The CVSS 7.1/EPSS disparity in this Solace PubSub+ vulnerability deserves more scrutiny than the raw numbers suggest. The low exploitation probability (0.00307) likely reflects enterprise infrastructure obscurity rather than genuine difficulty—a message broker behind internal networks with limited external reconnaissance creates an observation gap, not a security one.
What makes this vulnerability distinct is the subscriber context. Unlike a web application IDOR where an unauthorized read is transactional and bounded, an unauthorized subscription to a topic or queue establishes a persistent tap on a data stream. The attacker receives continuous data flows, potentially including payloads created after the initial compromise, with no further action required. CVSS treats this as a confidentiality failure, but the impact is ongoing rather than point-in-time—a distinction the scoring model underweights.
The filterable nature of broker subscriptions amplifies this. A single compromised or unauthorized subscriber can establish selector-based subscriptions across topic hierarchies, aggregating data from upstream systems without lateral movement. This is a multiplication point, not a direct attack.
From a remediation standpoint, message brokers present change management inertia that exceeds typical application patching. Every downstream consumer becomes a regression risk, meaning the disclosure-to-fix window stretches into quarters rather than weeks. During that window, the broker continues streaming unauthorized data.
The operational response gap is equally concerning: discovering a rogue subscriber doesn't reveal what data flowed during the compromise window. Audit trails for topic-level subscriptions vary by configuration, and message persistence may not retain enough history for impact assessment. This creates forensic opacity that defenders rarely anticipate.
If you're defending Solace environments, prioritize identifying any subscriptions established through the affected component (the CVE references 'Solace Extra'), verify whether topic hierarchy bindings expose broader data than intended, and audit subscription lifecycle behavior when permissions change—do standing subscriptions persist after user revocation? That question likely determines whether this vulnerability has already been exploited silently.