Patch by Exploitation, Not CVSS

Of 8,060 critical CVEs published between 1 January and 22 September, 85 were in CISA's Known Exploited Vulnerabilities (KEV) catalog, and so were 15 medium-severity ones, so a patch queue sorted by CVSS score puts some actively exploited flaws behind thousands that nobody is using.⁠¹ If you run internet-facing assets, match your inventory against KEV this week and move every hit into a 72-hour lane; sort everything else by exploitability, exposure, control and fix availability.

A CVSS-sorted queue buries exploited flaws

Measured Between 1 January and 22 September, 70,686 CVEs (Common Vulnerabilities and Exposures records) were published, 8,060 were rated critical, and 161 were known to be exploited, according to Peter Bassill's analysis of National Vulnerability Database (NVD), EPSS, KEV and Exploit-DB data. Of the critical ones, 85 were in KEV and 36 more had a public exploit, about 1.5%. A further 7,162 showed no exploitation, no public exploit and an EPSS score (FIRST's estimate of exploitation likelihood in the next 30 days) under 1% or none at all.⁠¹

Fifteen medium-severity CVEs were in KEV and 20 more had a public exploit. A queue sorted by CVSS (Common Vulnerability Scoring System) puts those 35 behind 36,436 critical and high findings.⁠¹ Defenders are also losing ground on remediation: only 26% of KEV-listed vulnerabilities were fully remediated in 2025, down from 38%, and the median time to remediation rose to 43 days. Those are the 2026 Verizon DBIR figures as Tenable relays them from CISA's blog.⁠²

Release days make the sorting problem worse, because Microsoft's record Patch Tuesday lands a large batch of security patches at once and a score-only queue cannot tell which of them matter.

Severity says how bad a flaw would be; KEV says someone is already using it.

CISA stopped using one deadline for every exploited flaw

Reported CISA's Binding Operational Directive (BOD) 26-04, issued 10 June, replaced BOD 22-01's flat remediation deadline for every KEV entry with four yes-or-no questions. Is the asset publicly exposed, is the flaw in KEV, can an attacker automate exploitation, and does exploitation give total or partial control? The answers set one of five deadlines: three days with forensic triage, three days, 14 days, 60 days, or fix at the next system upgrade.⁠²

In a pilot at one large civilian agency, CISA found 1% of vulnerability instances in the three-day tier and more than 60% in the deferral tier. The directive binds federal civilian agencies only, but CISA encourages private-sector adoption.⁠² It is risk-based vulnerability management turned into a deadline table, and a small team can copy the logic without copying the paperwork.

Four questions sort a small team's queue

Opinion I would run three lanes adapted from CISA's tiers. Exploited and exposed, or exploited on a management system, gets 72 hours and a compromise check. Exploited but internal, or critical, exposed and not yet reported exploited, gets 14 days. Everything else goes through your normal vulnerability management cycle. Within each lane, order by CVSS.

Never let a low EPSS score delay a KEV entry. By Bassill's count, 61 of this year's 161 KEV CVEs had an EPSS score under 10%, because the model often catches up only after active exploitation begins.⁠¹ Use EPSS to order the calm majority and to pick next window's list. That is the whole of vulnerability prioritization for a team without a dedicated analyst.

Edge security appliances belong at the top of the second question. Our coverage of Citrix and Ivanti edge zero-days is about gateways reachable from the internet, and GlobalProtect exploitation linked to ransomware covers what can follow when an exposed VPN gateway is exploited.

Applying the four questions to this week's GitLab and Cisco entries

Reported CISA added GitLab CVE-2026-97229 (CVSS 10.0, remote code execution) and Cisco CVE-2026-76418 (CVSS 8.6, firewall reload) to KEV on 29 October.⁠³⁠⁴ The details of GitLab and Cisco's exploited vulnerabilities are in our separate write-up. GitLab's 21 October release also fixes CVE-2026-110264, another CVSS 10.0 flaw, and GitLab's notice does not mention exploitation of it.⁠⁵

Opinion GitLab CVE-2026-97229 goes first. It is exploited, it sits on a server holding source code and CI/CD secrets, and Rapid7's lab route needs only a public project, so open sign-up makes it reachable.⁠³ The Cisco flaw goes second. It is exploited and exposed, but Cisco describes only a reload, a denial-of-service (DoS) outcome, and a vendor mitigation exists today.⁠⁴ CVE-2026-110264 has the same 10.0 score as the exploited flaw but no exploitation report. It still gets handled today because the fixed GitLab builds close both.⁠⁵

Fix availability changed that decision, not the score.

What we don't know: I could not open CISA's directive or its KEV feed. The BOD 26-04 details come from Tenable's FAQ, and the secondary summaries I read disagree on whether the three-day tier requires public exposure, so check Table 1 in the directive before copying its tiers. Bassill's counts are as of 22 September and count only Exploit-DB for public exploits, so they undercount exploitation. KEV lists confirmed exploitation, and absence from it is not proof of safety.⁠¹⁠²

Set up the triage in an afternoon

1. List every internet-facing system, and mark the ones that manage other systems: firewall and VPN gateways, remote support, backup, identity, source control and CI/CD.⁠¹
2. Pull CISA's KEV JSON feed weekly and match its entries against the vendors and products in your inventory.⁠¹
3. Put any KEV match on an internet-facing or management system into a 72-hour lane. Run forensic triage before you close the ticket if the flaw gives an attacker full control, as CISA requires of agencies for those entries.⁠²
4. Put KEV matches on internal systems, and critical flaws on exposed systems with no exploitation report, into a 14-day lane.
5. Review flaws with an EPSS score of 10% or more at the next change window, and keep the rest in your normal cycle.⁠¹
6. Read the vendor advisory for the first fixed build. Where none exists, apply the vendor mitigation and set a date to replace it with the security patch, because Cisco's own mitigation for CVE-2026-76418 weakens VPN login.⁠⁴
7. Re-rank when a status changes: a CVE entering KEV moves to a faster lane immediately, as BOD 26-04's timelines do.⁠²

Revisit when CISA revises Table 1 of BOD 26-04, or when a flaw in your queue enters KEV.