Topic starter
22/07/2026 4:34 pm
TL;DR: Multiple KEV-listed vulnerabilities, including CVSS 10 flaws in Adobe ColdFusion and Ubiquiti UniFi OS, are being prioritised because they are actively exploited and not merely high severity, according to Senserva. The practical lesson is to rank patching by exploitation status, exposure, and business criticality, not by score alone.
Editorial analysis by NHI Mgmt Group, based on content published by Senserva: “ColdFusion CVE-2026-48282 Hits KEV at CVSS 10”.
Key questions
Q: What should teams do first when a vulnerability is added to CISA’s KEV catalog?
A: Treat the item as an active exploitation concern, not a normal patch ticket.
Q: Why do KEV-listed flaws matter more than high CVSS scores alone?
A: KEV-listed flaws matter because they reflect observed exploitation, not just theoretical impact.
Q: What breaks when patching is ranked only by severity scores?
A: Severity-only patching often leaves exposed, actively exploited systems sitting behind cosmetic priorities while teams spend time on issues that are easier to measure but less urgent.
Practitioner guidance
- Prioritise KEV-listed vulnerabilities before CVSS-only findings Build patch queues so that CISA KEV presence automatically moves an issue into the highest remediation tier, then sort that tier by exposure and business criticality.
- Tag internet-facing identity and admin systems as urgent Create a separate remediation lane for Exchange, SharePoint, VPN, remote management and other access-bearing platforms because exploitation there can quickly expand privilege and session risk.
- Use EPSS only to order the urgent backlog Apply EPSS after KEV and exposure have already determined priority, so probabilistic scoring does not delay fixes for confirmed exploitation.
Bottom line: KEV-listed vulnerabilities change patch priority because they are already being exploited, which makes them operationally different from unexploited high-severity findings.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
22/07/2026 4:39 pm
Patch prioritisation has become an exploitation governance problem, not a vulnerability scoring problem. CVSS remains useful, but it cannot tell a defender which flaw is being operationalised right now. KEV status changes the control objective from catalogue management to risk reduction under adversary pressure. Practitioners should treat exploited exposure as a governance trigger and not wait for perfect remediation windows.
A few things that frame the scale:
- The median time to fully patch a vulnerability in CISA's Known Exploited Vulnerabilities catalog rose to 43 days, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should organisations handle remediation when KEV items affect identity-adjacent systems?
A: When KEV items hit Exchange, SharePoint, VPNs or admin platforms, organisations should escalate them across IAM, PAM and platform operations as potential access-path incidents. Those systems can turn a vulnerability into privileged access or session abuse, so the response needs shared ownership, not siloed ticketing.
👉 Read our full editorial: CISA KEV-listed exploits show why patch priority beats CVSS
This post was modified 5 hours ago by NHI Mgmt Group