The CVSS 9.8 rating on CVE-2026-67917 masks an exploitation pathway that is far narrower than the score suggests. The vulnerability is a SQL injection in the azuracast:restore CLI command, which reads and executes SQL from a db.sql file within a backup archive. For a truly remote attacker to exploit this, they must either upload a crafted backup through an authenticated interface, manipulate a backup pulled from a remote URL, or compromise the backup source itself — none of which represent a traditional unauthenticated remote attack surface. The EPSS score of 0.00226 reflects this reality: statistically, exploitation within 30 days is unlikely.
The critical insight defenders should extract is not the CVSS number but the execution context. Restore functionality runs with elevated privileges precisely because it must reconstruct system state. If that backup archive includes configuration files or credentials for remote backup destinations — a common pattern in restore commands — arbitrary SQL execution becomes a pivot point to cloud storage credentials and remote infrastructure. The 9.8 score doesn't capture what happens after the SQL executes in this privileged path.
Before allocating patching resources, verify three conditions in your environment: whether the web interface accepts unauthenticated backup uploads, whether the restore command supports remote backup URLs that could be manipulated, and what privileges the database user actually has when executing restore operations. Organizations running this version who never use the restore command may have both the vulnerability and the fix sitting in forgotten state — vulnerable in theory, unpatched in practice, because audit processes rarely trigger on CLI tooling that runs quarterly at most. Patch the function, but treat this as a signal to audit your entire backup/restore trust model: the conditions that enabled this vulnerability probably exist in related code paths where the same implicit trust assumptions apply.