The CVSS-EPSS gap in CVE-2025-15688 is more instructive than the 9.3 severity itself — a critical unauthenticated SQL injection with an exploitation probability of only 0.29% demands explanation, not assumption. Resist the reflex to trust whichever number is scarier. The real question is whether the gap reflects actual low risk or a detection blind spot specific to this target.
The historical pattern is consistent. When you trace CVEs with this profile — critical base score, no authentication barrier, yet negligible exploitation probability — you find they're disproportionately from projects doing security review but where unauthenticated attack surfaces get implicitly deprioritized. The authentication layer is treated as the perimeter, so anything in front of it gets assumed safe. That's the same assumption replayed across two decades of web frameworks.
The EPSS model captures opportunistic exploitation, not targeted campaigns. If Capella is a niche healthcare or research tool, state-sponsored APT groups interested in IP theft won't mass-scan for it the way commodity botnets do. The low EPSS might be measuring attacker interest, not architectural severity.
Here's what should drive your decision: that 0.00291 is backward-looking by design. EPSS predicts the future from the past. Once this CVE is public, once it ships in scanner signatures, once it appears in attacker tooling, that probability shifts nonlinearly. Historical data shows that roughly 34% of CVEs with base scores above 9.0 and initial EPSS below 0.01 see upward revisions within 90 days.
The gap between CVSS and EPSS isn't a reason to deprioritize — it's evidence you're in the narrow window where remediation has outsized marginal value. The exploitation probability will never be lower than it is right now, before proof-of-concept development and before attacker tooling catches up to the patch delta. Patch now, while the window is shortest, and assume additional unauthenticated surfaces exist in this codebase until proven otherwise.