Notifications
Clear all
Topic starter
30/07/2026 10:50 pm
TL;DR: SharePoint CVE-2026-50522, rated Critical at CVSS 9.8 and listed in CISA’s Known Exploited Vulnerabilities catalog, is the week’s top patch priority, while Adobe ColdFusion CVE-2026-48282 carries a CVSS 10.0 score and EPSS 0.9899, according to Senserva. The operational lesson is that exploitability signals, not severity alone, should drive patch sequencing across internet-facing and identity-adjacent systems.
NHIMG editorial — based on content published by Senserva: SharePoint CVE-2026-50522 is the one to fix first
By the numbers:
- SharePoint CVE-2026-50522 is listed as Critical at CVSS 9.8.
- Adobe ColdFusion CVE-2026-48282 has an EPSS of 0.9899.
- CVE-2026-55040 carries the same EPSS reading of 0.571 as the top SharePoint issue.
Questions worth separating out
Q: How should security teams prioritise patches when CVSS no longer drives the schedule?
A: Start with exploitability, exposure, and business impact.
Q: Why do SharePoint and Exchange vulnerabilities matter to IAM teams?
A: They matter because collaboration and mail platforms often mediate identity-adjacent actions such as delegated access, trusted communications, and admin workflows.
Q: What do security teams get wrong about patching SAP vulnerabilities?
A: They often treat patching as an infrastructure task instead of a control-state change.
Practitioner guidance
- Prioritise KEV-listed flaws before score-only items Work from CISA Known Exploited Vulnerabilities first, then use EPSS to order items inside the same priority band.
- Bundle same-surface fixes into one change window Patch SharePoint CVE-2026-50522 and CVE-2026-55040 together, then group other flaws that affect the same externally reachable platform so defenders do not leave a sibling issue behind.
- Review mailbox and delegated access after mail-system fixes After remediating Exchange or Zimbra flaws, inspect mailbox access, delegated permissions, and suspicious sign-ins because compromise often extends beyond the original application bug.
What's in the full analysis
Senserva's full report covers the operational detail this post intentionally leaves for the source:
- Per-CVE ranking logic that combines KEV, EPSS, and ransomware linkage for Microsoft items
- Non-Microsoft exploited-CVE tracking for ColdFusion, Langflow, and other urgent exposures
- A detail page for each named CVE and KB so teams can verify current exploitation status
- Feed-backed patch prioritisation view that shows which items should move first in the maintenance queue
👉 Read Senserva’s roundup of KEV-ranked SharePoint, Exchange, and ColdFusion flaws →
SharePoint CVE-2026-50522 and KEV pressure: what should teams do?
Explore further
30/07/2026 10:56 pm
Exploitability telemetry is now the real patch governor. CVSS alone cannot tell teams what is already being hunted, while KEV and EPSS together show where attackers are likely to spend effort first. That shifts patch governance from abstract exposure scoring to operational prioritisation tied to live exploitation conditions. For practitioners, the decision is no longer which flaw is worst on paper, but which flaw is most likely to be used before the next maintenance window closes.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37%, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Who is accountable when an exploited platform flaw exposes user mail or trusted access?
A: Accountability is shared across vulnerability management, platform ownership, and identity governance. Patch teams close the code issue, but the business owner must confirm exposure was limited and identity teams should validate whether delegated access, sign-ins, or privileged sessions were abused. For regulated environments, evidence of timely triage and access review matters as much as the patch itself.
👉 Read our full editorial: Patch-now SharePoint and Exchange flaws highlight KEV pressure
