An unauthorized hacker has discovered a publicly known vulnerability in a retail store's cloud$-$based supply chain management software. The exposure has a CVSS score of $9\mathrm{.}3$ and a high impact to confidentiality.

Fortunately, there is no appropriate proof of concept or publicly available exploit for this vulnerability.

What is the biggest hurdle to the hacker gaining access to the retail store's supply chain management software?

Attack vectors

Weaponization

Attack complexity

Exploitability