The CVSS 9.8 assigned to CVE-2026-67868 is analytically dishonest for an OPC UA EventFilter vulnerability in an ICS context. The EPSS score of 0.00272 — roughly a 0.27% probability of exploitation in the next 30 days — tells you more about the actual threat landscape than the base score ever could.
This vulnerability exists in EventFilter handling during CreateMonitoredItems — an operation requiring a valid OPC UA session, proper subscription state, and interaction with a monitored items subsystem. This is not a stateless buffer overflow exploitable over the wire with a single packet. The CVSS vector treats the theoretical severity ceiling as the actual severity floor, ignoring the authentication and session requirements that constrain realistic exploitability.
The historical record supports skepticism. Three prior OPC UA EventFilter vulnerabilities — CVE-2017-12069, CVE-2018-7559, and CVE-2020-8658 — all landed with critical CVSS scores citing heap corruption and remote code execution. None produced a working public exploit targeting actual OT deployments. This pattern tells you that EventFilter vulnerabilities cluster at high theoretical severity precisely because they involve complex heap manipulation in server-side processing — but consistently fail the realistic exploitability test once authenticated sessions and hardened deployment configurations are accounted for.
For operators, the productive questions are concrete: What is the realistic attack path from external network to this OPC UA stack? Does your deployment expose CreateMonitoredItems to unauthenticated callers? Are you running OPC UA security modes beyond the default? Does role-based access control factor into session establishment? If your architecture requires valid authentication before CreateMonitoredItems is reachable, the CVSS number becomes almost irrelevant — the protocol's own design creates friction the scoring model ignores.
The heap corruption mechanism in EventFilter processing involves complex data structures — subscription filters, content filters, and operand resolution — where achieving reliable code execution in a hardened OT environment with DEP, ASLR, and industrial protocol protections is substantially harder than the CVE description implies. The EPSS signal reflects that difficulty.
Stop arguing about whether the score should be 9.8 or 4.2. Map what the failure cascade actually looks like in your specific topology. The controls that limit blast radius — network segmentation, authentication enforcement, DMZ architecture — do more work than any patching urgency dictated by an inflated severity rating. Audit your deployment, verify whether the CreateMonitoredItems attack surface is exposed beyond authenticated sessions, and prioritize architectural controls over CVE-driven urgency.