Scanners hand us CVEs, and a CVE is not something anyone can fix. What actually gets patched is a particular version of a particular component on a particular host with a particular route to it. One advisory can land on an internet-facing gateway, an isolated lab appliance, a library that ships in the image but is never invoked, and a container that has not been scheduled in months. Same identifier, four different answers to whether anybody should be paged.
So the row in our queue is a pair: the vulnerability and the instance. Everything downstream depends on that choice, because a clock and an owner can be attached to an instance and cannot honestly be attached to an identifier.
The CISA KEV catalog is the best available evidence that a vulnerability is being exploited in the wild, and it is published as machine-readable data with a schema, so it belongs in a pipeline rather than in a spreadsheet someone refreshes monthly. What it does not tell us is whether the vulnerable function is reachable here. KEV is the threat half of the join. Exposure is the half we have to prove ourselves, from an external vantage point, through the load balancers, proxies, partner links and management planes that actually carry traffic.
CVSS is useful in the same partial way. Version 4.0 separates Base, Threat, Environmental and Supplemental metric groups, and Base is explicitly intrinsic severity under standardized assumptions. A queue built on the Base number alone keeps the one part of that structure which knows nothing about our environment and discards the vector that explains the attack path. We store the vector, the version and the source. Two findings with an identical score can require completely different sequencing, and the vector is where that shows up.
CISA's BOD 26-04, issued in June 2026, moved federal prioritization off the earlier flat KEV-centered model onto asset exposure, KEV status, exploit automation and post-exploitation technical impact. It binds covered federal agencies and not us. We borrowed the decision variables anyway, because those four are the questions triage was already arguing about without naming them.
Two things fail quietly after that.
The first is the claim that something is not reachable. A package can be installed without its vulnerable code path ever being called, and VEX exists to say exactly that. We treat it as a control with an expiry rather than as a deletion. The record carries the path that was tested and the time it was tested, because a feature flag, a dependency bump or a routing change can make yesterday's analysis false without anyone touching the vulnerable code.
The second is closing a finding on a mitigation. A firewall rule can remove the route today and leave the vulnerable software in place for the next topology change or the next internal compromise to reach. Mitigation lowers urgency and does not close the row. The row closes when the changed state is independently verified on every affected instance, which means a rescan, an image inspection or a configuration check, not a ticket transition.
NIST SP 800-40 Rev. 4 frames patching as enterprise preventive maintenance rather than emergency response, and that framing is the part most teams under-invest in. The way to survive a compressed clock is to make ordinary change safe, observable and reversible long before the clock starts.
The full write-up on our own site covers the rest: the decision bands and the evidence each one requires, the treatment table from patch through isolation to time-bound acceptance, when the clock is allowed to start, and what closure verification looks like on each path.
Prioritize Patching With CISA KEV and Local Exposure, Not CVSS Alone
Written by the engineering team at Edilec.
Top comments (0)