Less panic patching, more precision
Summary: Cisco Talos's Threat Source newsletter argues that CVSS, the default severity score for over a decade, answers only how bad a vulnerability could be in theory, not how likely it is to be exploited, and that patch queues sorted purely by CVSS spend finite operations capacity on hypotheticals. It recommends pairing CVSS with EPSS, a 0.0-to-1.0 probability that a CVE will be exploited in the next 30 days, and points to GCVE as a decentralized alternative to CISA's KEV catalog, which the author describes as structurally centralized and scoped to U.S. federal visibility.
What you should know: A CVSS 9.8 that nobody is exploiting and a CVSS 7.2 being weaponised in the wild this morning land in the same place on a severity-sorted queue, and the author's point is that triage logic alone decides which one your team sprints on at 2:00 a.m.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026