Topic starter
30/07/2026 10:50 pm
TL;DR: Adobe ColdFusion CVE-2026-48282, a path traversal flaw with CVSS 10, CISA KEV status, and EPSS 0.992, heads the list of actively exploited issues, alongside high-priority SharePoint, Exchange, Langflow, Zimbra, and legacy Windows and Alcatel entries cited by Senserva. The practical lesson is that remediation order should follow exploitation evidence, not severity alone.
Editorial analysis by NHI Mgmt Group, based on content published by Senserva: “Adobe ColdFusion CVE-2026-48282 tops KEV movers with EPSS 0.99”.
By the numbers:
- Adobe ColdFusion CVE-2026-48282 has a CVSS score of 10 and an EPSS score of 0.992.
- Microsoft SharePoint remote code execution CVE-2026-50522 is listed at CVSS 9.8.
Key questions
Q: What breaks when organisations wait for KEV before patching new CVEs?
A: Waiting for KEV creates a blind spot because exploitation often starts before formal catalogue inclusion.
Q: Why do actively exploited vulnerabilities create more urgent risk than high CVSS scores alone?
A: Actively exploited vulnerabilities are urgent because they show attackers are already using the flaw in the wild, so the risk is immediate rather than theoretical.
Q: What are the signs that exploit-priority patching is failing?
A: Common signs include repeated references to the same CVEs across multiple cycles, lingering legacy systems, and vulnerable application servers that stay exposed after central patch operations claim completion.
Practitioner guidance
- Prioritise KEV-listed vulnerabilities first Build your remediation queue around active exploitation signals, then sort by external exposure, business criticality, and whether the affected system handles identities or secrets.
- Verify exposure on authentication and admin systems Check internet-facing applications, SSO integrations, and administrative consoles for the listed CVEs before assuming central patching has covered them.
- Contain identity-bearing systems alongside patching If a vulnerable platform stores tokens, certificates, or privileged accounts, review those credentials as part of the same remediation cycle and reset anything that may have been exposed.
Bottom line: KEV-listed vulnerabilities should be treated as active attack paths, not just high-priority defects.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:54 pm
KEV status is now the operational signal that matters most: severity without exploitation evidence is a weak prioritisation model. Once a vulnerability enters the active exploitation queue, defenders are no longer choosing among theoretical risks but between known attack paths and incomplete remediation capacity. The practical conclusion is that remediation governance must elevate KEV-listed exposure above untreated but unexploited findings.
A few things that frame the scale:
- The median time to fully patch a vulnerability in CISA's Known Exploited Vulnerabilities catalog rose to 43 days, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: When should teams prioritise an older CVE over newer patch work?
A: Prioritise the older CVE when it is externally reachable, has proof of concept code, and affects a privileged management surface or identity control path. Age matters less than exploitability and blast radius. A year-old bypass on an internet-facing appliance can be more urgent than a newer flaw hidden behind stronger compensating controls.
👉 Read our full editorial: KEV-listed exploitation is driving patch urgency across key systems