// #patch-management
20 articles
HTTP.sys CVE-2026-47291: Quantifying Wormable Risk Across the Windows Server Estate
Three days after the June Patch Tuesday, CVE-2026-47291 in HTTP.sys remains unpatched on a significant proportion of enterprise Windows Server infrastructure. This article maps the attack surface — which services expose HTTP.sys, how the worm propagation would function, and what network controls reduce the blast radius while patching is in progress.
Enterprise Guide: Prioritising the June 2026 Patch Tuesday Across 198 CVEs
Security teams face 198 CVEs from Microsoft's June 2026 Patch Tuesday plus concurrent advisories from SAP, Ivanti, Palo Alto, and CISA. This guide provides a decision framework for prioritising remediation across different infrastructure tiers — from internet-facing servers to workstations — with specific guidance for each of the highest-risk vulnerabilities.
Windows Server Fleet Patching After June Patch Tuesday: Managing Velocity and Risk in Large Environments
After the largest Microsoft Patch Tuesday of 2026, enterprise teams face the challenge of patching Windows Server fleets at emergency speed while avoiding the outages that come with untested updates. This article addresses patch deployment sequencing, testing compression strategies, and rollback planning for the June 2026 emergency patch cycle.
CISA KEV June 2026 Tracker: Vulnerability Additions, BOD 22-01 Deadlines, and Remediation Priorities
The CISA Known Exploited Vulnerabilities catalogue added three entries in the first week of June 2026, including the Oracle WebLogic deserialization vulnerability (CVE-2024-21182) and the Mirasvit Magento RCE (CVE-2026-45247). This tracker consolidates the June additions with their remediation deadlines and documents the patch availability status for each.
Verizon DBIR 2026: Vulnerability Exploitation Surpasses Phishing as Top Initial Access Vector — Enterprise Implications
Verizon's 2026 Data Breach Investigations Report, published mid-May, documents a structural shift in breach methodology: vulnerability exploitation has overtaken phishing as the most common initial access pathway in analysed breaches. The shift reflects a maturing attacker ecosystem that increasingly uses automated exploit delivery rather than requiring human interaction. Enterprise security programmes built around phishing awareness need recalibration.
Linux Kernel Patch Management as Asset Security: Why CVE-2026-46243 Exposes the Kernel Update Gap
The CVE-2026-46243 disclosure — a 19-year-old kernel flaw with a public root exploit and distribution patches already available — is a useful lens for examining how enterprises manage Linux kernel versions as security-relevant assets. Many organisations have robust patch management for applications but inconsistent processes for kernel updates, particularly on specialised infrastructure like database hosts and container nodes.
Android Enterprise Patch Management: Closing the Gap Between Google's Bulletin and Fleet-Wide Coverage
The June 2026 Android Security Bulletin — which includes an actively exploited zero-day — highlights a structural challenge for enterprise Android fleet management: Google publishes a patch, but enterprise coverage depends on OEM update timelines, carrier approval processes, and EMM deployment policies that can extend the effective exposure window by weeks. This guide covers a practical approach to managing the gap.
CISA KEV May 2026: Complete List of Known Exploited Vulnerabilities Added This Month and Enterprise Response Guidance
CISA's Known Exploited Vulnerabilities catalogue received multiple additions in May 2026, including developer toolchain supply-chain compromises, network appliance vulnerabilities, and Microsoft Windows flaws. This guide consolidates the May 2026 KEV additions with enterprise response guidance for each category.
May 2026 Vulnerability Retrospective: Patch Prioritisation Guide for Enterprise Security Teams
May 2026 produced an unusually dense cluster of high-severity vulnerabilities: Netlogon CVSS 9.8, Ubiquiti CVSS 10.0 × 3, AMD Zen 2 CVSS 8.8, golang/crypto CVSS 10.0, Linux ptrace four-exploit-chain. This retrospective ranks them by risk for organisations still working through the patching backlog.
Apple's Retroactive CVE Disclosure Practice Creates Systematic Gaps in Enterprise Patch Management
Apple's habit of retroactively adding CVE details to previously published security advisories creates operational complexity for enterprise vulnerability management programmes: vulnerabilities appear as 'new' in CVE feeds after they have already been patched in deployed OS versions, generating false-positive remediation workflows and obscuring the true patch state of Apple endpoints.
Apple Retroactively Publishes CVE Details for macOS, iOS, and visionOS — Including Root Escalation and Siri Privacy Bypass
Apple updated multiple security pages on 26 May to add CVE identifiers and technical details for vulnerabilities that were patched weeks or months earlier with minimal public disclosure. The retroactively disclosed issues include a CoreServices root escalation via malicious app, a Siri Private Browsing bypass, and a call history fingerprinting flaw — none were disclosed as separate security updates at the time of patching.
The Pwn2Own 90-Day Clock: How Defenders Should Use the Patch Window Before Public Disclosure
Pwn2Own's 90-day coordinated disclosure rule gives vendors time to patch before technical details are made public. For enterprise defenders, the same 90 days is a known timeline during which the confirmed existence of specific zero-days — but not their technical details — is public. Understanding how to use that window is an underexplored aspect of enterprise vulnerability management.
Red Hat Enterprise Linux LPE at Pwn2Own: What the Results Mean for Enterprise Linux Patch Strategy
Red Hat Enterprise Linux was successfully exploited twice at Pwn2Own Berlin 2026 via local privilege escalation vulnerabilities. For enterprise security teams running RHEL, and the broader family of RHEL-derived distributions including CentOS Stream, Rocky Linux, and AlmaLinux, the results inform how Linux patching SLAs should be evaluated against the demonstrated threat model.
CISA KEV Additions: Windows Shell Spoofing CVE-2026-32202 and Cisco SD-WAN Sensitive File Exposure CVE-2026-20133
CISA's late-April Known Exploited Vulnerabilities additions include a Windows Shell protection mechanism failure under active exploitation and a Cisco Catalyst SD-WAN Manager flaw allowing unauthenticated access to sensitive OS files. Federal agencies face a May 12 remediation deadline for CVE-2026-32202; enterprise organisations should treat both additions as confirmation of active threat actor interest and patch accordingly.
NIST Halts NVD Enrichment for Lowest-Priority CVEs as Submission Volume Surges 263% — Vulnerability Management Impact
NIST has announced it will no longer provide full CVSS scoring, CPE matching, and CWE classification for the lowest-priority tier of CVE submissions in the NVD. The change, driven by a 263% surge in annual CVE volumes since 2024, means thousands of CVE records will remain in an unenriched 'DEFERRED' state — with no CVSS score, no affected product mapping, and no severity rating. Enterprise vulnerability management programmes that rely on NVD as their authoritative source must adapt their workflows immediately.
Microsoft Issues Emergency Patch KB5091157 After April Updates Crash Domain Controllers
Microsoft's April 2026 Patch Tuesday updates triggered LSASS crash-reboot loops on non-Global Catalogue domain controllers in PAM-enabled deployments and forced some Windows Server 2025 systems into BitLocker recovery mode. Emergency out-of-band updates were released April 19 for all affected Server versions. Immediate installation is required — affected DCs cause complete authentication outages across their domains.
CISA Adds Quest KACE (CVSS 10.0), Kentico Xperience, and Zimbra ZCS to Known Exploited Vulnerabilities — Federal Deadline May 4
CISA's April 2026 KEV additions include a CVSS 10.0 unauthenticated SQL injection in Quest KACE Systems Management Appliance, active exploitation of Kentico Xperience CMS, and Zimbra Collaboration Suite vulnerabilities. Federal agencies have a May 4 remediation deadline; enterprise organisations should treat confirmed KEV additions as indicators of active attacker tooling and prioritise these systems immediately.
SAP BPC SQL Injection (CVE-2026-27681, CVSS 9.9) Gives Low-Privilege Users Full Access to Financial ERP Data
A near-perfect CVSS 9.9 SQL injection vulnerability in SAP Business Planning and Consolidation and BW/4HANA allows any authenticated user with standard access to read, modify, and delete financial consolidation data. SAP patched the flaw in its April 2026 Security Patch Day; organisations should treat unpatched SAP financial systems as having their financial data integrity at risk from any internal user with SAP credentials.
CISA Adds Seven CVEs to KEV Including Decade-Old Microsoft Bugs Exploited by Storm-1175
CISA has added seven vulnerabilities to the Known Exploited Vulnerabilities catalogue, including four Microsoft flaws spanning from 2012 to 2025 being actively leveraged by the Storm-1175 ransomware group. The additions highlight a persistent patching blind spot: vulnerabilities patched years ago that never made it into legacy system maintenance cycles, now routinely weaponised for initial access and privilege escalation.
March 2026 Patch Cycle: The Governance and Risk Metrics That CISOs Should Be Reporting
March 2026 has been an unusually demanding patch cycle — 83 Microsoft CVEs, three new CISA KEV additions across F5, Citrix, and Active Directory, and concurrent exploitable vulnerabilities across Linux, PAN-OS, and Dell hardware. CISOs face board-level questions about patching velocity and exposure windows. This analysis provides the governance framework and risk metrics to answer those questions accurately.
Commentary tagged #patch-management
Vulnerability Management Is Failing Because the Volume Is Unmanageable. We Need to Admit It.
The June 2026 Patch Tuesday delivered 198 CVEs from one vendor in one day. Security teams also had to process concurrent critical advisories from SAP, Ivanti, Palo Alto, and CISA on the same day. The volume is not a temporary surge — it is the permanent state of software security. The current vulnerability management model is not designed for this scale and the consequences are being measured in ransomware payments.
CipherWatch Editorial
Security Intelligence Platform
198 CVEs in One Day. Something Has Gone Wrong With How We Do Patch Management.
Microsoft's June 2026 Patch Tuesday drops 198 vulnerabilities in a single Tuesday, including six zero-days and three CVSS 9.8 remote code execution flaws. Meanwhile SAP patches 21 flaws on the same day, Cisco issues a critical advisory, and a Linux kernel PoC goes public. The security community has normalised a monthly event so large that no enterprise team can actually process it — and that normalisation is itself the problem.
CipherWatch Editorial
Security Intelligence Platform
VPN Gateways Are Where Ransomware Gets In. CVE-2026-50751 Is Not the Last One.
Check Point CVE-2026-50751 joins a long list of critical authentication bypass and remote code execution vulnerabilities in enterprise VPN gateways that have been exploited in ransomware campaigns. The pattern is consistent enough that it is no longer useful to treat each as a one-off incident — it is a structural category of risk that requires a structural response.
CipherWatch Editorial
Security Intelligence Platform
CVE-2026-46243 and the Enterprise Linux Kernel Patch Lag Problem
The 19-year latency of CVE-2026-46243 makes headlines. What is less discussed is the operational lag between 'patch available' and 'patch applied' across enterprise Linux fleets. Distribution advisories are published. Patched kernels hit repositories. And then organisations schedule the reboots — often weeks later. CVE-2026-46243 is not unusual in its severity; it is unusual in making the patch lag visible.
CipherWatch Editorial
Security Intelligence Platform
Oracle's Quarterly CPU and the Enterprise Java Patching Culture That Makes WebLogic Vulnerabilities Sticky
CVE-2024-21182 was patched in January 2024. It reached the CISA KEV in June 2026. The 18-month gap is not unique to this CVE — it reflects how enterprise Java middleware is patched in practice, which is to say: slowly, incompletely, and often only under direct pressure.
CipherWatch Editorial
Security Intelligence Platform
65 Days Unpatched: The Citrix NetScaler Exploitation Pattern Nobody Has Solved
CVE-2026-3055 was patched in March. In late May, Fortinet confirms large-scale exploitation of thousands of unpatched NetScaler appliances. This cycle has repeated with every major Citrix vulnerability for years. The gap between patch availability and patch deployment on network appliances is a structural problem with a known solution that the industry is not implementing.
CipherWatch Editorial
Security Intelligence Platform
Apple's CVE Transparency Problem Is Also the Industry's CVE Transparency Problem
Apple routinely patches vulnerabilities without disclosing CVE IDs, adding them retroactively weeks later. This is criticised as a transparency failure. But Apple is not uniquely bad at this — it is doing what the industry's incentive structure rewards.
CipherWatch Editorial
Security Intelligence Platform
The 90-Day Patch Clock Is a Threat Actor Countdown Timer — We Should Use It That Way
Pwn2Own's 90-day coordinated disclosure window is designed to give vendors time to patch. But for enterprise defenders, it is also a confirmed, public notice that specific classes of zero-day vulnerability exist in named products. Most organisations wait for the patch to act. The ones that prepare during the 90-day window have a meaningful advantage.
CipherWatch Editorial
Security Intelligence Platform
Pwn2Own Proves the Software Is Breakable. Enterprise Patching Pretends It Isn't.
Pwn2Own Berlin Day 1 saw Windows 11 compromised three separate times, Edge's sandbox escaped, and two hypervisors defeated. Vendors will patch the reported bugs within 90 days. The enterprise response to Pwn2Own results is almost universally: nothing. We treat demonstrated zero-days as vendor problems until they become CVEs, and we treat CVEs as patch management problems until they become incidents.
CipherWatch Editorial
Security Intelligence Platform
The Patch-to-Exploit Window Has Collapsed — cPanel in 48 Hours Is Not an Anomaly, It's the New Baseline
The 'Sorry' ransomware group compromised 44,000 cPanel servers within 48 hours of a critical patch release. The industry still plans patch cycles in weeks. These two realities are incompatible, and the gap between them is where organisations keep getting destroyed.
CipherWatch Editorial
Security Intelligence Platform
AI Has Learned to Find Bugs Faster Than We Can Fix Them
Claude Mythos discovering thousands of zero-days confirms what was already theoretically obvious: AI vulnerability research is orders of magnitude faster than human-paced remediation. The industry's response — private disclosure programmes — is a delay mechanism, not a solution to the structural asymmetry between discovery speed and patch deployment speed.
CipherWatch Editorial
Security Intelligence Platform
Patch Tuesday Is Not a Patching Programme
Every second Tuesday, the industry runs a collective sprint to triage, test, and deploy hundreds of Microsoft patches before the next cycle begins. We call this a patching programme. It isn't. It's a treadmill — and the real security question is whether we're measuring the right thing.
CipherWatch Editorial
Security Intelligence Platform
The KEV List Is Not a Vulnerability Management Strategy
CISA's Known Exploited Vulnerabilities catalogue has become the de facto patch priority list for thousands of organisations — most of whom had no coherent strategy before it arrived. Treating the KEV list as a vulnerability management programme is a category error that leaves organisations systematically exposed to everything that has not yet been exploited.
CipherWatch Editorial
Security Intelligence Platform