This CVE—a memory corruption vulnerability enabling code execution in Windows DNS—carries CVSS 8.8 but EPSS 0.0057. The adjacent network qualifier in the CVSS vector string accounts for part of that gap: exploitation requires network proximity rather than remote internet access. Don't let that reassure you.
DNS is the blast apex of any network topology. Every workstation, every service, every security control depends on DNS resolution to function. Compromising DNS doesn't give you one server—it gives you the ability to intercept all traffic, poison Kerberos and LDAPS authentication, and corrupt the trust substrate of the entire network. An attacker who has achieved adjacent access already controls the segment where DNS lives. The 'adjacent network required' qualifier assumes a hard boundary that modern network architecture has dissolved: Wi-Fi is flat, VPNs bridge remote endpoints onto internal segments, and a single compromised workstation via routine phishing is adjacent access by definition.
EPSS's low score reflects historical exploitation patterns—it cannot price targeted attacks against crown-jewel infrastructure, and it certainly cannot price a vulnerability disclosed days ago. Using EPSS 0.0057 to justify scheduling this patch for next month's maintenance window while DNS serves as the mandatory relay for every authentication and certificate validation chain in your environment is risk management theater.
Prioritize this patch. The out-of-bounds write mechanism—most likely involving DNS compression pointer dereferencing—has a documented lineage across BIND, Unbound, and Windows DNS. This follows Kaminsky's cache poisoning, amplification attacks, and compression pointer exploits that all followed the same pattern: researchers dismissed the 'adjacent' constraint until exploitation became routine. Apply the patch now, not next month. The vulnerability doesn't need high EPSS to be catastrophic—it just needs to persist past the point where an attacker who has already achieved adjacent access decides DNS is their pivot point.