Briefing
Scan reports rank findings by severity. Severity measures potential impact, not real-world use. A medium-rated flaw under active attack matters more than a critical one nobody exploits.
CISA's Known Exploited Vulnerabilities catalog lists flaws with a CVE ID, reliable evidence of exploitation, and a clear fix. BOD 26-04, issued June 10, 2026, replaced BOD 22-01 for federal agencies and weighs four factors: public exposure, KEV status, whether exploitation can be automated, and how much control it grants. CISA recommends all organizations make KEV remediation a priority. FIRST's EPSS publishes a daily probability that each CVE will be exploited within 30 days.
Together these give a defensible order that small teams can follow and explain to an auditor.
What to do
- Tier 1: KEV and internet-facing. Remediate immediately or remove exposure.
- Tier 2: KEV on internal systems. Remediate next; these are how one compromised account spreads.
- Tier 3: high EPSS on exposed systems. Schedule soon.
- Tier 4: everything else, on the regular patch cycle.
- Maintain an asset inventory and an external exposure list so tiers can be assigned.
- Retire unsupported systems that cannot be patched.
How to verify
- Closure means a clean rescan, not a ticket note.
- Track time from KEV publication to remediation for your exposed assets.
- Keep the written triage procedure with your risk analysis or security program.
Sources
- CISA, Known Exploited Vulnerabilities: criteria and guidance
- CISA, Known Exploited Vulnerabilities catalog
- CISA, BOD 26-04: Prioritizing Security Updates Based on Risk
- CISA, BOD 22-01 (superseded by BOD 26-04)
- FIRST, Exploit Prediction Scoring System (EPSS)
Want help putting this in place? Contact Computer Plus.