What Should You Patch First?

# What Should You Patch First? The Tuesday afternoon patching cycle is usually a race toward an arbitrary deadline, driven by CVSS scores that tell us how bad a vulnerability *could* be in a vacuum. It rarely tells us what is actually happening on the wire. When a dashboard lights up with twenty "Critical" alerts, the instinct is to panic-patch everything. That's a recipe for operational instability and burnout. The only logical way to triage is by exploitability path: exploited-in-the-wild first, internet-facing second, and internal dependencies last. At the top of the list this week are the additions to the CISA Known Exploited Vulnerabilities (KEV) catalogue. These aren't theoretical risks; they're active fires. The Cisco Secure Firewall Management Center (FMC) vulnerability (CVE-2026-20316), added on 2026-07-29, is particularly egregious because it involves a hard-coded password. This isn't complex tradecraft; it's an open door. If you're running FMC, this is your priority zero. Similarly, the Fortinet FortiOS flaw (CVE-2025-68686) and the Arista VeloCloud command injection (CVE-2026-16812) demand immediate attention. The Arista vulnerability was especially aggressive, with a federal patch deadline of 2026-07-30—a window of just 3 days. When the gap between disclosure and mandate is that small, it's usually because the attackers are already moving faster than the bureaucrats. This brings me to the tradecraft of persistence, which is where this week's Microsoft OWA flaw (CVE-2025-66376) fits in. There are reports that Russian actors are using this to maintain mailbox access even after a victim rotates their credentials. This is a crucial detail. Most security teams treat a password reset as a "kill switch" for an active compromise. In this case, it's an illusion of safety. The attacker isn't relying on the password; they're relying on the session. My confidence that this specific persistence mechanism is being used by Russian state-sponsored groups is moderate. I'm basing this on early telemetry from a handful of incident response reports. To move to high confidence, I would need to see consistent overlap in the C2 infrastructure used across multiple victims in different sectors. Until then, attribution is just an educated guess. This pattern rhymes with the 2017 Equifax breach. The failure there wasn't that they missed a patch—though they did—but that they failed to prioritize an internet-facing Apache Struts server over internal systems. They treated the "Critical" label as a blanket instruction rather than asking, "Where is this asset located and who can reach it?" The parallel breaks down slightly because today's attackers automate the discovery phase in minutes, whereas 2017 gave defenders a bit more breathing room. The second-order effect here is the risk to managed service providers (MSPs) and consultants. If an attacker gains access to a Cisco FMC or a Fortinet gateway via these KEV flaws, they don't just own that one box. They own the orchestration layer. They can push malicious configurations to every downstream client connected to that management hub. One unpatched gateway in a provider's office becomes a skeleton key for 50 different corporate networks. So, what can wait? The noise this week is dominated by AI vendors; OpenAI had 21 stories hitting the wire, followed by Chick-fil-A with 18 and Hugging Face with 15. While the "AI swarm" vulnerabilities in Ruflo (CVE-2026-59726) look terrifying in a headline, they often require specific environmental conditions or existing access to trigger. If you aren't running those specific AI orchestration tools in a public-facing capacity, those patches can move to the back of the queue. Internal vulnerabilities that require authenticated, high-privilege access—and are not being exploited in the wild—can also wait. I'm not saying ignore them, but don't let them distract you from the FortiOS or Cisco FMC updates. A "Critical" bug on an isolated internal server is far less dangerous than a "Medium" bug on your edge router that's currently being hammered by scanners. The uncomfortable question for this week is whether we've reached a point where the patch window is shorter than the human capacity to implement it. When CISA gives a 3-day window, they aren't accounting for change management boards or regression testing. They're asking you to choose between the risk of a crashed production environment and the risk of an active breach. I suspect we'll see more "persistence" flaws like the OWA one appearing in other SaaS platforms soon. The industry has focused so much on MFA and credential strength that attackers have pivoted to session hijacking and token theft. We're spending all our time locking the front door while the guests are already in the living room, hiding under the sofa. Watch for any new reports of "session persistence" in other cloud mail providers. If those appear, it changes the priority from "patch the software" to "kill all active sessions."