How should I prioritize which vulnerabilities to patch first?
Short answer
Patch known exploited vulnerabilities first, especially on internet-facing systems, then flaws with high exploitation likelihood (EPSS) and high severity (CVSS) on important assets. Severity alone produces too many "critical" items to act on.
The details
Keep an accurate asset inventory, because you cannot prioritize flaws in systems you do not know you have.
What to do
- Fix anything in CISA KEV that you run.
- Then internet-facing systems with high EPSS.
- Then high-CVSS flaws on critical internal systems.
- Schedule the rest in regular patch cycles.
Useful next reads and tools
Terms explained
- Patch management
- Patch management is the process of finding, prioritizing, testing and installing software updates that fix security flaws.
- CVSS
- CVSS is a standard maintained by FIRST for rating the technical severity of a vulnerability on a scale from 0 to 10.
- EPSS
- EPSS, maintained by FIRST, estimates the probability that a published vulnerability will be exploited in the wild within the next 30 days.
- Known Exploited Vulnerabilities (KEV)
- CISA’s Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with reliable evidence that attackers are exploiting them.
Sources
Related questions
Related Guides
GuideSOC
6 SOC Functions to Automate With AI Agents (and What to Keep Human)
Which SOC tasks should AI agents handle and which need a human? A function-by-function guide to automation potential, the AI role, the human role and the outcome.
Read more GuideSOC
9 Quick-Win AI Agent Use Cases for Security Operations
Nine high-impact, low-effort SOC tasks to hand to AI agents first, what each agent does and the metric that proves it, plus the tasks to keep human.
Read more GuideWeb Security
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): How to Patch, Mitigate and Detect Attacks
Two critical PHP flaws allow unauthenticated remote code execution. See who is affected, the fixed versions, temporary mitigations and what to watch for in your logs.
Read more GuideSOC
How to Build an Agentic SOC: A 4-Phase Roadmap for AI Security Operations
A practical roadmap for moving a SOC to AI agents: build the data foundation, start with quick wins, customize and orchestrate agents, and keep humans in command.
Read more