The EPSS-CVSS gap in CVE-2026-13202 should concern you, but not for the reason you might think. The 7.3 CVSS with an EPSS of 0.00262 isn't a scoring anomaly to resolve—it's a signal that demands investigation into your specific deployment topology before you allocate remediation bandwidth.
OpenText Directory Services is enterprise infrastructure, not a consumer product, which changes the risk calculus. The "Input Data Manipulation" classification tells you almost nothing about what actually happens when exploitation succeeds—it could affect authentication flows, LDAP query parsing, replication, or attribute management. Each of those contexts carries fundamentally different operational risk. Before prioritizing this over actively exploited vulnerabilities, answer this: does your OpenText deployment front Entourage or GroupWise authentication workloads? If yes, the blast radius of forged group memberships or modified access control entries could span every resource trusting that directory. That's not a compromised application—that's the keys to the kingdom.
Two things should temper over-prioritization. First, the 2026 date means EPSS has essentially zero training data for this vulnerability—if exploitation occurred before formal disclosure, the model is structurally blind to it. Second, directory services accumulate deprecated LDAP schema extensions, dormant replication paths from old migrations, and forgotten query patterns that create a "forgotten surface" nobody audits. The low EPSS may reflect that nobody has successfully navigated that forgotten topology at scale, not that the blast radius is small.
The historical pattern matters: directory service Input Data Manipulation flaws cycle through quiet periods, then spike in EPSS once weaponization lands in commodity attack frameworks. The question isn't whether this EPSS is accurate today—it's whether your environment runs a configuration where a single directory manipulation primitive becomes a privilege escalation onramp for commodity ransomware actors. Investigate your topology first, then decide if this warrants immediate attention or monitoring.