The KEV list is the floor, not the ceiling

CISA's Known Exploited Vulnerabilities list is one of the most useful free tools in IT security. It is also easy to misread. A flaw that isn't on the list is not a flaw nobody is attacking. This week showed that clearly.

What the KEV list actually is

CISA adds a vulnerability to the catalogue only when three things are true. It has a CVE number. There is reliable evidence it has been exploited in the wild. And there is a clear fix, such as a vendor update. CISA is explicit that scanning, research and proof-of-concept code don't count as exploitation, and that temporary workarounds don't count as a fix.

Those rules are sensible. They keep the list short, trustworthy and actionable. But they also mean the list will always lag behind what attackers are doing. Evidence has to be gathered and checked before anything is added.

This week's gap

A weekly report from Daily CyberSecurity compared reports of active attacks between 26 October and 1 November against the KEV catalogue as it stood on 30 October. Several flaws seen under attack were not on it:

YOOtheme Pro (a WordPress page builder theme), CVE-2026-102785, rated 10.0. Unit 42 confirmed attacks on 26 October, with PHP web shells hidden in image files. The fix is version 5.0.53.
Oracle E-Business Suite, CVE-2026-101767, rated 9.8. Fixed in Oracle's October update. Defused reported exploratory attacks; Oracle has not confirmed exploitation.
FreeSWITCH, CVE-2026-116779, fixed in 1.11.3.

The report itself notes that these may well be added later. That is the point: "later" can be days after attackers start.

A practical way to triage

I use KEV as the floor, not the ceiling. Here is the order I work through when a batch of advisories lands.

1. Is it on KEV? Patch it now

Anything on the list that you run gets treated as an emergency change, not something for the next monthly window. Federal agencies get deadlines measured in days or weeks for a reason.

2. Is it internet-facing and being reported as attacked? Treat it the same

If a reputable vendor, researcher or threat intelligence team says a flaw is being exploited, and your copy is reachable from the internet, don't wait for CISA. VPN appliances, remote support tools, web apps, phone systems and admin panels all sit in this group.

3. Is there public exploit code? Move it up

A public proof of concept isn't exploitation, but it shortens the time before there is some. This week a working exploit for Linux kernel flaw CVE-2026-31419 was published. It needs local access, so it's less urgent on a single-user server than on a shared host running containers.

4. Everything else goes into the normal cycle

Most CVEs belong here. Patching on a steady monthly rhythm, with good reporting on what didn't install, handles the bulk of the risk.

Know what you run

None of this works without an inventory. The question "do we run YOOtheme anywhere?" should take minutes to answer, not an afternoon of logging into sites. Keep a list of:

every internet-facing service, with its product and version
WordPress sites and the themes and plugins on them
appliances (firewalls, VPNs, NAS boxes, phone systems) and their firmware
remote access and remote support tools

Your RMM tool can cover the endpoints. The appliances and websites are where the gaps usually are.

Exposure matters as much as the patch

The BTCPay Server thefts reported this weekend are a good reminder. The attacker logged in as an administrator, and how they got that access is still unknown. Whatever the route turns out to be, an admin panel that isn't reachable from the internet, or that sits behind a VPN and MFA, is much harder to abuse. The same goes for FreePBX, which patched two critical User Manager flaws this week. If the management page isn't on the internet, a flaw in it is far less urgent.

The short version

KEV tells you what is definitely being attacked. It doesn't tell you everything that is.
Credible reports of attacks on internet-facing kit deserve the same urgency as a KEV entry.
Public exploit code moves a flaw up the queue.
A good inventory turns a scary headline into a five-minute check.
Take admin interfaces off the internet wherever you can.

Sources

← All posts