Security for Lean IT TeamsWeekly
Security for lean IT: what to patch this week, and what can wait
Updated 15 October 2026 · Timeframe: This week's confirmed-exploited CVEs
7 confirmed-exploited CVEs landed this week. This week that includes Atlassian, Cisco, Microsoft. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
Why it matters
With no security team, you can't chase everything. Confirmed exploitation is the one signal that reliably separates patch-now from patch-later.
What to do
- Security leaders. Make 'patch all KEV within N days' a written policy; it's the cheapest risk reduction you can mandate.
- Lean IT orgs. This week: patch the KEV CVEs, check Microsoft 365 / your main SaaS for the same, and schedule the rest.
- MSPs. Package the KEV list as this week's standard client maintenance window.
Our take
Most breaches hit organizations that lacked the time, not the tools. Plain-English 'what to patch' guidance is where resilience meets reality for lean IT orgs.
Earlier issues
Past states of this signal, most recent first.
15 October 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
11 confirmed-exploited CVEs landed this week. This week that includes Cisco, Microsoft. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
09 October 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
8 confirmed-exploited CVEs landed this week. This week that includes Citrix. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
04 October 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
7 confirmed-exploited CVEs landed this week. This week that includes Apple, Cisco, Citrix. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
28 September 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
10 confirmed-exploited CVEs landed this week. This week that includes Adobe, Microsoft. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
21 September 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
7 confirmed-exploited CVEs landed this week. This week that includes Cisco, Google. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
14 September 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
14 confirmed-exploited CVEs landed this week. This week that includes Adobe, Cisco, Citrix. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
07 September 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
10 confirmed-exploited CVEs landed this week. This week that includes Google. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
31 August 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
11 confirmed-exploited CVEs landed this week. This week that includes Citrix, Microsoft. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
24 August 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
9 confirmed-exploited CVEs landed this week. This week that includes Apple, Microsoft. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
17 August 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
3 confirmed-exploited CVEs landed this week. This week that includes Cisco, Microsoft. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
10 August 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
6 confirmed-exploited CVEs landed this week. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.
03 August 2026 Security for lean IT: what to patch this week, and what can wait
Timeframe: This week's confirmed-exploited CVEs
3 confirmed-exploited CVEs landed this week. This week that includes Cisco, Fortinet. Everything on the KEV list is patch-now; the high-EPSS movers are watch-and-schedule.