Notifications
Clear all
Topic starter
30/07/2026 10:50 pm
TL;DR: Adobe ColdFusion CVE-2026-48282, a path traversal flaw with CVSS 10, CISA KEV status, and EPSS 0.992, heads the list of actively exploited issues, alongside high-priority SharePoint, Exchange, Langflow, Zimbra, and legacy Windows and Alcatel entries cited by Senserva. The practical lesson is that remediation order should follow exploitation evidence, not severity alone.
NHIMG editorial — based on content published by Senserva: Adobe ColdFusion CVE-2026-48282 is the one to move on first
By the numbers:
- CVE-2026-48282 has a CVSS score of 10 and an EPSS score of 0.992.
- Microsoft SharePoint CVE-2026-50522 is listed with a CVSS score of 9.8 and an EPSS of 0.571.
- Langflow authorization bypass CVE-2026-55255 carries a CVSS 9.9 score and is KEV listed.
Questions worth separating out
Q: What breaks when organisations wait for KEV before patching new CVEs?
A: Waiting for KEV creates a blind spot because exploitation often starts before formal catalogue inclusion.
Q: Why do internet-facing application flaws often become identity risks?
A: Because web application compromise frequently exposes the components attackers need to reach identity controls, including configuration files, session tokens, admin interfaces, or service credentials.
Q: How do security teams know whether exploitability is more urgent than severity?
A: Use exploitation evidence, not severity alone.
Practitioner guidance
- Prioritise remediation by exploitation evidence Move KEV-listed vulnerabilities to the front of the queue, then order the rest by EPSS and exposed asset criticality.
- Review identity-adjacent blast radius Check whether vulnerable platforms can expose session material, admin panels, configuration files, or service credentials.
- Hunt for long-tail legacy exposure Inventory older systems still reachable from the internet or internal admin networks, especially ones tied to forgotten exceptions.
What's in the full article
Senserva's full article covers the operational detail this post intentionally leaves for the source:
- The live KEV and EPSS prioritisation logic used to rank patch urgency across Adobe, Microsoft, Langflow, Zimbra, and legacy systems.
- The per-CVE breakdown of why each issue is being treated as exploited, pending, or lower priority in the current remediation cycle.
- The linked tracker workflow for checking Microsoft patch state, including how open items are ordered and reviewed.
- The daily monitoring approach for non-Microsoft KEV additions and the companion guidance on exposed collaboration and email systems.
👉 Read Senserva's patch priority analysis for exploited CVEs and KEV-listed issues →
KEV-listed exploitation: what security teams need to patch first?
Explore further
30/07/2026 10:54 pm
Patch urgency is now an exploitation-governance problem, not a vulnerability-scoring problem. CVSS tells teams what could happen, but KEV and EPSS tell them what is already likely to happen. That shift matters because remediation calendars built around periodic review cycles are too slow for actively exploited web application flaws. Practitioners should treat exploitation evidence as a governance trigger that overrides normal queue discipline.
A question worth separating out:
Q: Who is accountable when a known exploited Office vulnerability remains unpatched?
A: Accountability sits with the owners of endpoint patching, email security, and privileged workstation governance, because the exposure spans all three. When a CVE is in KEV and patches are available, delayed remediation becomes a governance failure as well as a technical one. CISA deadlines and internal patch SLAs should be aligned to that reality.
👉 Read our full editorial: KEV-listed exploitation is driving patch urgency across key systems
