure-to-exploit window closes first. In practice, this means treating exploit chatter as a governance input alongside KEV and EPSS, not as a separate research curiosity.

The MCP angle sharpens the identity question: when AI connectors can reach enterprise data, the security decision is no longer only about code defects. It is also about who or what is allowed to use the connector, what privilege it inherits, and how quickly that privilege can be revoked when a flaw appears.

For practitioners

• Prioritise exploitability over score alone Build triage rules that combine CVSS, EPSS, KEV and underground exploit indicators so a low EPSS score never suppresses credible criminal weaponization signals.
• Monitor criminal exploit circulation for in-scope CVEs Add forum, Telegram and dark web monitoring to the vulnerability intake process for exposed systems that support enterprise integrations.
• Inventory MCP-facing services as privileged exposure points Track which AI connectors and MCP servers can reach business data, then treat them as high-value assets in patch and review cycles.
• Shorten remediation SLAs after public disclosure Use the time between NVD publication and exploit circulation as a trigger to tighten patch windows for high-impact services.
• Verify backported fixes against deployed versions Confirm whether vendor backports cover every branch in use, especially when exploit guidance includes version-fingerprinting steps.

Key takeaways

• The case shows that formal vulnerability scoring can lag behind real-world criminal exploitation by days, leaving a meaningful gap in operational prioritisation.
• The published evidence includes a CVSS 9.1 rating, an EPSS score of 2.3%, and a working exploit circulating six days after NVD publication.
• Vulnerability management should combine public scoring with underground exploit intelligence, because confirmation-based systems alone cannot see weaponization in progress.

Related NHI Mgmt Group resources: SSVC Guide · Zero-Day and Exploited Vulnerabilities Guide · OWASP Agentic Applications Top 10 · CISA KEV Catalogue Guide

Key terms

• CVE: Common Vulnerabilities and Exposures is a standard identifier for publicly known software vulnerabilities. It does not measure severity or exploitability on its own. Security teams use CVE IDs to align scanners, advisories, patching workflows, and reporting around the same issue across tools and organisations.
• CVSS: The Common Vulnerability Scoring System is a standard way to rate how severe a software vulnerability is. It scores the flaw itself using base, temporal, and environmental factors, but it does not tell you how likely the issue is to be exploited in your specific identity environment.
• EPSS: The Exploit Prediction Scoring System estimates the likelihood that a vulnerability will be exploited in the wild. It is useful for prioritisation because it reflects observed threat patterns, but it still needs local identity context such as privilege scope, secret exposure, and reachability.
• CISA KEV Catalog: The CISA KEV Catalog is the official list of vulnerabilities known to be exploited in the wild. Security teams use it to drive patch prioritisation, enforce deadlines, and distinguish active threats from weaknesses that are only theoretically exploitable. It is a practical control input for remediation workflows.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It helps practitioners connect access governance, workload identity, and AI-facing control decisions to the wider security programme.