CVE-2026-66340 exposes missing brute-force protections in Mira's cloud authentication service — specifically absent per-account rate limiting, per-IP throttling, and account lockout controls. These aren't sophisticated security failures; they're commodity controls that have been understood for two decades. The vulnerability is straightforward: an unprotected authentication endpoint that allows unlimited login attempts.
The CVSS 5.3 and EPSS 0.00236 scores create a dangerous frame. They signal 'not urgent' to defenders operating on severity triage, but the actual exploitation landscape for this class of vulnerability follows a tiered pattern that EPSS was never designed to capture. Sophisticated actors weaponize missing auth controls within hours of publication. Opportunistic attackers follow when tooling becomes available. The EPSS model's telemetry gap — it excludes brute-force attacks because they're too common to register as anomalous — creates a measurement artifact that systematically underweights exactly this vulnerability class.
What matters most for defenders: the blast radius isn't a cascade problem, it's a collective risk problem. This one vulnerability creates simultaneous exploitation options across the entire deployed base, available to every opportunistic actor at once. That's a different severity model than sequential lateral movement, and current scoring doesn't capture it.
Your response depends on your role. If you use Mira's cloud auth: verify whether they've released a patch for these three missing controls, assess whether your authentication traffic routes through the affected service, and implement compensating controls (WAF rate rules, upstream throttling) if vendor remediation lags. If you're evaluating vendors: treat missing brute-force protections as a disqualifying finding, not a feature gap. The controls are trivial to implement — their absence signals either architectural neglect or deliberate deprioritization, neither acceptable in authentication infrastructure.
The compounding risk is temporal. Medium-severity CVEs get deferred to next maintenance window while critical ones get immediate attention. That remediation asymmetry is where attackers operate. The EPSS score tells you exploitation is unlikely in the next 30 days based on current telemetry — but that telemetry was never designed to see credential stuffing attacks. By the time tooling appears and opportunistic exploitation begins, your 'not urgent' CVE has become active exposure. Prioritize accordingly.