The authenticated qualifier in this CVE masks a risk amplification that CVSS structurally cannot represent. In password management systems, the attacker who can authenticate is already inside the vault—one step from the master password that unlocks the organization's entire credential hierarchy. SQL injection in this context is not a foothold; it is a single-pivot privilege escalation to credentials that govern the infrastructure hosting the PAM itself.
The EPSS score of 0.01583 compounds the mispricing. Probability-of-exploitation models trained on general web populations weight 'authenticated' vulnerabilities lower because the baseline assumes opportunistic attackers. But PAM products are rarely internet-facing, and the threat actors targeting them are not running random scans—they have already obtained valid credentials through credential stuffing, insider threat, or a separate compromise. For an attacker already inside the PAM, this SQL injection is not a probabilistic opportunity; it is a precision tool for maximal impact.
What makes this worse is the credential topology. The secrets managed by PAM360 and Password Manager Pro are not siloed entries—they include AD service accounts, LDAP bind credentials, backup service accounts, and hypervisor principals that other systems use as trust anchors. Compromising these credentials doesn't just give you access to data the PAM holds; it invalidates the trust model of every system that relies on those credentials for authentication. The blast radius from a successful exploit flows outward to infrastructure the PAM doesn't directly manage.
Defenders should treat this as a Tier-1 priority despite the CVSS score. Verify whether the vulnerable endpoint is in active use or represents legacy code that survived a version migration—the 'authenticated' framing often masks code paths that predate current RBAC models. If you are an MSP using shared infrastructure, assess whether the database is multi-tenant and how secrets are namespace-separated; the same flaw could enable cross-tenant credential extraction. The question is not merely 'do we have this CVE' but 'are we running the code path where this class of vulnerability recurs.'