You need to understand what CVE-2026-64850 actually represents before you decide how to prioritize it. The CVSS 8.7 rating captures the impact accurately, but it obscures something more important: this isn't a traditional deserialization vulnerability. The actual mechanism—abusing arrayFilterRecursive() in Grav's Utils.php to invoke PHP built-ins like system as callbacks—exploits the framework's own API design rather than introducing malicious gadgets. Your existing deserialization defenses won't catch this because nothing gets instantiated or unserialized. The attack chains existing framework classes together, making system callable without needing any new code injection.
The permission requirement (admin.pages or api.pages.write) creates a meaningful constraint: this is primarily a privilege escalation issue in single-tenant deployments, but becomes a cross-tenant compromise vector in multi-tenant setups where different users control different pages.
The execution trigger is view-based rather than save-based. Malicious frontmatter sits dormant until something accesses the page, which delays detection and complicates incident reconstruction—the attack runs under whoever browses the page next, not necessarily the editor who planted the payload.
Version 2.0.7 patches system, exec, and passthru specifically, but this targeted approach leaves gaps. The underlying issue is the API's unrestricted callable acceptance, and other PHP built-ins like shell_exec or proc_open could serve the same trampoline function. The authorization model for blueprint callbacks warrants deeper scrutiny beyond this single fix.