Start here

What to patch first.

180 of these vulnerabilities are actively used in ransomware attacks. Start with these — they're the ones criminals are exploiting right now.

• Patch first180used in ransomware
• Patch second190critical, or high-severity on internet-facing gear
• Patch third417high-severity, or on internet-facing gear
• Patch fourth55everything else on the list

Every entry here is on CISA's Known Exploited Vulnerabilities list, and CISA's current directive, BOD 26-04, gives federal agencies 3 or 14 days to fix a listed vulnerability.

Treat all four groups as due inside that window and work through them in this order; a later place in the order is not permission to wait.

The order comes from CVSS severity and our guess at internet exposure from the kind of product. Neither is how CISA sets its deadlines: the directive looks at:

• Whether your system is actually reachable from the internet
• Whether the attack can be automated
• How much control it gives an attacker

Want just the ones that hit your gear? Check your stack to pick your vendors and see what's being exploited right now.