Notifications
Clear all
Topic starter
20/08/2026 5:35 pm
TL;DR: January Patch Tuesday surfaced 112 CVEs, including one actively exploited zero-day now in CISA’s KEV catalog, and a 2025 retrospective shows 63% of prioritised flaws had evidence of real-world exploitation, according to Expel. That pattern reinforces that vulnerability triage is now an identity-adjacent governance problem because footholds often become credential access and privilege escalation paths.
NHIMG editorial — based on content published by Expel: January Patch Tuesday review and 2025 exploit predictions
By the numbers:
- January’s Patch Tuesday includes 112 CVEs, including one zero-day vulnerability that is actively being exploited in the wild.
- In 2025, Expel recommended expedited patching of 46 CVEs with strong exploitation risk factors.
- 63% of the vulnerabilities Expel prioritised in 2025 showed evidence of exploitation in the wild.
Questions worth separating out
Q: What breaks when a vulnerability becomes an identity problem as well as a patching problem?
A: Patching only removes the code flaw.
A: Because exploit evidence shows attacker relevance, not just technical possibility.
Q: How can teams tell when a vulnerability is likely to enable privilege escalation?
A: Look for flaws that expose memory layout, require authenticated access, allow remote code execution, or sit near administrative trust paths such as update services and management planes.
Practitioner guidance
- Prioritise KEV-listed and weaponised flaws first Build patch queues around CISA KEV, malware weaponisation, and public exploitation before CVSS-based bulk remediation.
- Treat authenticated exploits as identity risks Flag vulnerabilities that require valid credentials, trusted connections, or user interaction because they can turn ordinary access into privileged execution.
- Separate control-plane assets into a faster patch lane Put SharePoint, WSUS, Azure Arc, RRAS, and similar trust-distribution systems into an accelerated remediation path with tighter change windows and compensating controls.
What's in the full article
Expel's full blog post covers the operational detail this post intentionally leaves for the source:
- Month-by-month vulnerability tables with EPSS, KEV status, and exploit-evidence annotations for the 2025 predictions list
- The full prioritisation rationale behind each CVE selection, including why some lower-scoring flaws were still escalated
- A complete breakdown of the January 2026 Patch Tuesday items, including the specific exploitation conditions for each CVE
- The retrospective comparison between prediction accuracy, in-the-wild exploitation, and ransomware or malware weaponisation
👉 Read Expel’s January Patch Tuesday analysis and 2025 exploit-retrospective →
Patch Tuesday vulnerability prioritisation: are your controls keeping up?
Explore further
20/08/2026 6:21 pm
Exploitability is the real prioritisation model, not raw vulnerability counts. Patch Tuesday volume matters, but the governance question is which flaws create a usable attacker path first. CVSS alone cannot tell teams whether an issue already sits inside an active intrusion pattern. Practitioners should therefore treat KEV-listed and weaponised flaws as operational access risks, not just remediation queue items.
A few things that frame the scale:
- 63% of the vulnerabilities Expel prioritised in 2025 showed evidence of exploitation in the wild, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
A question worth separating out:
Q: Who is accountable when a vulnerability report misses an exploitable issue?
A: Accountability sits with the programme owner who accepted the testing model and closure criteria, not only with the tester. If the organisation chose snapshots over continuous validation, the control gap is governance-led. Security leaders, application owners, and risk owners all need clear closure standards and evidence requirements.
👉 Read our full editorial: Patch Tuesday prioritisation still favours exploited Windows flaws
