Which CVEs to patch first this week (KEV + EPSS, 27 Sep 2026)
There are more than 380,000 CVEs with an EPSS score and no team patches them all. The two free signals that cut the list down fastest are CISA's Known Exploited Vulnerabilities (KEV) catalog (confirmed exploitation in the wild) and FIRST's EPSS (the probability of exploitation activity in the next 30 days). This week's list, and a repeatable way to build it.
This week: 17 new exploited CVEs, 3-day deadlines
Between 14 and 25 September 2026 CISA added 17 CVEs to KEV (catalog version 2026.09.25, 1,726 CVEs in total). All 17 carry a federal due date three days after they were added (the latest due date is 28 September). Sorted by EPSS:
| CVE | Vendor / product | Added | Federal due | EPSS |
|---|---|---|---|---|
| CVE-2026-71362 | Adobe Commerce and Magento | 24 Sep | 27 Sep | 87.5% |
| CVE-2026-76461 | Cisco Secure Email Gateway | 14 Sep | 17 Sep | 28.3% |
| CVE-2026-93616 | Check Point (multiple products) | 22 Sep | 25 Sep | 19.7% |
| CVE-2026-87902 | WordPress Core (remote file inclusion) | 25 Sep | 28 Sep | 18.2% |
| CVE-2026-76460 | Cisco Identity Services Engine | 16 Sep | 19 Sep | 14.0% |
| CVE-2025-39682 | Linux Kernel | 18 Sep | 21 Sep | 2.9% |
| CVE-2026-7273 | Zyxel GS1900 switches | 21 Sep | 24 Sep | 2.5% |
| CVE-2026-94127 | F5 BIG-IP APM | 22 Sep | 25 Sep | 2.2% |
| CVE-2026-65660 | Microsoft SharePoint | 25 Sep | 28 Sep | 2.1% |
| CVE-2026-67279 | MikroTik RouterOS | 25 Sep | 28 Sep | 1.0% |
The other seven (Arista VeloCloud Orchestrator, a second Check Point CVE, two more Linux kernel CVEs, WSO2, Acronis Backup and Google Pixel) score under 1.1%. They are still exploited; EPSS only tells you where mass exploitation is most likely.
FIRST EPSS scores dated 27 Sep 2026: the estimated chance of exploitation activity in the next 30 days. Top 8 of the 17 additions.
The order to patch in
- In KEV and internet-facing: Adobe Commerce/Magento, WordPress core, Cisco Secure Email Gateway, Check Point gateways, F5 BIG-IP APM, SharePoint. Exploitation is confirmed and the systems are reachable by anyone.
- In KEV, inside the network: Cisco ISE, the Linux kernel CVEs, Zyxel switches, MikroTik routers, Acronis Backup.
- Not in KEV but EPSS above 10%: the early-warning list. 17,267 CVEs have an EPSS of 10% or more today, and only 1,274 of them are in KEV. Run your scanner output through both signals and the gap is where the next KEV entries usually come from.
- Everything else by CVSS and exposure, on your normal patch cycle.
Try it: CVEs added to KEV in the last 14 days (free, no key)
Why KEV plus EPSS beats CVSS alone
CVSS rates how bad a flaw could be. It does not say whether anyone is using it. Of the 1,726 KEV entries, 361 are known to be used in ransomware campaigns. Vendor pages show how concentrated the risk is: Microsoft has 389 CVEs in KEV, Cisco 99, Apple 94 and Ivanti 35. See every vendor.
Automate it: one call per 20 CVEs
Paste your scanner's CVE list into Kevscope and every CVE comes back with a verdict (act_now, high, medium, low) and the evidence behind it: KEV status, due date and ransomware use, EPSS score and percentile, CVSS and CISA's SSVC decision points. The rules are public: act_now means it is in KEV or SSVC says exploitation is active; high means EPSS of 10% or more, or an automatable CVSS 9+ flaw with a public exploit.
curl "https://kevscope-api.cybermax-tools.workers.dev/api/priority?cve=CVE-2026-71362,CVE-2026-65660"The same key works as a remote MCP server, so an AI agent can triage a scan for you.
Published prices on 27 September 2026: OpenCVE Starter is €19/month and Pro €49/month; Vulners Basic is $600/month. Kevscope is free for 200 calls a day, then $19/month for 10,000 calls. Prefer a report to an API? The Exploited Vulnerabilities Brief lands every Monday.
Sources: CISA KEV catalog, FIRST EPSS scores dated 27 Sep 2026, NIST NVD.