// #cvss
3 articles
Enterprise Guide: Prioritising the June 2026 Patch Tuesday Across 198 CVEs
Security teams face 198 CVEs from Microsoft's June 2026 Patch Tuesday plus concurrent advisories from SAP, Ivanti, Palo Alto, and CISA. This guide provides a decision framework for prioritising remediation across different infrastructure tiers — from internet-facing servers to workstations — with specific guidance for each of the highest-risk vulnerabilities.
NIST Halts NVD Enrichment for Lowest-Priority CVEs as Submission Volume Surges 263% — Vulnerability Management Impact
NIST has announced it will no longer provide full CVSS scoring, CPE matching, and CWE classification for the lowest-priority tier of CVE submissions in the NVD. The change, driven by a 263% surge in annual CVE volumes since 2024, means thousands of CVE records will remain in an unenriched 'DEFERRED' state — with no CVSS score, no affected product mapping, and no severity rating. Enterprise vulnerability management programmes that rely on NVD as their authoritative source must adapt their workflows immediately.
NIST Ends Full NVD Enrichment — What It Means for Your Vulnerability Management Programme
NIST has announced it will no longer enrich every CVE record in the National Vulnerability Database, shifting to a risk-based model that prioritises only the most critical submissions. With CVE volumes up 263% since 2020 and the NVD backlog now officially unresolvable, security teams that rely on NVD CVSS scores and CPE data for vulnerability prioritisation must urgently adapt their tooling and workflows.
Commentary tagged #cvss
Vulnerability Management Is Failing Because the Volume Is Unmanageable. We Need to Admit It.
The June 2026 Patch Tuesday delivered 198 CVEs from one vendor in one day. Security teams also had to process concurrent critical advisories from SAP, Ivanti, Palo Alto, and CISA on the same day. The volume is not a temporary surge — it is the permanent state of software security. The current vulnerability management model is not designed for this scale and the consequences are being measured in ransomware payments.
CipherWatch Editorial
Security Intelligence Platform
198 CVEs in One Day. Something Has Gone Wrong With How We Do Patch Management.
Microsoft's June 2026 Patch Tuesday drops 198 vulnerabilities in a single Tuesday, including six zero-days and three CVSS 9.8 remote code execution flaws. Meanwhile SAP patches 21 flaws on the same day, Cisco issues a critical advisory, and a Linux kernel PoC goes public. The security community has normalised a monthly event so large that no enterprise team can actually process it — and that normalisation is itself the problem.
CipherWatch Editorial
Security Intelligence Platform
When Everything Is Critical, Nothing Is: The CVSS Severity Inflation Problem
Q2 2026 has produced more CVSS 9.0+ vulnerabilities than most organisations can effectively respond to simultaneously. Part of the problem is the vulnerability itself. Part of the problem is that the CVSS scoring system has drifted toward higher scores over time, reducing the signal value of 'critical' as a triage category.
CipherWatch Editorial
Security Intelligence Platform