Zero-day, CVE, CVSS and KEV: how to read an advisory

Published on November 10, 2026 · The mitza.es team

“Critical zero-day with a CVSS of 9.8 in the KEV catalog.” A sentence like that can alarm or bore you, and neither reaction helps. Most of the security advisories you see in the press don't affect you; a few do, and they call for action the same day. This guide gives you the vocabulary and a simple method to tell them apart, designed for a small business with no security department.

A quick glossary, without the jargon

Vulnerability: a flaw in a program or device that lets someone do something they shouldn't (get in without a password, run commands, see other people's data).
CVE: the public “ID number” of a specific vulnerability, in the format CVE-year-number (for example, CVE-2026-98432). It lets everyone talk about the same flaw, whether or not it has a commercial name.
CVSS: a score from 0 to 10 for technical severity. The usual scale classifies it like this: 0.1–3.9 low; 4.0–6.9 medium; 7.0–8.9 high; 9.0–10 critical. It measures how serious a flaw would be, not whether anyone is attacking it.
Zero-day: strictly speaking, a flaw that is exploited before the vendor has a patch. The term is used with nuances: Microsoft also applies it to flaws that become public before they are fixed. An exploited zero-day is the most urgent case.
Exploit: the code or technique that takes advantage of the vulnerability. “There is a public exploit” means attacking is easier.
KEV: the catalog of known exploited vulnerabilities from the US agency CISA. If a flaw makes it in there, there is evidence of real exploitation. The deadlines it sets are for US federal agencies, but the list is a useful signal for anyone.
CWE: the type of weakness behind the flaw (for example, a race condition or the use of memory after it has been freed). It's information for technicians; you don't need it to decide.
EPSS: a statistical estimate of the probability that a flaw will be exploited in the next 30 days. It complements the CVSS.
Patch, update and mitigation: the patch fixes the flaw; mitigation is a temporary measure when there is no patch yet (for example, closing a port or disabling a feature).
Patch Tuesday: on the second Tuesday of each month Microsoft publishes its security updates.

The five questions to read any advisory

Do I use that product and that version? Most advisories are ruled out right here. That is why you need an inventory, even if it's just a spreadsheet.
Is it already being exploited? Look for expressions such as “exploited in the wild” or inclusion in the KEV catalog. It's the question that changes the priority the most.
Is it exposed to the internet? A VPN, a firewall, a website or a mail server reachable from outside are immediate targets. A device reachable only from the internal network gives you a little more margin.
Is there a patch or only a mitigation? If there is only a mitigation, apply it and keep an eye on the advisory until the fix is released.
What happens if the update goes wrong? Before patching, have a backup and a plan to roll back, especially on servers and websites. Here we explain the 3-2-1 backup rule.

Why the score isn't enough: two examples from this season

A 9.8 looks scarier than an 8.1, but the order of action can be the opposite. Look at two advisories we analyzed this month:

The Linux kernel flaw CVE-2026-98432 has a CVSS of 9.8, but in the Red Hat advisories we reviewed it was not listed as exploited and taking advantage of it requires precise timing.
The WordPress flaw CVE-2026-119977 has a lower score according to the analysis we cite (8.1), but CISA added it to its catalog because of active exploitation. For a WordPress site, it's the one to deal with first.

The practical rule: exploited + exposed to the internet always beats “high score but theoretical”. More than the score, what decides urgency is your company's context: what you have exposed and what data sits behind it.

Reasonable patching deadlines for a small business

Neither NIS2 nor the GDPR sets a deadline in hours for patching: they ask for measures appropriate to the risk. These deadlines are a common practical reference in small companies, not a legal obligation:

Exploited and exposed to the internet: within 24–48 hours. If there is no patch, immediate mitigation.
Critical (CVSS 9 or higher) and exposed, with no known exploitation: within 72 hours.
High (7.0–8.9): within 7 days.
Medium: in the monthly maintenance cycle.
Low: with the next normal update.

After patching an exploited flaw, don't stop at “done”: check whether there was an intrusion before the patch (new users, modified files, odd logs). In the case of the Ivanti VPN it was especially important because the attack left little trace.

Where to find out what affects you

INCIBE-CERT: it publishes vulnerability advisories in Spanish; INCIBE (Spain's national cybersecurity institute) also offers free help on 017.
The vendor: subscribe to the advisories of the products you use (VPN, firewall, switches, NAS, WordPress, browsers).
CISA's KEV catalog: to know which flaws are really being exploited.
Your IT provider: ask them to notify you in writing of the critical flaws that affect your company and of the deadline by which they will apply the fixes.

Which devices to watch first

Prioritize what is exposed or is the way in: VPN, firewall, email gateway, web server, network equipment and browsers. In recent weeks we have seen advisories in every category:

Browser: the eighth Chrome zero-day of 2026.
Network equipment: the Zyxel GS1900 switches, the Ivanti VPN and the Citrix NetScaler devices.
Servers: the Linux kernel and OpenSSH on Alpine.
Websites: WordPress 7.1.4 and the exploited plugins.
Workstations: the October Patch Tuesday.

A minimal patch management process

Inventory: which devices, programs and versions you have, and who is responsible for each.
Subscribe to the advisories of the products in the inventory.
Classify with the five questions above and the reference deadlines.
Test and back up before applying, especially on servers and websites.
Verify and record: check the final version and note the date, the device and who did it. It's what you'll be asked for if one day you have to justify your measures, for example under the NIS2 regulation.

Quick questions

Do I have to read every advisory?

No. With an inventory and a couple of subscriptions, most are ruled out in seconds. The goal is not to miss the small percentage that does affect you.

What do I do if the vendor doesn't publish a patch?

Apply the mitigation it recommends, limit the device's exposure and consider replacing it if the vendor abandons it. A device with no support is a permanent risk.

Can patches break things?

Sometimes. That is why they are applied with a backup and, where possible, first in a test environment. The risk of not patching an exploited flaw is usually greater than that of an update.

Does cybersecurity insurance make sense?

It is a complement, not a substitute for patching, and insurers often ask about these practices. You can find more in how much cyber insurance costs for a small business.

How we can help at Mitza

We build the inventory, watch the advisories that affect you and apply the patches with a prior backup and a log. Discover our IT maintenance for small businesses, the website security audit or tell us about your case on the contact page.

Zero-day, CVE, CVSS and KEV: how to read a security advisory and how fast a small business should patch