Notifications
Clear all
Topic starter
22/07/2026 4:34 pm
TL;DR: Multiple KEV-listed vulnerabilities, including CVSS 10 flaws in Adobe ColdFusion and Ubiquiti UniFi OS, are being prioritised because they are actively exploited and not merely high severity, according to Senserva. The practical lesson is to rank patching by exploitation status, exposure, and business criticality, not by score alone.
NHIMG editorial — based on content published by Senserva: Adobe ColdFusion CVE-2026-48282 is the one to move on
By the numbers:
- CVE-2026-48282, a path traversal vulnerability in Adobe ColdFusion, carries a CVSS score of 10 and is on the CISA KEV list.
- CVE-2026-34910 in Ubiquiti UniFi OS is also rated CVSS 10 and has an EPSS near 0.79.
- CVE-2007-3010, an Alcatel OmniPCX Enterprise remote code execution flaw, has an EPSS of 0.98.
Questions worth separating out
Q: How should security teams prioritise patches when CVSS no longer drives the schedule?
A: Start with exploitability, exposure, and business impact.
Q: Why do low-scoring vulnerabilities sometimes outrank higher CVSS issues?
A: Because attacker behaviour is shaped by access, exploit maturity, and available targets, not just severity scores.
Q: What signals show that patching is not keeping up with risk?
A: A growing number of KEV-listed assets, repeated exposure on public-facing systems, and a backlog dominated by legacy platforms all suggest remediation is lagging behind attacker activity.
Practitioner guidance
- Prioritise KEV-listed vulnerabilities first Move all CISA KEV entries into an emergency queue regardless of CVSS when the affected asset is internet-facing or identity-adjacent.
- Weight remediation by exploitability and exposure Use EPSS, KEV status, and external reachability together to rank patches so teams do not waste effort on high-scoring but low-pressure issues while active exploits remain open.
- Treat Exchange and admin consoles as identity-critical Escalate patching for systems that can expose sessions, credentials, or privileged access paths, because a foothold there can become authentication abuse or lateral movement very quickly.
What's in the full analysis
Senserva's full article covers the operational detail this post intentionally leaves for the source:
- Daily tracker coverage of KEV-listed Microsoft and non-Microsoft CVEs, including patch status and exploitation signals.
- Product-specific mapping between CVEs, KBs, and affected versions for faster remediation validation.
- Feed-based ranking using CISA KEV, EPSS, and ransomware linkage for prioritised patch scheduling.
- Source references to the press reports and advisories behind each CVE so teams can verify urgency.
👉 Read Senserva's KEV-prioritised patch analysis for exploited CVEs →
CISA KEV-listed exploits: what should patch teams do first?
Explore further
22/07/2026 4:39 pm
Exploitability-first remediation is now the correct patch governance model. CVSS remains useful for technical severity, but it does not tell practitioners which vulnerabilities are being used in the wild today. KEV inclusion, EPSS, and exposure context together provide a more defensible prioritisation model for security operations and IAM-adjacent platforms. Teams that still queue patches by score alone are optimising for neatness, not risk reduction. The practical conclusion is to move exploitation status to the top of remediation policy.
A question worth separating out:
Q: Who should own remediation when a CVE affects identity infrastructure?
A: Ownership should sit with the service or platform team that can change the control, but IAM or NHI specialists should co-own remediation when the issue affects authentication, privilege, token handling, or credential storage. Clear ownership prevents identity-impacting vulnerabilities from falling between infrastructure and security teams.
👉 Read our full editorial: CISA KEV-listed exploits show why patch priority beats CVSS
