The EPSS score of 0.00179 for CVE-2026-65935 sits in tension with its CVSS 7.6 rating, and that gap is not a measurement error — it's a structural mismatch between how these metrics were designed and the reality of embedded Bluetooth silicon. Standard vulnerability scoring assumes the world of server-side software: automatable exploitation chains, patches deployable in hours, and attacker profiles that are distant actors. The RS9116W and SiWx917 live in an entirely different risk reality.
The passkey bypass (B-E3) attacks the cryptographic handshake before the human-confirmed exchange completes. For server CVEs, this would be a clear prioritization signal. Here, the exploitation requires physical proximity, specialized tooling, and deep knowledge of a niche wireless SoC — constraints that drive EPSS toward zero but say nothing about the downstream blast radius. These chips authenticate endpoints in medical devices, building automation systems, and industrial sensors. Compromising the pairing mechanism doesn't target the chip in isolation; it inherits whatever access that endpoint has in the operational system. The trust cascade is the real severity, and CVSS doesn't model it.
The more consequential failure is temporal. For server vulnerabilities, disclosure compresses the exploit window — patches deploy, probability drops. For embedded silicon that cannot be firmware-updated without hardware replacement and recertification, disclosure expands the window. Every researcher who studies B-E3, every tool that automates the attack, every attacker who recognizes the trust inheritance in deployed endpoints increases exposure. The 30-day EPSS probability reflects a dynamic that doesn't exist here.
Practically: treat CVSS 7.6 as accurate for severity at disclosure, but treat EPSS 0.00179 as a measure of current researcher attention, not of long-term risk. The population of attackers capable of exploiting this won't shrink — it will grow. For devices using these chips in high-trust environments, the remediation path is physical replacement, not patching, and that timeline should drive prioritization independent of score comparisons. The standard EPSS/CVSS synthesis that works for enterprise software will systematically underweight this class until your scoring framework acknowledges that some vulnerabilities live in fundamentally different temporal and spatial dimensions than the metrics assume.