Topic starter
20/08/2026 5:41 pm
TL;DR: December’s Patch Tuesday ships 57 CVEs, including an actively exploited zero-day in Windows Cloud Files Mini Filter Driver and two publicly disclosed zero-days in GitHub Copilot for JetBrains and PowerShell, while late-November EPSS swings affected 4,832 CVEs, according to Expel. The pattern shows why patch queues need exploit-likelihood signals, not just severity labels, to drive remediation.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Patch Tuesday: December 2025 (Expel’s version)”.
By the numbers:
- December’s Patch Tuesday includes 57 CVEs.
- Late-November EPSS swings affected 4,832 CVEs.
Key questions
Q: What should teams do first when a vulnerability was classified as low exploitability?
A: Re-open the exception and test the original reasoning against AI-assisted exploit generation.
Q: Why do EPSS changes matter when patch teams already use CVSS?
A: CVSS measures impact and technical characteristics, but it does not tell you how likely a vulnerability is to be used next.
Q: What breaks when patch governance only uses monthly review cycles?
A: A monthly cadence can leave teams acting on stale risk data while attackers are exploiting newly prioritised vulnerabilities.
Practitioner guidance
- Prioritise vulnerabilities with exploit-likelihood context Weight actively exploited flaws, KEV-listed items and sharp EPSS rises above generic severity bands when building patch queues.
- Shorten re-triage cycles for patch governance Re-score remediation priorities whenever EPSS or threat intelligence changes materially, rather than waiting for the next scheduled patch review.
- Focus first on privilege-escalation paths Treat vulnerabilities that can reach SYSTEM, root or equivalent administrative control as urgent because they expand blast radius quickly.
Bottom line: Patch Tuesday prioritisation now depends on more than severity because exploitation evidence and likelihood signals can change faster than remediation backlogs.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:25 pm
Exploit-likelihood has become a governance control, not just a scoring input. Patch teams increasingly need live signals that separate theoretical exposure from practical attacker interest. Severity alone cannot tell you which weakness is most likely to be chained into privilege abuse, especially when late-cycle intelligence shifts ranking rapidly. Practitioners should treat exploit-likelihood as part of remediation governance, not as an optional dashboard filter.
A few things that frame the scale:
- Only 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38% the year before, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should security teams balance severity scores with exploitation evidence?
A: Use severity to understand impact, but let exploitation evidence and exploit-likelihood decide urgency. If a flaw is actively exploited, publicly disclosed or rising sharply in EPSS, it should move ahead of equally severe issues without current attacker attention. In practice, that means patch order should be driven by a blend of impact, exposure and observed threat activity.
👉 Read our full editorial: December Patch Tuesday highlights active exploit risk and EPSS volatility