Your Firewall and Phone System Are on the Patch List Too

Briefing

A vulnerability scan of a small office often returns hundreds of findings. The severity score describes how bad each one could be. It does not say whether anyone is using it. CISA's Known Exploited Vulnerabilities (KEV) catalog answers that question: an entry requires a CVE ID, reliable evidence of exploitation in the wild, and a clear remediation action.

On June 10, 2026, CISA issued BOD 26-04, which supersedes BOD 22-01 for federal agencies and keeps KEV at the center. Urgency depends on whether an asset is publicly exposed, whether the flaw is on KEV, whether exploitation can be automated, and how much control it gives. Private businesses are not bound by the directive, but CISA recommends every organization prioritize KEV remediation. FIRST's EPSS adds a daily probability that a CVE will be exploited in the next 30 days.

The devices that usually get skipped are the ones that were installed once and forgotten: firewalls, VPN appliances, session border controllers, IP phone system servers, voicemail servers and the management interfaces on switches. Those sit closest to the internet and are the first to matter.

What to do

1. Inventory everything with an IP address, including the phone system, SBC, door controllers, printers and network storage.
2. Identify what is reachable from the internet. Remote admin pages on phone systems and firewalls should not be.
3. Patch in this order: KEV and internet-facing, then KEV on internal systems, then high EPSS on exposed assets, then everything else on the normal cycle.
4. If a vendor patch cannot go in right away, apply the vendor mitigation or remove internet exposure until it can.
5. Plan replacement for gear that no longer gets updates. Unsupported PBX servers and old firewalls will keep collecting findings with no fix.

How to verify

• A finding is closed when the next scan says so. Compare two consecutive scans.
• Check that new KEV entries are matched against your inventory within a day of publication. Ask for the KEV findings report from your monitoring platform after each catalog update; for our clients that report comes from Ares RMM.
• Confirm phone system and firewall firmware versions against the vendor's current release notes.

Sources

• CISA, Known Exploited Vulnerabilities: criteria and guidance
• CISA, Known Exploited Vulnerabilities catalog
• CISA, BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA, BOD 22-01 (superseded by BOD 26-04)
• FIRST, Exploit Prediction Scoring System (EPSS)

Questions about your phones, network or IT? Contact Texwan.