The CVSS 6.3 rating for CVE-2026-18722 doesn't reflect operational reality. This is an authorization bypass in the devSurvey endpoint (/api/dwsurvey/app/v6/dw-design-survey/dev-survey.do) of DWSurvey, an open-source survey platform. The vendor has not responded to the disclosure, meaning no patch is coming through normal channels — and a public exploit already exists. That combination elevates this from a medium-severity technical finding to a high-priority operational exposure.
Start by confirming whether DWSurvey is in your environment at all. This is a survey tool — it collects employee feedback, customer satisfaction data, academic responses, often among the most sensitive data an organization handles. The devSurvey endpoint was almost certainly a development debug interface that got deployed alongside production code. If it lacks authentication entirely, an attacker doesn't need the public exploit — they just need the URL. If it requires a low-privilege session, the exploit provides that bridge.
Detection: correlate access logs for requests to this specific endpoint against session establishment events. A successful request to /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do without a prior login event is anomalous and indicates active exploitation. Given the endpoint's 'dev' naming convention, no legitimate production traffic should reach it. Flag any such access immediately.
This is unlikely to be isolated. Development artifacts that survive into production rarely travel alone — audit for other dev- or debug- endpoints in your DWSurvey instance. The absence of vendor response means you are operating without a security net; treat any DWSurvey deployment as requiring immediate inventory reconciliation and consider whether the platform's maintenance status justifies its continued use in your environment.