The Patch Is Out. You Are Probably Still Exposed.
Last Tuesday, Microsoft patched 974 vulnerabilities in one go. It was the largest Patch Tuesday in history: 723 flaws in Windows, 111 in Office, 62 in SQL, 22 in developer tools, and over 110 rated critical. Two of those flaws were already being exploited before the patch shipped.
Three days later, CISA added five more actively-exploited vulnerabilities to its Known Exploited Vulnerabilities catalog — JFrog Artifactory, ConnectWise ScreenConnect, MikroTik RouterOS. Two of them had been known since early August and were chained together to take admin control of self-hosted Artifactory servers. Wiz saw the active exploitation between August 15 and September 8. JFrog had fixed both flaws before then. Only the servers that hadn’t been updated were vulnerable.
If you felt a flicker of anxiety reading that, you’re paying attention. The problem is not that we don’t patch fast enough. The problem is that we have lost the ability to tell whether a patch even applies to us.
The CVE flood is now structural
In the first half of 2026 alone, 35,853 CVEs were published — roughly 49% more than the same period in 2025, per Picus Security’s mid-year analysis. AI-assisted vulnerability research has accelerated discovery on the defender side, which is good news in theory. In practice, it means security teams are now staring at a queue that grows faster than they can triage it. The median organization cannot realistically patch every critical CVE in any given month. They have never been able to. But the gap between “vulnerability disclosed” and “vulnerability exploitable on my network” has gotten harder to close.
This is why two camps have emerged. One camp still treats every critical CVE as an emergency. They patch and patch and patch, and their IT teams burn out, and they still miss things because the queue is longer than the runway. The other camp has quietly given up: they only patch what their scanner flags, and the scanner is missing half of what is actually exploitable. A third camp, the one I think most security professionals are quietly migrating to, has decided that the right question isn’t “is this CVE critical?” but rather “is this CVE on a path to anything I actually care about?”
That question (exposure validation) is the work of 2026.
What changed
A scanner reports a CVE. It might be a 9.8 in your environment. Your heart rate spikes. You open a change ticket, get a maintenance window, test the patch, deploy it, and document the closure. Three hours of work for one CVE. Multiply by a thousand.
But here’s what the scanner didn’t tell you: that CVE lives in a service running on a host inside a network segment with no inbound internet access, that no employee account has credentials for, that has no data an attacker would want. The 9.8 is real in the abstract, but it is not on any attack path to anything that matters. The urgent thing was a lie. The thing that is actually urgent is somewhere else: a “medium” CVE on a print server that the scanner ranked low because it was old, but that an attacker reached through a contractor’s VPN account last week.
BreachLock’s research on this gap is worth sitting with. A critical-rated CVE that sits behind strong segmentation, identity controls, and credential hygiene creates a different risk profile than the same CVE on an internet-exposed endpoint with default credentials. The first is theoretically exploitable and practically hard. The second is exploitable by anyone who can read a Shodan query. Most scanner dashboards do not make that distinction. Most security teams do not have the time to make it manually for thousands of CVEs per quarter.
The attacker side of the same coin
Attackers are not running scanners. They are running exploit chains. The JFrog Artifactory attack Wiz documented is a clean example: an attacker chained two flaws that JFrog had already patched. The exploit window opened the day the patches shipped and stayed open until each server got updated. Servers that updated were safe. Servers that didn’t, even if they “thought” they had applied the patch, or thought they didn’t run Artifactory, or thought their scanner would have caught the wrong version, were owned.
Cisco disclosed the same pattern last week around its Secure Firewall Management Center. CVE-2026-20079, a CVSS 10.0 authentication bypass, was patched in July. By September, three distinct threat clusters had been observed exploiting it in the wild, including one linked to the Qilin ransomware crew. N-able’s N-central CVE-2026-86218, also a CVSS 10.0 pre-auth remote code execution, was added to KEV the same week. The FBI, CISA, and every vendor on earth had screamed about it. Servers that hadn’t been updated were owned.
This is the asymmetry. Attackers can move on a window of hours or days. Defenders have to move on a window of weeks because of change-control windows, testing, and the sheer volume. Closing that asymmetry means shrinking the patch window for what matters and accepting that not everything matters equally.
What exposure validation looks like in practice
Exposure validation is the discipline of answering “am I actually vulnerable to this CVE, on this asset, in this configuration, reachable from anything an attacker can touch?” before patching. The practice usually combines three things: a continuous asset and configuration inventory that knows what software is actually running (not what you think you installed); an attack-path model that can reason about network segmentation, identity, and credential relationships; and some form of safe-to-run adversary simulation that confirms the exploit works (or doesn’t) against your real environment, not the theoretical one.
For most small and mid-sized businesses, that’s a lot of jargon for “buy one of the commercial exposure validation platforms and turn it on.” Tenable, CrowdStrike, Wiz, and a half-dozen newer entrants all have products aimed at exactly this problem. They cost real money: the SMB-friendly end of the market is roughly $30K-$80K per year for a few hundred assets. For a business that has been getting breached every eighteen months because patching is chaos, that math works. For a business that has been getting breached because the attacker phished a finance clerk, no exposure validation platform in the world is going to help. The first move is always knowing what you are trying to defend.
For organizations that can’t justify a commercial platform, the same idea works in stripped-down form: maintain an actual software inventory (not an assumed one); check CISA’s KEV catalog weekly, not monthly; treat anything in KEV as a 72-hour change-control window regardless of CVSS; and run an annual pen test that includes exploit verification, not just vulnerability enumeration.
Five things to do this week
- Pull the current CISA KEV catalog and compare it against your asset inventory line by line. Not “we have something from Cisco.” Which Cisco. Which version. Is it patched. Today, not next sprint.
- Identify the three to five internet-exposed services in your environment and verify each one’s current version against the vendor’s latest security advisory. The JFrog attackers did not use a zero-day. They used two-month-old patches against servers that hadn’t been applied.
- Audit your change-control windows. Anything longer than seven days for an actively-exploited vulnerability is an acceptance of risk that should be on paper, signed by someone who can lose their job over it.
- Stop measuring patching success by “vulnerabilities closed this month.” Start measuring it by “mean time to remediate KEV entries” and “percentage of KEV entries closed within the CISA deadline.” That number is what your insurer, your auditor, and your lawyer will eventually ask for.
- Run one honest exposure-validation exercise this quarter, even a tabletop. Pick one CVE from this week’s news. Trace it: is the vulnerable software present? Reachable? Authenticated? With credentials any attacker could obtain? Whatever your honest answer is, that is the actual risk on your network right now.
The patch is the easy part. Knowing whether it matters is the part most teams are skipping. That gap is where the breaches are coming from in 2026, and it is not going to close itself.
