CVE-2026-67282 is a CVSS 10 vulnerability in Fabrik, a Joomla extension for building database-driven forms. Unauthenticated remote code execution, no user interaction required. The technical severity is undeniable — but the EPSS score of 0.00568 predicts exploitation in the wild within 30 days as unlikely. This gap deserves scrutiny before you deprioritize.
The EPSS number is not a permission to ignore this CVE. It's a signal about opportunistic scanning, not targeted attacks. Fabrik isn't a casual plugin — it's specialized infrastructure deployed by healthcare organizations handling patient intake, government agencies processing structured submissions, and financial services running compliance-driven data capture. These aren't random Joomla installs. They're high-value data pipelines. The narrow attack surface (specific frontend list filter model trigger) doesn't reduce the severity if an attacker reaches a Fabrik deployment with intent; it reduces the likelihood of mass scanning discovery.
The real question is whether your organization runs Fabrik, and if so, whether it's exposed to the internet. If it is, patch it — the CVSS 10 is technically accurate about what an attacker could accomplish. The low EPSS reflects attacker difficulty finding targets through automated scanning, not attacker indifference toward the targets they already know about. Sophisticated actors profile specialized data infrastructure specifically because the data it collects is valuable and the software is often abandoned, unpatched, and forgotten.
Your move: identify Fabrik installations in your asset inventory, verify their internet-facing status, and prioritize patching or isolating them. The CVSS-EPSS gap is real, but it's a gap between opportunistic and targeted exploitation models — not a reason to treat this as routine.