The CVSS-EPSS gap in CVE-2026-61965 reveals more about the Discord bot attack surface than the vulnerability itself. A CVSS 7.1 paired with an EPSS of 0.0018 is an unusual signal—EPSS is calibrated on real-world exploitation patterns, and this low probability suggests either limited exposure or limited attacker interest. For a Discord bot, the direct attack surface is a bot account processing commands in a platform context Discord controls, which explains the gap—but it also demands a different analytical frame than traditional web app vulnerabilities.
The question analysts should ask is not 'how severe is this?' but 'where does the JavaScript actually execute?' If the payload lives in bot responses, Discord's sanitization layer should intercept most XSS attempts before they reach a browser. If the XSS lives in an associated web dashboard or admin panel, the risk profile shifts entirely. The fact that EPSS stays low despite a 7.1 suggests automated models don't see a clear exploitation path—but this may reflect tooling gaps rather than actual risk ceilings. Historical patterns with IoT botnets and early container escapes show low EPSS often precedes exploitation spikes once attackers invest in building reliable attack chains.
More concerning is the blast radius. A bot with thousands of guilds isn't isolated incidents—it's a single compromised credential that can pivot across all servers simultaneously, reading message history, exfilting OAuth tokens, and propagating to every server it's installed in. That's not a 7.1 with low EPSS—that's a fragmentation grenade with a delayed fuse.
Also consider the temporal dimension: CVSS and EPSS assume a patch will be released and deployed. Discord bots are maintained by individual developers who abandon projects or stop responding. If GeekyBot 1.2.6 is fork-prone and embedded across multiple projects, the remediation path may not exist at all—or mean-time-to-fix may be measured in years, not weeks.
Verify the execution context first: does this XSS execute in Discord's native rendering, a third-party integration, or a web dashboard? Then verify whether a patch actually exists in 1.2.7 and whether the maintainer is responsive. The 7.1 score does not automatically outrank a 6.8 with higher EPSS if the latter is being actively exploited while the former requires chaining through uncertain conditions—and for Discord bots, the uncertainty is substantially higher than traditional enterprise software.