When Patch Tuesday lands 60 or more fixes at once, you cannot install everything today. This free checklist ranks each vulnerability in five quick questions so you know what to patch in 24 hours, this week, this month, or in the next normal cycle. Print it, copy it into your ticket template, or run it on a single CVE.
The 5-question patch priority checklist
- Is it on the CISA Known Exploited Vulnerabilities (KEV) catalog, or does the vendor say it is exploited in the wild? Check CISA KEV. Yes = attackers are already using it. Go straight to Patch now if the asset is exposed or critical.
- Is the affected system reachable from the internet? VPNs, firewalls, email gateways, web apps, remote access tools and file transfer servers are the usual first targets.
- Can it be exploited without logging in or user interaction? Look at the CVSS vector:
PR:N(no privileges) andUI:N(no user interaction) mean an attacker needs nothing from you. - How likely is exploitation soon? Check the FIRST EPSS score, which estimates the probability a CVE will be exploited in the next 30 days. A high EPSS score with no KEV listing still deserves attention. Also check whether public exploit code exists.
- How bad is it if this asset is compromised? Domain controllers, identity providers, backup servers, hypervisors and systems holding customer data rate higher than a test laptop. The CVSS base score describes the bug, not your business impact, so adjust for the asset.
Score it: which bucket?
| Bucket | Rule of thumb | Target |
|---|---|---|
| Patch now | Exploited (Q1 yes) AND internet-facing or critical asset | Within 24 to 72 hours, or apply the vendor workaround and isolate until you can |
| This week | Exploited on an internal asset, OR internet-facing + no login needed (Q2 and Q3 yes) | Within 7 days |
| This month | Critical or high CVSS with high EPSS or public exploit code, but not exposed | Within 30 days |
| Normal cycle | Everything else | Your regular patch window |
These targets are a starting point, not a rule. US federal civilian agencies must meet the due dates CISA sets for each KEV entry under Binding Operational Directive 22-01; most private companies set their own SLAs. Write yours down so the decision is not made from scratch every month.
Before you close the ticket
- Confirm the fixed version or KB is actually installed (scan again, do not trust the deployment tool alone).
- For exploited bugs on edge devices, check for signs of compromise before or after patching. Patching does not remove an attacker who is already in.
- Rotate credentials or session tokens if the advisory says they could have been exposed.
- Record the CVE, the asset, the bucket and the date fixed for your next audit.
Keep up with what to patch
Our daily brief flags newly exploited vulnerabilities and fixed versions every morning, and our October 2026 Patch Tuesday breakdown shows this checklist applied to a real release.
Studying for Security+, CySA+ or CISSP? Vulnerability management and patch prioritization are tested on all three. Free certification practice for 12 cybersecurity exams. No card needed.