Topic starter
16/09/2026 9:21 am
TL;DR: CISA’s latest KEV additions confirm active exploitation of MikroTik RouterOS flaws and Cisco FMC authentication bypass conditions, while Rapid7 tooling and ransomware-linked CVEs show how quickly exposed management planes become operational targets, according to Senserva. Patch order now has to follow exploitation evidence, not CVSS alone, because edge and management-plane exposure can outrun routine enterprise reporting.
Editorial analysis by NHI Mgmt Group, based on content published by Senserva: “MikroTik RouterOS CVEs Added to CISA KEV, Cisco FMC Exploited”.
Key questions
Q: What should teams do first when a KEV-listed management-plane flaw appears?
A: Patch the exploited management-plane exposure first, then confirm which devices are internet reachable and whether any admin interface was left outside your normal patch and monitoring workflow.
Q: Why do KEV-listed vulnerabilities deserve faster action than high-CVSS bugs?
A: KEV-listed flaws already have evidence of exploitation, which means attackers are actively prioritising them.
Q: Where do patch programmes fail with firewall and router management planes?
A: They fail when appliance inventories, internet exposure checks, and patch ownership sit outside the same governance process used for servers and endpoints.
Practitioner guidance
- Prioritise KEV over CVSS Reorder patch queues so confirmed exploitation, internet exposure, and management-plane reachability outrank raw severity scores.
- Inventory every appliance separately Build a dedicated list of edge routers, firewall managers, and appliance consoles that are not covered by endpoint tooling or standard reporting.
- Lock down management interfaces Remove internet exposure from administrative portals, restrict them to trusted networks, and confirm access is authenticated and monitored.
Bottom line: KEV-listed flaws change the patching question from what is severe to what is already being exploited.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/09/2026 9:21 am
KEV changes the governance model for patching. CVSS tells you how bad a flaw could be, but KEV tells you whether adversaries are already using it. In practice, that means remediation priority should follow exploitation evidence, not abstract severity ordering. For patch teams, this is a control-selection problem as much as a vulnerability problem: the patch queue must reflect attacker behaviour, not just scanner output.
A few things that frame the scale:
- Only 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38% the year before, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
A: Any system that can alter network policy, authentication flow, or administrative control belongs in privileged access governance. If a controller can change trust boundaries or manage access paths, it should be treated as a high-risk privileged asset, even when it is sold as infrastructure.
👉 Read our full editorial: KEV-listed edge router flaws show why patch priority must change