The CVSS 10 / EPSS 0.00377 gap in CVE-2026-20358 (CWE-73 in Cisco Crosswork) is real, but the standard interpretation — that EPSS is underestimating risk or CVSS is overreacting — misses the point. The gap measures two different things, and both are correct.
CWE-73 (External Control of File Name or Path) is a broad class. A CVSS 10 means an unauthenticated network attacker can manipulate file paths to read sensitive data, write executable content, or delete system files. That assessment is technically accurate for Crosswork. The EPSS score of 0.00377 is also accurate: appliance-style vulnerabilities in proprietary management platforms don't mass-scan well. They require access to the management network, understanding of Cisco's protocol layer, and the target must be running with sufficient privileges to do meaningful damage. The exploitation ceiling for this class in this context is genuinely lower than, say, a path traversal in a widely-deployed web framework.
What matters more than the scoring debate is what the vulnerability actually exposes. Crosswork sits in the management plane of your network infrastructure — it holds credentials for the devices it manages, API tokens for orchestration, and configuration state. The blast radius of a file-system primitive here isn't limited to the appliance itself. If an attacker can read the Crosswork database or configuration directory, they're likely grabbing credentials that extend into the network devices under management. That's the question your risk assessment should answer: what actually lives in the file paths this vulnerability can reach, and what identity does the Crosswork application run as?
The second signal worth your attention is the 'internal security review' disclosure framing. This correlates historically with vulnerabilities that are genuine but constrained — Cisco found them during development, not through external incident reports. That's why EPSS is low: the vulnerability was patched before it entered the wild exploitation ecosystem. It was never fingerprinted by mass-scanners, never observed in honeypots. The low score is a timing artifact, not a severity verdict.
On prioritization: patch this. The EPSS score correctly predicts low mass-exploitation probability, but the blast radius in a management appliance can exceed that of an unconstrained vulnerability in a sandboxed application. The practical question isn't whether to patch — it's whether your monitoring should treat this as a critical boundary that, if breached, gives an attacker operational reach into your network infrastructure. That context matters more than either score alone.