December Patch Tuesday highlights active exploit risk and EPSS volatility

At a glance

What this is: Expel says December’s Patch Tuesday combines active exploitation, public zero-days and major EPSS volatility, making exploit-likelihood a required input to patch triage.

Why it matters: For IAM and NHI practitioners, the same prioritisation problem applies to privileged accounts, service credentials and automation paths because exposure, exploitability and blast radius rarely line up with severity alone.

By the numbers:

• December’s Patch Tuesday includes 57 CVEs.
• Late-November EPSS swings affected 4,832 CVEs.

Context

Patch Tuesday is the monthly Microsoft update cycle, but the operational issue is broader than one vendor’s release: security teams must decide what to patch first when exploitable weaknesses outpace remediation capacity. In this case, the priority problem is not only the number of CVEs, but the combination of active exploitation, publicly disclosed zero-days and volatile exploit-likelihood signals.

That matters to IAM and NHI programmes because patching pressure often competes with privilege management, credential rotation and access reviews. If teams rely only on severity, they can miss where an exploitable vulnerability intersects with privileged execution paths, service accounts or automation tooling, which is where the largest blast radius tends to sit.

Key questions

Q: What should teams do first when a vulnerability was classified as low exploitability?

A: Re-open the exception and test the original reasoning against AI-assisted exploit generation. If the only justification was that the flaw seemed difficult to weaponise, that assumption is now weaker and should not be treated as a durable control boundary.

Q: Why do EPSS changes matter when patch teams already use CVSS?

A: CVSS measures impact and technical characteristics, but it does not tell you how likely a vulnerability is to be used next. EPSS adds that probability lens, which is especially useful when exploit activity changes quickly. Teams should use both together: CVSS for severity context, EPSS for near-term prioritisation, and KEV or observed exploitation for immediate escalation.

Q: What breaks when patch governance only uses monthly review cycles?

A: A monthly cadence can leave teams acting on stale risk data while attackers are exploiting newly prioritised vulnerabilities. When EPSS and threat intelligence are moving quickly, a once-a-month review is too slow to reorder the queue. That creates avoidable exposure windows, especially for privileged systems, scripting tools and perimeter services that can turn a flaw into system-level control.

Q: How should security teams balance severity scores with exploitation evidence?

A: Use severity to understand impact, but let exploitation evidence and exploit-likelihood decide urgency. If a flaw is actively exploited, publicly disclosed or rising sharply in EPSS, it should move ahead of equally severe issues without current attacker attention. In practice, that means patch order should be driven by a blend of impact, exposure and observed threat activity.

Technical breakdown

Why exploitability data changes patch order

Severity tells you how bad a vulnerability could be, not how likely it is to be used next. EPSS adds a probabilistic layer by estimating the chance of exploitation in the next 30 days, which helps separate theoretical risk from urgent remediation. That does not replace CVSS or vendor advisories. It gives vulnerability teams a second lens for ordering work when the patch queue is larger than the patch window. In practice, exploit-likelihood signals become more valuable as volumes rise and attackers focus on the most efficient paths to impact.

Practical implication: Use exploit-likelihood signals as an input to triage, not as a substitute for impact assessment.

Why active exploitation creates a different control problem

An actively exploited zero-day changes the question from whether a flaw is worth patching to how quickly containment can happen before exploitation spreads. In the source article, the Windows Cloud Files Mini Filter Driver issue matters because it can escalate a low-privilege foothold to SYSTEM, which turns a local flaw into a privileged control problem. That is especially important in environments where the vulnerable component sits inside a commonly used workflow or platform layer. Once privilege escalation is possible, the downstream issue becomes access abuse, not just code defect management.

Practical implication: Prioritise vulnerabilities that enable privilege escalation into privileged execution paths before lower-impact defects.

How EPSS volatility affects remediation governance

Large score swings show that exploit-risk rankings are not static evidence records. They are live signals that reflect new intelligence, exploit activity and model recalibration. A workflow that snapshots risk once a week can be stale by the time tickets are assigned. This is why patch governance now needs a repeatable refresh cycle, not a once-a-month review. For teams with identity-heavy estates, that same logic applies to privileged access and service accounts: risk posture changes when exposure changes, not when the monthly report arrives.

Practical implication: Build re-triage checkpoints into remediation governance so risk changes can alter patch order quickly.

Threat narrative

Attacker objective: The attacker’s objective is to turn an exposed flaw into privileged code execution and system-level control before defenders can patch or re-prioritise.

1. Entry occurs through a vulnerability that is already being exploited in the wild or through a publicly disclosed flaw that attackers can weaponise quickly.
2. Credential or privilege gain follows when the flaw enables code execution or escalation to SYSTEM, turning a limited foothold into high-impact access.
3. Impact is achieved when attackers use privileged execution to run arbitrary code, seize control of the host or extend access into adjacent systems.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.
• JADEPUFFER agentic ransomware 2026: The first documented agentic ransomware used harvested keys, default MinIO credentials and a default Nacos signing key to wipe a database.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exploit-likelihood has become a governance control, not just a scoring input. Patch teams increasingly need live signals that separate theoretical exposure from practical attacker interest. Severity alone cannot tell you which weakness is most likely to be chained into privilege abuse, especially when late-cycle intelligence shifts ranking rapidly. Practitioners should treat exploit-likelihood as part of remediation governance, not as an optional dashboard filter.

Privilege escalation is the real remediation boundary in many environments. A vulnerability that reaches SYSTEM or equivalent administrative control changes the operational consequence from a software defect to an access-control failure. That is where identity governance, endpoint hardening and patch management intersect. The important question is not simply whether the CVE is known, but whether it can cross into privileged execution before containment.

Patch queues now need a blast-radius concept, not a binary criticality label. The article’s central lesson is that exploitable flaws become materially different when they sit inside drivers, scripting environments or perimeter services that already carry high trust. This is where the security stack meets IAM and PAM: privileged pathways amplify the impact of a single defect. Practitioners should prioritise anything that can turn ordinary execution into elevated control.

EPSS volatility is a signal that remediation programmes must be more continuous. When thousands of scores move in two days, weekly or monthly patch governance cannot keep pace with attacker-relevant change. The operational response is to make risk re-ranking routine and to connect it to actual remediation capacity. Teams that cannot refresh priority decisions quickly will always be reacting after the highest-value exposure window has opened.

From our research library:

• Only 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38% the year before, according to Verizon's 2026 Data Breach Investigations Report.

What this signals

Exploit-likelihood signals are becoming the practical bridge between vulnerability data and identity governance. Teams managing privileged access, service accounts and automation should assume that a newly urgent CVE can change access risk faster than scheduled review cycles can absorb it. That means remediation decisions, not just detection dashboards, need to refresh continuously.

Privilege pathways deserve the same urgency as obvious external exposure. When a flaw can escalate into SYSTEM or run code through a trusted admin tool, the issue is no longer only patching. It becomes a question of how much control an attacker can gain before privilege boundaries or admin restrictions are enforced.

Blast-radius thinking should replace binary patch labels. The programme question is not whether a CVE is critical in the abstract, but whether it can cross into privileged execution, scripting abuse or trusted infrastructure control. That is the point where vulnerability management, PAM and least-privilege policy intersect.

For practitioners

• Prioritise vulnerabilities with exploit-likelihood context Weight actively exploited flaws, KEV-listed items and sharp EPSS rises above generic severity bands when building patch queues.
• Shorten re-triage cycles for patch governance Re-score remediation priorities whenever EPSS or threat intelligence changes materially, rather than waiting for the next scheduled patch review.
• Focus first on privilege-escalation paths Treat vulnerabilities that can reach SYSTEM, root or equivalent administrative control as urgent because they expand blast radius quickly.
• Restrict scripting and admin tooling exposure Limit who can use PowerShell and similar high-trust tools, and pair that restriction with least-privilege controls on administrative accounts.

Key takeaways

• Patch Tuesday prioritisation now depends on more than severity because exploitation evidence and likelihood signals can change faster than remediation backlogs.
• An actively exploited flaw that can reach SYSTEM is an access-control problem as much as a software defect, because it turns local execution into privileged control.
• Teams need a continuously refreshed triage model that blends EPSS, KEV status and privilege impact so the highest-risk issues move first.

Key terms

• Exploit Probability: Exploit probability is the estimated likelihood that a vulnerability will be used successfully in the wild over a defined time window. It is a forecasting signal, not a confirmation of active exploitation, so it should be refreshed frequently and combined with exposure and business context before assigning remediation priority.
• Exploited vulnerability catalog: An exploited vulnerability catalog is a curated list of flaws known to be used in real attacks. It matters because active exploitation changes priority. In practice, it helps security teams separate theoretical risk from issues that require urgent remediation and tighter operational oversight.
• Privilege Escalation: An attack technique where a compromised identity, often an NHI with initially limited permissions, exploits vulnerabilities or misconfigurations to gain elevated access rights, typically leading to broader compromise.
• Patch triage: The process of deciding which vulnerabilities to fix first, based on exploitation evidence, exposure, criticality, and operational dependency. Good triage does not try to treat every issue as equal; it aims to remove the attacker’s most realistic options with the least delay.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It helps IAM, PAM and security teams connect privilege governance to broader security operations.