CVE-2026-47882 presents a classic CVSS-EPSS disconnect that demands analytical discipline rather than reflexive patching. The vulnerability involves weak PRNG-generated shared secrets in Spring Tools Boot Dashboard's remote Docker and Cloud Foundry configuration — a convenience feature for the edit-compile-test cycle, not a production security boundary.
The 8.3 CVSS score reflects theoretical maximum impact: an attacker who intercepts or predicts the secret can trigger remote container restarts and upload content to the DevTools endpoint. However, examine the prerequisites: network positioning to intercept this secret during initial configuration, or the ability to predict java.util.Random output. This places the vulnerability in a development workflow context where the attacker already possesses significant access. If you can sniff the secret during Boot Dashboard setup, you likely already have the container access that makes this exploit marginal.
The EPSS of 0.00174 is doing honest work here — it correctly infers that exploitation probability for development tooling vulnerabilities sits near zero regardless of vector string. The remote DevTools feature that hosts this vulnerability has been essentially unmaintained since Spring Tools 5.2.0 (2019-2020). Attackers with the prerequisite positioning have more reliable vectors through the same forgotten code path.
The practical question is not whether to patch but whether this feature belongs in your threat model at all. If you're deploying Spring applications to remote containers, the trust boundary already extends to that transport layer. The PRNG weakness is real but the marginal damage from exploitation is thin when measured against what an attacker positioned to exploit it likely already possesses. Prioritize based on your actual attack surface — for most organizations, this sits well below production CVEs with comparable scores.
Monitor for Spring Tools updates that address this specifically, but treat it as developer environment hygiene rather than production emergency response.