The Exposure Backlog Is Becoming the Real Breach Surface
CISA’s latest KEV additions, large-scale remediation data, and Microsoft’s identity warning all point to the same executive problem: attackers are exploiting the gap between what enterprises know and what they can close in time.
CISA added eight more known exploited vulnerabilities to its catalog on April 20, including issues affecting Cisco SD-WAN Manager, Kentico Xperience, PaperCut NG/MF, and Zimbra Collaboration Suite. On paper, that is another operational priority list for defenders. In practice, it is another reminder that exploited risk now arrives as a stream, not as an isolated emergency.
The story that matters
The KEV list keeps growing, but the real stress shows up in the queue behind it
CISA added eight more known exploited vulnerabilities to its catalog on April 20, including issues affecting Cisco SD-WAN Manager, Kentico Xperience, PaperCut NG/MF, and Zimbra Collaboration Suite. On paper, that is another operational priority list for defenders. In practice, it is another reminder that exploited risk now arrives as a stream, not as an isolated emergency.
That distinction matters because most enterprises do not fail to notice KEV entries. They fail when those entries land on top of already crowded patch, validation, and change windows. The board-level problem is no longer just whether teams can identify what matters. It is whether they can force urgent work through the organization before attackers reach the same gap first.
Identity remains the fastest shortcut through enterprise complexity
Recorded Future News reports that Microsoft saw identity-based attacks surge by 32% in the first half of 2025 and says more than 97% of identity attacks are still password attacks. That is strategically important because it shows attackers do not need novel tradecraft everywhere. They can keep extracting value from stolen credentials, help-desk manipulation, and infostealer-driven access at industrial scale.
This is why the exposure backlog problem is bigger than vulnerability management alone. Even if infrastructure teams improve patch prioritization, attackers can still bypass slow-moving environments by entering through the identity layer, especially where password resets, remote assistance, or weak privileged account controls remain easier than direct exploitation.
Why this matters beyond one CVE
BleepingComputer’s coverage of Qualys research is useful here because it reframes the problem. The analysis of one billion CISA KEV remediation records argues that the issue is not simply patch speed, but the human operating model behind it. Teams are closing far more tickets than before, yet critical exposures still remain open too long because the tail of remediation keeps stretching out.
Put differently, the risk is no longer captured by a neat list of severe flaws. It sits in cumulative exposure, where new exploited vulnerabilities, stale infrastructure, and reusable credentials combine into a backlog attackers can route around or straight through.
What this means for enterprise risk
First, executives should stop reading exploitation alerts as separate events owned by separate teams. KEV additions, credential abuse, and remediation lag are all different expressions of the same organizational constraint: limited security execution capacity under real business conditions.
Second, remediation programs should be measured on reduction of exposed high-leverage paths, not on gross closure counts. The flattering metric is how many tickets got closed. The dangerous metric is how much exploitable exposure remained open across the long tail.
Third, identity control weakness deserves the same urgency as internet-facing software defects. If stolen passwords, help-desk social engineering, or infostealer loot can still reliably produce access, then enterprises are leaving attackers a lower-friction option whenever patching takes longer than planned.
Takeaways
Board takeaway in 20 seconds
- CISA added eight more known exploited vulnerabilities to its catalog on April 20, including issues affecting Cisco SD-WAN Manager, Kentico Xperience, PaperCut NG/MF, and Zimbra Collaboration Suite. On paper.
- Fraud controls should be judged by whether they interrupt the handoffs attackers need: attention, delivery, trust, identity, web foothold, and credential payout.
What should CISOs do?
- Monitor cloud workloads that unexpectedly send mail, create bulk outbound traffic, or appear outside approved provisioning patterns.
- Treat trusted sharing services as redirect surfaces: inspect destination chains, not only the first domain a user clicks.
- Lock down exposed form plugins, workflow tools, and AI builders with patch SLAs, admin restrictions, and recent-change review.
What should boards demand?
- Evidence that payment, travel, hospitality, and support workflows require out-of-band verification at high-risk moments.
- Named ownership for public-facing convenience software before it becomes a fraud staging point.
- Metrics that show fraud controls make completion harder across attention, delivery, trust, identity, web foothold, and credential payout.
What should risk committees rethink?
- Move fraud from awareness-only training into process design: approvals, callbacks, domain monitoring, and cloud-mail anomaly response.
- Run incident scenarios for executive hospitality fraud, fake support, and compromised public web tools.
- Review whether seasonal events, procurement exceptions, and support urgency weaken verification controls faster than policy owners expect.
The board blind spot
The blind spot is believing that better prioritization alone will solve the problem. Prioritization matters, but it does not eliminate the execution debt that builds up behind every urgent item that still waits for patching, validation, credential cleanup, or business approval.
That is the deeper meaning of today’s signals. CISA keeps identifying exploited flaws, Microsoft keeps seeing password-heavy identity abuse, and large-scale remediation data keeps showing the same structural lag. These are not disconnected issues. They are different measurements of the same operating gap.
The organizations that will look strongest over the next year are the ones that treat backlog compression as a security capability in its own right, not as an administrative byproduct of vulnerability management.
- CISA, Cybersecurity Alerts & Advisories, noting eight KEV additions on April 20, 2026
- CISA Known Exploited Vulnerabilities Catalog CSV
- BleepingComputer, Analysis of one billion CISA KEV remediation records exposes limits of human-scale security
- Recorded Future News, Microsoft warns of a 32% surge in identity hacks, mainly driven by stolen passwords