Which Patches Actually Matter?

# Which Patches Actually Matter? Listen up. Your inbox is currently a disaster zone of "Critical" alerts and vendor warnings that all sound like they're screaming for your firstborn. If you try to treat every CVE as an emergency, you'll burn out by lunch and leave the door wide open for someone who actually knows how to read a packet capture. I’ve seen this movie before. During NotPetya, the problem wasn't that people didn't have patches; it was that they didn't understand the blast radius of the tools they were ignoring. When you're staring at a list of twenty vulnerabilities, you don't ask "Is this bad?" You ask "What would this cost me on a Tuesday?" Here is how we’re ranking the pile for September 1st. ### The House Is On Fire If you are running PaperCut NG or MF, stop reading this and go fix it. Now. Two vulnerabilities—CVE-2026-82078 and CVE-2026-81578—hit the CISA KEV yesterday, August 31. These aren't theoretical. They are being exploited to get inside. Print servers are the gift that keeps on giving for attackers because nobody remembers they exist until the ransom note appears. They usually have broad network access and terrible logging. If an attacker hits your print server, they aren't looking for a PDF; they’re looking for a path to your domain controller. The federal deadline is September 14, but if you wait two weeks, you're just giving the criminals a head start. ### The "You're Already Late" Pile Then we have the Citrix NetScaler ADC and Gateway (CVE-2026-8452). CISA added this to the KEV on August 26. If you haven't patched this yet, you’ve already missed the federal deadline of August 29. You are currently operating an open door. When a company gets hit through a gateway like this, their PR team always puts out a statement about "sophisticated actors" using "advanced techniques." It's a lie. There is nothing sophisticated about running a known-exploited vulnerability on your perimeter for five days after the deadline. That’s not an advanced attack; it’s basic hygiene failure. ### The Perimeter Buffer Once you've handled the immediate fires, look at your internet-facing middleware. JFrog Artifactory (CVE-2026-66384) and ownCloud (CVE-2023-49105) are on the list. These are high-value targets because they hold the keys to the kingdom—your code, your binaries, your internal docs. If a developer's credentials get leaked via an infostealer, these vulnerabilities provide the bridge for the attacker to move from a stolen session into the actual infrastructure. It’s a second-order effect: you aren't just losing a server; you're potentially poisoning your entire software supply chain. ### The Noise Now, here is the part where I tell you what can wait. You'll see things on your dashboard for the Linux Kernel (CVE-2026-53362 and CVE-2022-0995) or Red Hat Libuser. Unless you are running a highly specific, high-risk configuration where an attacker already has local access, these are not your priority today. The "Critical" CVSS score is a measurement of theoretical severity, not operational risk. A kernel bug that requires local privileges to execute doesn't keep me up at night when there's a remote code execution vulnerability on the NetScaler gateway. Put these in the next scheduled maintenance window. Do not break your production environment on a Tuesday morning for a privilege escalation bug that requires someone to already be logged into the box. I know what you're thinking: "Ray, my uptime SLA says I can't reboot the core gateways without three levels of management approval." That is a convenient excuse until you have to explain to those same managers why 284 million records—like the mess over at McKesson—are currently for sale on a leak site. An SLA is a goal; a breach is a reality. I would rather explain a fifteen-minute scheduled outage than spend six months in a war room trying to figure out how an attacker pivoted from a print server to the payroll database. If you're still unsure where to start, look at the volume of noise. Boston Scientific has been in the news with 30 different stories this week alone because they are still scrubbing their environment after a hit. They didn't get there because of some genius hacker; they got there because someone, somewhere, decided a patch could wait until next quarter. Check your PaperCut versions first. Then check the NetScaler. Everything else is just paperwork.