CVE-2026-20465 presents a classic severity-exploitability gap: an 8.1 CVSS out-of-bounds write in Qualcomm's WCN wireless AP driver, but an EPSS score of only 0.00203. The explanation isn't mysterious—it's the disclosure pathway and attack surface geometry.
The MSV-7834 prefix in the CVE identifier signals Microsoft Coordinated Vulnerability Disclosure, meaning this reached public record through Microsoft's security pipeline rather than vendor channels. This matters because the EPSS model derives exploitation telemetry from honeypots, bug bounties, and public exploit databases—channels that don't capture attacks against quietly-patched, internally-discovered vulnerabilities in carrier-grade infrastructure. The low EPSS reflects structural blind spots in the model's data sources, not necessarily low actual risk.
The adjacent-proximity requirement is the critical constraint. This vulnerability lives in Access Point drivers—code running on routers, hotspots, and network infrastructure devices. An attacker needs to be within WiFi range, which rules out opportunistic internet scanning but creates serious risk for targeted scenarios: enterprise networks, conference venues, executive travel, and carrier infrastructure. Compromising an AP driver means kernel-level code execution with network hardware privileges on infrastructure every connected client trusts—an attacker inherits a permanent man-in-the-middle position.
What to do: Identify every Qualcomm-based wireless device in your environment—routers, hotspots, Surface devices, embedded systems. Verify the WCNCR00489200 patch is present in deployed firmware versions. For high-value targets, treat this as a forced audit trigger regardless of EPSS: the gap between the CVSS severity and EPSS probability likely reflects telemetry blind spots, not absence of threat actors capable of proximity attack. Prioritize patching on network infrastructure devices first.