Notifications
Clear all
Topic starter
20/08/2026 5:41 pm
TL;DR: December’s Patch Tuesday ships 57 CVEs, including an actively exploited zero-day in Windows Cloud Files Mini Filter Driver and two publicly disclosed zero-days in GitHub Copilot for JetBrains and PowerShell, while late-November EPSS swings affected 4,832 CVEs, according to Expel. The pattern shows why patch queues need exploit-likelihood signals, not just severity labels, to drive remediation.
NHIMG editorial — based on content published by Expel: December Patch Tuesday prioritisation and EPSS volatility analysis
By the numbers:
- December’s Patch Tuesday includes 57 CVEs, including three zero-day vulnerabilities and one that is actively being exploited in the wild.
- The late-November EPSS update affected 4,832 CVE scores across two days.
Questions worth separating out
Q: How should security teams prioritise vulnerabilities when EPSS changes quickly?
A: Use EPSS as a live probability signal, not as a standalone decision engine.
Q: Why do privilege escalation flaws create broader security risk than ordinary endpoint bugs?
A: Privilege escalation flaws change the attacker’s authority, not just their access.
Q: What do teams get wrong about developer tooling and code execution risk?
A: Teams often trust developer tools because they are part of normal workflows, but that trust can be abused when auto-approval, plugins, or embedded scripts execute unreviewed commands.
Practitioner guidance
- Re-rank patches using exploit evidence Prioritise CVEs that combine KEV listing, public exploit artefacts, and EPSS movement, then route them ahead of severity-only backlog items.
- Restrict high-risk execution paths Limit who can use PowerShell, developer automation, and other script-executing tools on endpoints that handle sensitive administration or code.
- Treat local privilege as identity scope Map where SYSTEM, local admin, and service-account permissions can be reached from normal user workflows, then reduce those pathways before attackers can chain exploitation into broader access.
What's in the full article
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- Per-CVE breakdown of the December Patch Tuesday list, including the three zero-days and the driver-level escalation path behind CVE-2025-62221.
- The article's own prioritisation rationale for the Critical RCE issues, which is useful when patch windows are constrained.
- EPSS movement tables and score-change examples that help teams compare exploit likelihood across a large vulnerability set.
- Specific commentary on why Microsoft’s warning for PowerShell matters for day-to-day admin and scripting workflows.
👉 Read Expel’s analysis of December Patch Tuesday prioritisation and EPSS volatility →
Patch Tuesday priorities and EPSS volatility: what teams should act on?
Explore further
20/08/2026 6:25 pm
Exploitability, not severity, is the real patch governor: CVSS remains useful, but it is too static to carry operational priority on its own. When KEV listing, public disclosure, and EPSS movement all point in the same direction, remediation should move from backlog management to active risk containment. The practical conclusion is that vulnerability programmes need dynamic reprioritisation rules, not fixed patch calendars.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations respond when a critical vulnerability is already being exploited?
A: Containment comes first. Isolate exposed systems, remove or restrict the risky execution path, validate whether the vulnerable component is in use, and then patch based on exposure and privilege impact. If the issue affects administrative or scripting workflows, treat it as a high-priority identity and endpoint control failure, not just a software update.
👉 Read our full editorial: December Patch Tuesday highlights active exploit risk and EPSS volatility
