Most organisations scan regularly and still get breached through vulnerabilities they already knew about, because the programme measures scanning activity rather than exposure. The mistakes below recur across incident reports and are each tied to a published standard or a live breach. For every one we give the issue, why it matters and what to do, with links to deeper NHI Mgmt Group guides. This list is for vulnerability management leads, security operations and IT teams who own remediation. For the full programme, see the Vulnerability Management Guide.
The Top 10 at a glance
The table lists ten common vulnerability management mistakes, each tied to a cited source or a live breach in the NHIMG breach database. Each mistake is explained below with the fix that matters most.
| # | Mistake | Anchor source or incident |
|---|---|---|
| 1 | Treating known exploited vulnerabilities as just another "high" | CISA KEV catalogue; ShinyHunters PeopleSoft claim |
| 2 | Scanning an incomplete asset inventory | CIS Safeguards 1.1 and 7.7; CISA BOD 23-01 |
| 3 | Relying on unauthenticated scans | CIS Safeguard 7.5; BOD 23-01; NIST RA-5(5) |
| 4 | Leaving scanner and pipeline credentials unmanaged | Trivy supply chain attack 2026 |
| 5 | Prioritising on CVSS base score alone | FIRST CVSS v4.0 and EPSS guidance |
| 6 | Exceptions and unsupported software that never expire | CIS Safeguard 2.2; NIST CA-5 |
| 7 | Patching without evicting the attacker | CitrixBleed 2023; ToolShell 2025 |
| 8 | Ignoring network devices and edge appliances | Salt Typhoon; BOD 23-01 scope |
| 9 | Counting only CVEs | ShadowRay 2024 |
| 10 | Treating virtual patches and WAF rules as fixes | CISA KEV remediation criteria; ShinyHunters claim |
1. Treating known exploited vulnerabilities as just another "high"
The issue: vulnerabilities in the CISA Known Exploited Vulnerabilities (KEV) catalogue sit in the same 30 or 90 day queue as everything else rated high.
Why it matters: KEV lists only flaws with reliable evidence of exploitation in the wild and a clear remediation action. The catalogue held 1,754 entries on 21 October 2026, 361 of them marked as known to be used in ransomware campaigns, and the due dates CISA sets for federal agencies are most often 21 days after listing, sometimes as little as 3. In the ShinyHunters FBI breach claim, the claimed intrusion came about 103 days after Oracle patched the PeopleSoft flaw the page discusses, although its use in that attack is unconfirmed.
What to do: a separate, faster SLA for KEV entries on internet-facing systems, with automatic ticketing when a new entry matches your inventory. CISA recommends that non-federal organisations include immediate KEV remediation in their plans. See the Zero-Day and Exploited Vulnerabilities Guide.
2. Scanning an incomplete asset inventory
The issue: scanners target ranges and hosts from a CMDB that is missing cloud accounts, roaming laptops and forgotten servers.
Why it matters: a clean dashboard that excludes unknown assets is false assurance. The CIS Controls v8.1 assessment specification makes Safeguard 7.7 (remediate detected vulnerabilities) depend on Safeguard 1.1 (detailed enterprise asset inventory) for this reason.
What to do: discovery before scanning. CISA BOD 23-01 sets automated asset discovery every 7 days and vulnerability enumeration of all discovered assets every 14 days, a useful benchmark beyond federal agencies. Report scan coverage against discovered assets, not against the CMDB. See the Asset Inventory and CMDB Security Guide.
3. Relying on unauthenticated scans
The issue: network scans run without credentials and infer software versions from banners and open ports.
Why it matters: unauthenticated scans miss most local software, missing patches and configuration issues. BOD 23-01 notes that full visibility needs privileged access through credentialed scans or endpoint agents, and CIS Safeguard 7.5 calls for both authenticated and unauthenticated internal scans at least quarterly.
What to do: credentialed scanning or agents for every managed asset (NIST SP 800-53 RA-5(5) Privileged Access), track the authenticated scan success rate, and treat credential failures as defects. See the Vulnerability Scanning Guide.
4. Leaving scanner and pipeline credentials unmanaged
The issue: the accounts that let scanners and patch tools log on to every host, and the tokens security tools hold in CI/CD pipelines, are shared, long-lived and over-privileged.
Why it matters: security tooling becomes the attack path. In the Trivy supply chain attack, a stolen token let attackers publish a malicious release and repoint trivy-action tags, so pipelines running the scanner had their secrets stolen; credentials missed in the first rotation kept the attacker in.
What to do: dedicated scanning accounts per scope, vaulted and rotated, never domain admin; pin scanner actions to commit SHAs; and rotate every reachable credential at once after an incident. See the Secrets Management Guide.
5. Prioritising on CVSS base score alone
The issue: remediation queues and SLAs are driven only by CVSS base severity.
Why it matters: the CVSS v4.0 specification says consumers should enrich Base metrics with Threat and Environmental metrics, and asks that scores are labelled CVSS-B, CVSS-BT, CVSS-BE or CVSS-BTE so readers know what was assessed. FIRST's EPSS guidance notes that severity-only deadlines can cover thousands of vulnerabilities, most of which may never be exploited.
What to do: combine severity with exploitation evidence (KEV), likelihood (EPSS, which estimates the probability of exploitation in the next 30 days and is not itself a risk score) and asset context, or use a decision model such as CISA SSVC (Track, Track*, Attend, Act). See the Vulnerability Prioritisation Guide.
6. Exceptions and unsupported software that never expire
The issue: risk acceptances are granted with no end date, no owner and no compensating controls, and end-of-support systems sit permanently in the exception list.
Why it matters: the exception register becomes the real backlog. CIS Safeguard 2.2 allows unsupported software only with a documented exception reviewed at least monthly; otherwise it is unauthorised. KEV guidance says that if a product is end-of-life and cannot be updated, the action is to remove it.
What to do: every exception gets an owner, a fixed expiry (for example 90 days), compensating controls and a plan of action and milestones (NIST CA-5). Report expired exceptions as overdue findings. See the Remediation SLAs and Vulnerability Exceptions Guide.
7. Patching without evicting the attacker
The issue: a ticket closes when the patch is installed, even though the flaw was exploited before the fix.
Why it matters: stolen sessions, keys and web shells survive patching. After CitrixBleed (CVE-2023-4966), Citrix told customers to terminate all active and persistent sessions after upgrading. In ToolShell, attackers stole SharePoint ASP.NET machine keys, so Microsoft's guidance required key rotation and an IIS restart on every server.
What to do: for any KEV or zero-day on an exposed system, the remediation includes compromise assessment, session revocation and rotation of credentials and keys on the host. See the Patch Management Guide.
8. Ignoring network devices and edge appliances
The issue: routers, firewalls, VPNs and load balancers are excluded from scanning or patched once a year by a network team outside the programme.
Why it matters: in the Salt Typhoon telecom intrusions, Cisco Talos found CVE-2018-0171, a flaw about seven years old, likely abused in one case, although stolen credentials were the main entry route. BOD 23-01 explicitly includes routers, switches, firewalls and appliances in scope.
What to do: inventory firmware versions, include edge devices in authenticated scanning, apply the KEV SLA to them, and manage device credentials such as SNMP communities and local admin accounts as non-human identities.
9. Counting only CVEs
The issue: the programme tracks only issues with a CVE ID, and misconfigurations or insecure-by-design exposures fall between teams.
Why it matters: in ShadowRay, CVE-2023-48022 was disputed because the maintainer said the missing authentication on Ray's Jobs API was by design, so there was no patch to apply. Exposed clusters were still compromised and their cloud and AI API credentials stolen. BOD 23-01's definition of vulnerability enumeration covers misconfigurations as well as missing updates.
What to do: include misconfiguration findings, exposed management interfaces and exposed secrets in the same risk queue. See the Exposure Management and CTEM Guide.
10. Treating virtual patches and WAF rules as fixes
The issue: a WAF signature or IPS rule is deployed and the vulnerability is marked mitigated with no deadline for the real patch.
Why it matters: CISA's KEV criteria describe workarounds as temporary, to be replaced by the official update when available. The ShinyHunters breach page reports that the group bypassed WAF rules for the PeopleSoft flaw by URL-encoding one character in the request path.
What to do: record virtual patches as time-limited exceptions (mistake 6) and keep the patch ticket open until the fix is installed and verified by rescan.
Mapping to frameworks
| Mistake | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | CIS Controls v8.1 |
|---|---|---|---|
| 1. KEV as just another high | ID.RA-01 | SI-2, RA-5 | 7.2, 7.7 |
| 2. Incomplete inventory | ID.AM-01, ID.AM-02 | CM-8 | 1.1, 1.3 |
| 3. Unauthenticated scans | ID.RA-01 | RA-5(5) | 7.5 |
| 4. Unmanaged scanner credentials | ID.RA-01 | RA-5(5) | 7.5 |
| 5. CVSS-only prioritisation | ID.RA-01 | RA-3, RA-5 | 7.2 |
| 6. Exceptions that never expire | PR.PS-02 | CA-5 | 2.2, 7.2 |
| 7. Patching without eviction | ID.RA-01 | SI-2 | 7.7 |
| 8. Network and edge devices | ID.AM-01 | CM-8, RA-5 | 1.1, 7.5, 7.6 |
| 9. CVE-only tracking | ID.RA-01 | RA-5 | 7.1 |
| 10. Virtual patches as fixes | PR.PS-02 | SI-2, SI-2(2) | 7.7 |
Attackers map to the same gaps: MITRE ATT&CK T1190 Exploit Public-Facing Application and T1133 External Remote Services for mistakes 1, 8 and 10, T1210 Exploitation of Remote Services for internal patch gaps, and T1078 Valid Accounts where stolen sessions and keys outlive the patch (mistake 7).
Where to start
If you can fix only three things this quarter: put a KEV SLA and automatic ticketing in place for internet-facing systems (mistake 1), measure scan coverage against discovered assets rather than the CMDB (mistake 2), and give every exception an owner and an expiry (mistake 6). Then track four numbers monthly: median days to remediate KEV entries, percentage of assets with authenticated scans, percentage of discovered assets scanned in the last 14 days, and count of expired exceptions. CIS Safeguard 7.2 expects the remediation process to be reviewed monthly, which is a natural cadence for these metrics. To score your programme overall, use the Vulnerability Management Maturity Model.
Related NHI Mgmt Group resources: Vulnerability Management Guide · Vulnerability Prioritisation Guide · Risk-Based Vulnerability Management Guide · Vulnerability Management Policy Template · Top 10 Secrets Management Mistakes