The CVSS 9.2 rating on CVE-2026-67365 demands scrutiny not because the score is wrong in isolation, but because the EPSS of 0.00228 tells a dramatically different story. An unauthenticated SQL injection with no session or token requirements should be lighting up exploitation telemetry — that it isn't is analytically significant, and the gap deserves your attention not as a puzzle to dismiss but as a signal to interpret.
This vulnerability lives in iCagenda, a Joomla calendar and event management extension. That's a specific deployment context: not a foundational library like Log4j, not an authentication component, not something sitting at the trust boundary of a major framework. It's a calendar module managing event data, registration information, and timestamps. The database access it provides is real — but what it touches is architecturally peripheral to what matters most in a Joomla deployment. You're not extracting admin credentials or session tokens from a calendar module's database queries.
The low EPSS likely reflects two converging factors. First, this CVE almost certainly originated from coordinated vulnerability research — a bug bounty, a security audit, a focused audit — rather than incident response. The population that finds unauthenticated SQLi in Joomla extensions and reports it through official channels is largely disjoint from the opportunistic scanning population that generates EPSS telemetry. Second, the deployment footprint of a niche CMS extension is constrained by definition, but more importantly, these components often sit on projects that have ended, on servers that aren't actively monitored, on infrastructure that has fallen off everyone's security dashboard. The attackers EPSS measures aren't the ones who will eventually target forgotten Joomla sites years from now.
For defenders, the practical implication is this: patch the vulnerability — version 4.0.11 contains the fix — but calibrate your urgency against actual blast radius. This isn't a Log4j scenario where the vulnerable component sits at the center of systemic trust. It's a peripheral component with theoretical maximum severity and structurally limited impact. Prioritize it, yes, but within the population of Joomla extension vulnerabilities rather than treating it as a foundation-level emergency. The CVSS correctly describes the vulnerability's potential; the EPSS correctly describes its current exploitation landscape. Neither is wrong — they're measuring different things, and both deserve a place in your prioritization calculus.