CISA KEV-listed exploits show why patch priority beats CVSS

At a glance

What this is: This is a patch-prioritisation update showing that KEV-listed, actively exploited vulnerabilities should outrank severity-only scoring in remediation queues.

Why it matters: For IAM and security teams, the message is that exposed internet-facing systems, admin platforms, and legacy assets create the fastest path from vulnerability to compromise, so patch governance must be risk-based.

By the numbers:

• CVE-2026-48282, a path traversal vulnerability in Adobe ColdFusion, carries a CVSS score of 10 and is on the CISA KEV list.
• CVE-2026-34910 in Ubiquiti UniFi OS is also rated CVSS 10 and has an EPSS near 0.79.
• CVE-2007-3010, an Alcatel OmniPCX Enterprise remote code execution flaw, has an EPSS of 0.98.
• CVE-2026-42897 is a Microsoft Exchange Server spoofing vulnerability rated CVSS 8.8 and listed on KEV.

👉 Read Senserva's KEV-prioritised patch analysis for exploited CVEs

Context

Patch queues often fail when they are ordered by severity alone rather than by active exploitation and exposure. In practice, a perfect CVSS score can still sit below a lower-scoring flaw if the lower-scoring issue is already being weaponised against internet-facing systems. This update is about that governance gap, with direct implications for identity-adjacent platforms such as Exchange and admin consoles.

The primary question for practitioners is not which CVE looks worst on paper, but which one changes the likelihood of compromise today. That matters to IAM, PAM, and broader security operations because exploited infrastructure often becomes the foothold for credential theft, privilege escalation, and lateral movement. The article’s starting position is typical of modern patch triage: exploitability, not severity alone, drives outcomes.

Key questions

Q: How should security teams prioritise patches when CVSS no longer drives the schedule?

A: Start with exploitability, exposure, and business impact. A patch queue should elevate internet-facing systems, known exploited vulnerabilities, and flaws that can be automated at scale. CVSS still informs context, but it should no longer decide timing on its own. The practical goal is to reduce attacker opportunity, not to maximise score reduction.

Q: Why do low-scoring vulnerabilities sometimes outrank higher CVSS issues?

A: Because attacker behaviour is shaped by access, exploit maturity, and available targets, not just severity scores. A lower-scoring issue that is already exploited or easy to reach can present more immediate risk than a high-CVSS flaw that is not exposed or not yet weaponised. Prioritisation should reflect real attack pressure.

Q: What signals show that patching is not keeping up with risk?

A: A growing number of KEV-listed assets, repeated exposure on public-facing systems, and a backlog dominated by legacy platforms all suggest remediation is lagging behind attacker activity. The strongest warning sign is when known exploited issues remain open across multiple cycles without a clear ownership path.

Q: Who should own remediation when a CVE affects identity infrastructure?

A: Ownership should sit with the service or platform team that can change the control, but IAM or NHI specialists should co-own remediation when the issue affects authentication, privilege, token handling, or credential storage. Clear ownership prevents identity-impacting vulnerabilities from falling between infrastructure and security teams.

Technical breakdown

Why KEV listing changes patch priority

CISA’s Known Exploited Vulnerabilities list is a practical signal that a flaw has crossed from theoretical risk into observed attacker activity. A KEV-listed issue deserves different treatment from a dormant high-severity CVE because exploitation likelihood, not just technical impact, is already proven. EPSS adds a probabilistic layer by estimating the chance of exploitation, which helps teams separate urgent patching from standard backlog management. In operational terms, KEV and EPSS together form a better prioritisation model than CVSS alone.

Practical implication: place KEV-listed issues into emergency remediation tracks even when the CVSS score is lower than other open findings.

Why internet-facing systems become the first foothold

Path traversal, remote code execution, spoofing, and authorization bypass are not equivalent from an attacker’s perspective, but they all become more dangerous when exposed services sit on the public internet. Once attackers reach a vulnerable edge system, they often use it to pivot into identity infrastructure, cached sessions, or administrative control planes. That is why patching a perimeter application can be an identity security action, not just an infrastructure task. The real issue is blast radius, because exposed services rarely fail in isolation.

Practical implication: classify externally reachable systems with identity or admin reach as top-tier remediation targets.

How legacy assets turn patching into a governance problem

Older products and long-retired operating environments create a patching trap: they remain in inventory, but the organisations that own them often no longer maintain strong lifecycle controls. That is where legacy Windows systems, old Exchange instances, and unsupported appliances stay exposed long after the team believes they were retired. Governance fails when asset truth, ownership, and remediation authority are not aligned. The result is a patch backlog that is partly a discovery problem and partly a control problem.

Practical implication: tie vulnerability closure to asset ownership and retirement status, not only to scanner output.

NHI Mgmt Group analysis

Exploitability-first remediation is now the correct patch governance model. CVSS remains useful for technical severity, but it does not tell practitioners which vulnerabilities are being used in the wild today. KEV inclusion, EPSS, and exposure context together provide a more defensible prioritisation model for security operations and IAM-adjacent platforms. Teams that still queue patches by score alone are optimising for neatness, not risk reduction. The practical conclusion is to move exploitation status to the top of remediation policy.

Identity-adjacent platforms deserve special treatment because compromise there expands attacker control quickly. Exchange, admin consoles, and internet-facing collaboration systems are not just applications. They are paths into authentication flows, privileged sessions, and downstream identity stores. Once an attacker lands there, credential theft and privilege escalation become much easier. The practical conclusion is to treat these systems as identity-critical assets in vulnerability governance.

Legacy exposure is a lifecycle failure, not just a scanning failure. Old CVEs appearing on KEV lists years later show that some organisations are still carrying unsupported or forgotten assets inside operational environments. The named concept here is patch backlog persistence: vulnerabilities remain exploitable because asset retirement, ownership, and remediation authority never converge. This is a governance defect that spans IT, security, and identity teams. The practical conclusion is to close the lifecycle gap, not merely the ticket.

Exploit-pressure reporting is becoming a more useful control signal than raw vulnerability counts. Security teams need metrics that explain what can be attacked now, not just what exists in inventory. That means using KEV coverage, EPSS bands, and asset exposure to drive executive reporting and remediation cadence. For IAM and PAM teams, the same logic applies to privileged systems and externally reachable management planes. The practical conclusion is to report patch risk in terms of attacker opportunity, not backlog volume.

What this signals

Exploitability-driven patching is becoming a control discipline, not a hygiene task. Security teams that still rank work by severity alone will continue to miss the systems attackers can actually reach. The practical shift is to report exposure in terms of KEV, EPSS, and privilege-bearing reach so patch governance aligns with attacker behaviour rather than abstract risk scores.

Patch backlog persistence is a useful named concept for leadership reporting. It describes the point where vulnerabilities stay open because ownership, lifecycle management, and remediation capacity never converge. That matters to identity programmes because the same structural failure often affects privileged platforms and externally reachable admin planes.

For identity teams, patch intelligence should be tied to account and session exposure, not only infrastructure state. When a vulnerable system can expose authentication material or privileged management access, it should appear in the same governance discussion as credential hygiene and privileged session control. That alignment helps teams prioritise the fixes that most reduce blast radius.

For practitioners

• Prioritise KEV-listed vulnerabilities first Move all CISA KEV entries into an emergency queue regardless of CVSS when the affected asset is internet-facing or identity-adjacent. Require explicit risk acceptance before anything stays open past the current remediation cycle.
• Weight remediation by exploitability and exposure Use EPSS, KEV status, and external reachability together to rank patches so teams do not waste effort on high-scoring but low-pressure issues while active exploits remain open.
• Treat Exchange and admin consoles as identity-critical Escalate patching for systems that can expose sessions, credentials, or privileged access paths, because a foothold there can become authentication abuse or lateral movement very quickly.
• Verify legacy asset retirement and ownership Reconcile scanner findings against asset inventory, ownership, and retirement records so obsolete systems like legacy Windows hosts do not remain exposed because nobody still owns the fix.
• Build patch reporting around attacker opportunity Report the number of KEV-listed, externally reachable, and privilege-bearing assets separately from total vulnerability counts so leadership sees where compromise is most likely now.

Key takeaways

• Actively exploited vulnerabilities should outrank severity-only findings in patch queues.
• KEV, EPSS, and exposure context provide a better view of real attacker pressure than CVSS alone.
• Identity-adjacent systems and legacy assets turn patching into a governance and lifecycle problem.

Key terms

• Known Exploited Vulnerability: A Known Exploited Vulnerability is a flaw that has confirmed active exploitation in the wild and is tracked for urgent remediation. In governance terms, KEV status turns patching from a general hygiene task into a time-bound operational obligation.
• EPSS: The Exploit Prediction Scoring System estimates the likelihood that a vulnerability will be exploited in the wild. It is useful for prioritisation because it reflects observed threat patterns, but it still needs local identity context such as privilege scope, secret exposure, and reachability.
• Identity-adjacent system: An identity-adjacent system is any platform that can expose credentials, sessions, or privileged access if compromised. Examples include Exchange, admin consoles, and collaboration tools. These systems matter because they can become the launch point for credential theft or privilege escalation.

What's in the full analysis

Senserva's full article covers the operational detail this post intentionally leaves for the source:

• Daily tracker coverage of KEV-listed Microsoft and non-Microsoft CVEs, including patch status and exploitation signals.
• Product-specific mapping between CVEs, KBs, and affected versions for faster remediation validation.
• Feed-based ranking using CISA KEV, EPSS, and ransomware linkage for prioritised patch scheduling.
• Source references to the press reports and advisories behind each CVE so teams can verify urgency.

👉 Senserva's full update includes the affected products, KB mappings, and live tracker context.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners connect identity controls to the wider remediation and governance decisions their programmes depend on.