1,746 CVEs Are Being Actively Exploited: Why ‘Patch Everything’ Fails and Risk-Based Prioritization Wins

You cannot patch every vulnerability at once. You can make sure the most dangerous ones are not waiting at the back of the queue.

As of October 16, 2026, CISA’s Known Exploited Vulnerabilities (KEV) catalog lists 1,746 vulnerabilities known to have been exploited in the wild. That is the catalog’s current count, not a count of vulnerabilities affecting every organization, or proof that all 1,746 are being exploited at this moment. The catalog changes over time, so teams should check it regularly rather than treat the number as fixed.

The practical lesson is clear: a patch program cannot simply chase every finding. It needs a consistent way to identify which vulnerabilities present the greatest risk to your systems, and get those addressed first.

WHY CVSS ALONE DOESN’T SET YOUR PATCH QUEUE

The Common Vulnerability Scoring System (CVSS) describes the technical severity of a vulnerability. It helps teams understand a flaw’s potential impact and exploitability under defined conditions. But a CVSS base score does not tell you whether attackers are exploiting that vulnerability in the wild, whether it affects an asset in your environment, or how exposed that asset is.

That distinction matters. A hypothetical CVSS 9.8 flaw on a well-segmented internal development server, with no sensitive data or production credentials, may warrant attention, but it could be a lower immediate risk than a CVSS 7.5 flaw on an internet-facing VPN appliance that appears in CISA’s KEV catalog.

The National Vulnerability Database explains CVSS as a severity measure, not a complete risk assessment. Use the score as one input. Do not mistake it for the whole decision.

ADD EXPLOIT LIKELIHOOD WITH EPSS

The Exploit Prediction Scoring System (EPSS) provides another useful signal. Maintained by FIRST, EPSS estimates the probability that a published CVE will be exploited in the wild within the next 30 days. It publishes a score from 0 to 1 for each CVE, updated daily.

EPSS is a probability estimate, not a guarantee. A very low score does not mean a vulnerability can never be exploited, and a high score does not prove an attack against your organization is underway. But it helps teams compare vulnerabilities and direct limited remediation capacity toward flaws more likely to be targeted.

You can review EPSS’s methodology and limitations, use its guidance for applying scores, and access daily data.

BUILD A PRIORITY FROM LAYERS OF EVIDENCE

A practical vulnerability queue combines multiple signals instead of sorting by one score. For each finding, consider:

KEV status: Is there reliable evidence of exploitation in the wild? KEV presence should sharply increase urgency.
EPSS: How likely does the current model estimate exploitation within the next 30 days? Check the latest score, since it changes daily.
Asset exposure: Is the affected system internet-facing, reachable through remote access, or isolated behind internal controls?
Asset criticality: Does it support identity, customer services, sensitive information, production operations, or business continuity?
Business context: Are there compensating controls, a safe patch window, an available vendor fix, or a compliance deadline? Does the system connect to higher-impact assets?

This layered approach helps teams explain not just which item is first, but why. CISA likewise recommends using its KEV catalog as an input to vulnerability prioritization.

A WORKED EXAMPLE: THREE FINDINGS, THREE DIFFERENT DECISIONS

Consider these hypothetical findings. The CVSS and EPSS details are illustrative examples, not claims about specific CVEs.

1. Patch or mitigate the VPN vulnerability first. It is reachable from the internet and listed in KEV, meaning there is evidence of exploitation in the wild. Confirm affected versions, apply the vendor’s fix or mitigation, and assess whether the appliance shows signs of compromise. A strong CVSS score is not required to make this urgent.

2. Move quickly on the domain controller. Its high EPSS score signals elevated predicted exploitation likelihood, while its identity role makes the potential business impact significant. Validate exposure, check for a patch or compensating control, and set a rapid remediation window. If it is externally reachable or there is evidence of attempted exploitation, escalate it immediately and handle the VPN and domain-controller work in parallel if resources allow.

3. Schedule the development-server issue based on its actual containment. CVSS 9.8 indicates a severe flaw, but the assumed low EPSS and internal, segmented location may lower its immediate priority relative to the other two. Verify that the segmentation is effective, confirm that the server holds no production secrets or sensitive data, and set a remediation deadline. If those assumptions prove wrong, reassess the ranking.

This is not a universal ordering. A finding’s priority can change when exposure, evidence of compromise, business dependencies, or available mitigations change. Keep the reasoning documented, then revisit it as new information arrives.

REPORT EXPOSURE REDUCTION, NOT JUST FINDING COUNTS

Raw totals are easy to collect and easy to misread. A larger vulnerability count may mean the team discovered more assets, improved scanning coverage, or added new systems, not necessarily that business risk increased. A smaller count can also be misleading if critical assets were missed.

Give leadership a view of whether meaningful exposure is going down. Useful measures include:

The number of KEV-listed vulnerabilities open on exposed or critical assets
The number of high-priority findings past their remediation deadlines
The time it takes to close or mitigate vulnerabilities in agreed priority bands
The percentage of fixes validated by a follow-up scan
The number of assets still exposed without an effective compensating control
Documented exceptions, owners, and target dates

Show trends over time, explain significant changes, and distinguish an actual remediation from a risk acceptance or temporary mitigation. The goal is a clearer account of what exposure remains and what the organization is doing about it, not a green dashboard created by counting differently.

TURN PRIORITIZATION INTO A REPEATABLE PROCESS

A useful vulnerability program connects discovery to verified remediation. That means keeping an accurate asset inventory, matching findings to the affected systems, enriching them with current threat and severity information, assigning owners, tracking deadlines, and validating the result after the fix.

That is the approach behind Cenova Cyber’s Vulnerability Management as a Service (VMaaS). VMaaS combines recurring internal and external scanning with risk-based prioritization, remediation coordination, and validation reporting. Findings are assessed with exploit-probability data, asset criticality, and business context, not CVSS alone.

The outcome is a prioritized risk register and a remediation process your team can follow, not just another scan report. Your staff can focus on the vulnerabilities most likely to affect the business, while progress is tracked and fixes are checked.

Contact Cenova Cyber to book a free vulnerability management consultation. We’ll help you understand where your exposure stands, what to address first, and how VMaaS can support a more measurable, risk-based patching program.