Topic starter
11/11/2026 6:04 pm
TL;DR: CVE-2026-27825 reached criminal distribution six days after NVD publication, according to KELA, while EPSS still rated it at 2.3% and KEV had not yet caught up. Vulnerability programmes that wait for formal confirmation alone will understate active exposure.
Editorial analysis by NHI Mgmt Group, based on content published by KELA: “CVE-2026-27825 Means We Need to Talk About KEV...and CVE, and CVSS...”.
By the numbers:
- CVE-2026-27825 had a CVSS score of 9.1.
- EPSS rated the vulnerability at 2.3% probability of exploitation.
- The patch had been available since February 24, 2026.
Key questions
Q: Why can EPSS stay low when attackers already have a working exploit?
A: EPSS can stay low because it estimates the probability of exploitation from observed signals, not whether an exploit exists.
Q: What is the difference between CVSS and KEV when ranking third-party vulnerabilities?
A: CVSS measures the theoretical severity of a vulnerability based on impact and exploitability, while KEV indicates whether a vulnerability is known to be exploited in the wild.
Q: What should teams do first when a new CVE is already being exploited before KEV listing?
A: Treat active exploitation as the trigger, not KEV inclusion.
Practitioner guidance
- Prioritise exploitability over score alone Build triage rules that combine CVSS, EPSS, KEV and underground exploit indicators so a low EPSS score never suppresses credible criminal weaponization signals.
- Monitor criminal exploit circulation for in-scope CVEs Add forum, Telegram and dark web monitoring to the vulnerability intake process for exposed systems that support enterprise integrations.
- Inventory MCP-facing services as privileged exposure points Track which AI connectors and MCP servers can reach business data, then treat them as high-value assets in patch and review cycles.
Bottom line: The case shows that formal vulnerability scoring can lag behind real-world criminal exploitation by days, leaving a meaningful gap in operational prioritisation.
Glossary terms: CVE, CVSS, EPSS, CISA KEV Catalog
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:08 pm
Formal vulnerability scoring is now necessary but insufficient. CVE, CVSS, EPSS and KEV each describe a real part of the risk picture, but none of them is built to observe the criminal channel where exploit development first becomes operational. That means the weakest assumption in many programmes is not patching discipline, but the belief that formal confirmation equals real exposure. Practitioners should treat underground exploit activity as a first-class intelligence input, not a later-stage validation step.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- The median time to fully patch a vulnerability in CISA's Known Exploited Vulnerabilities catalog rose to 43 days, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
A: Security teams should treat MCP server weaknesses as high priority because they can become a direct bridge between AI systems and sensitive tools or data. Focus first on internet-exposed services, authentication, authorization, and input handling. Then validate where the server is deployed, what data it can reach, and whether compensating controls limit blast radius if compromise occurs.
👉 Read our full editorial: CVE-2026-27825 was weaponized before EPSS and KEV could catch up