CVE-2026-72557 in Cockpit CMS represents a collapsed exploitability threshold: any authenticated user can achieve remote code execution with zero additional friction. This is not a vulnerability in the traditional sense—it's a default configuration where the documented, supported path to file upload places uploaded files in a web-accessible directory with no execution barriers. The security control that could block this (allowed_uploads) defaults to permissive, and even if configured correctly, the underlying architecture still requires disabling PHP execution in the upload directory via server configuration—a second independent configuration that defenders must get right.
The CVSS 8.8 score is misleading. It rates this as requiring "low privileges" when in practice the barrier is nil: most CMS deployments allow self-registration, and credential stuffing lists mean attackers often have valid credentials without needing to exploit anything. Treat "any authenticated user" as "effectively unauthenticated" in your threat model.
For defenders: prioritize by exposure surface, not CVSS. Identify every Cockpit CMS instance accessible from the internet, assume compromise if any valid credentials exist or could exist, and either patch the allowed_uploads configuration AND disable PHP execution in upload directories, or remove the instance entirely. This software has been in maintenance atrophy since approximately 2022—no coordinated security patches will arrive. The exposure window closes only when the deployment does, not when a CVE is published.
The deeper pattern: this is the same architectural failure that has generated hundreds of CVEs across WordPress, Drupal, Laravel, and other CMS platforms. The shortcut of "authenticated upload to web-accessible storage" keeps reproducing because the penalty for getting it wrong lands on users years later, while the penalty for secure defaults (developer complaints about broken functionality) is immediate. Until framework authors make the secure path the default, these vulnerabilities will keep emerging—regardless of how many individual CVEs get published.