Sequencing patches in a heavy KEV week: KEV, CVSS and EPSS

What these documents cover

This guide draws on four CISA alerts dated October 20, 21, 23 and 28, 2026. Three announce additions to the Known Exploited Vulnerabilities (KEV) Catalog. The fourth is a critical advisory on PHP that CISA revised on October 23 and October 26, 2026.

None of the four documents gives a CVSS score or an EPSS probability. The guide can therefore report what CISA says about KEV status and exposure. On CVSS and EPSS it can only mark what the documents leave out. Everything below is attributed to the alerts, and nothing is filled in from outside them.

What landed between October 20 and October 28

The first alert, dated October 20, 2026, announced six additions. They cover four Plex Media Server flaws, one flaw in EG Secure Solutions SiteGuard Server Edition, and one in Siemens Software Center. CISA's alert describes the SiteGuard entry as an OS command injection flaw.

On October 23, 2026, CISA added one more entry, an SQL injection flaw in Arista VeloCloud Orchestrator.

On October 28, 2026, CISA added a Broadcom VMWare ESX insufficient logging flaw and a Linux Kernel missing initialization flaw.

Between those dates, CISA's PHP alert urged organizations to patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The alert was later updated to say both CVEs had entered the KEV Catalog. That makes PHP a case where a critical advisory and a KEV addition meet in one item.

KEV status: the first filter

CISA ties each KEV listing to evidence of exploitation. The October 23 alert says the entry was added "based on evidence of active exploitation."

CISA also sets a bar for what can be listed. Its alerts say a potential addition needs three things.

The alerts treat KEV status as the main signal for remediation priority, and the recommendation reaches beyond federal agencies.

In a week with nine KEV entries across three alerts, KEV membership alone does not give an order. All nine meet the same listing bar. The documents do not rank them against each other, so a team needs a second filter.

Exposure and impact: the second filter in BOD 26-04

CISA's alerts supply that second filter through Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk." The alerts describe what the directive asks federal civilian agencies to put first.

The same sentence in the alerts says agencies should defer action on lower-risk vulnerabilities. So the directive's priority test has three parts. The CVE must be in the KEV Catalog. The asset must be publicly exposed. Exploitation must give total control of the asset.

The directive also covers what happens after patching. CISA's alerts say it sets expectations for checking whether the system was already compromised.

This matters in a heavy week because a KEV listing is based on exploitation that has already been observed. Patching closes the hole, but under BOD 26-04 the compromise check is a separate step with its own expectations.

The PHP advisory as a worked example

The PHP alert shows how CISA writes priority guidance for a single item. It states the impact plainly.

It also states the reach. The alert lists PHP-FPM, php-cgi, FrankenPHP and LiteSpeed as affected too.

On the fix, the alert is specific.

On KEV status, it is dated.

On order of work inside the PHP effort, the alert tells defenders to start with exposure. That matches the exposure test in BOD 26-04.

The alert also admits a discovery problem. A team cannot sequence what it has not found, and CISA's first listed action is to inventory systems running any version of PHP.

For systems that cannot be patched, the alert gives a firm instruction.

For detection, it names specific behavior to watch.

CVSS and EPSS: what the documents do not say

The question asks how CVSS severity and EPSS exploit probability factor in. The four documents do not answer it.

CISA's PHP alert uses the word "critical" in its title and body. It gives no numeric CVSS score. The KEV alerts list CVE numbers and short vulnerability names, with no scores. None of the documents mentions EPSS, defines a threshold for either measure, or says how either should change the order set by KEV status and exposure.

Any claim here about how CVSS or EPSS should rank KEV items would come from outside the documents, so this guide does not make one. A team that uses those scores has to work out its own rules for them.

One point can be said from the documents themselves. The alerts base KEV listing on exploitation evidence and base BOD 26-04 priority on KEV membership, exposure and post-exploitation control. Neither test depends on a severity score or a probability estimate as the alerts describe them.

A sequence the documents support

Read together, the four alerts support the following order of questions for the week of October 20 to October 28, 2026. These are CISA's tests, and the documents do not rank the individual CVEs.

1. Is the CVE in the KEV Catalog? All nine entries listed above are.
2. Is the affected asset publicly exposed, and would exploitation give total control of it?
3. Is it PHP? CISA's alert calls for immediate patching, internet-facing systems first, and offline status for anything that cannot be updated.
4. Has the system been checked for compromise from before the patch, as BOD 26-04 expects of federal agencies?

Two limits apply. First, BOD 26-04 binds only federal civilian agencies. CISA encourages everyone else to adopt risk-based management and to prioritize KEV remediation, but the alerts do not make that a requirement. Second, the documents say nothing about where non-KEV critical advisories rank against KEV items, or how CVSS and EPSS should break ties.

Leaders who need guidance on those two points will have to find it in a source other than these four alerts.