The Q2 2026 State of Exploited Vulnerabilities report, published in July 2026, quantifies what security teams have been experiencing for months as a nagging intuition: adversaries are reverse-engineering vendor patches and shipping working exploits faster than any manual patch management process can respond. The headline number — functional exploits appearing within 8 hours of Patch Tuesday publication — compresses the window between patch release and in-the-wild exploitation to a single business morning. Against this backdrop, the patch remediation timelines mandated by FINMA Circular 2023/1 and the ISA minimum information security standards — both calibrated at 14 days for critical vulnerabilities — are not conservative safety margins. They are compliance benchmarks that describe a world that no longer exists. The July 2026 SharePoint dual zero-day is not an exceptional case; it is the new normal applied to a Microsoft product. The argument for automation is no longer strategic; it is arithmetically necessary.
What the Q2 2026 Data Actually Shows
Three findings from the Q2 2026 report matter specifically for Swiss patch management programmes. First, the exploit shipping window for high-CVSS CVEs has collapsed to 8 hours post-Patch Tuesday. This is not the average time to exploitation across all published CVEs; it is the time to exploitation for the subset of vulnerabilities that attract immediate attacker attention — broadly, those with CVSS 9.0 or above, with network-accessible attack vectors, and with low attack complexity. That subset is precisely the set that FINMA's 14-day SLA is designed to prioritise. Attackers are reading the same CVSS scores that compliance frameworks use for triage.
Second, CVSS inflation is accelerating the degradation of triage signal. The proportion of CVEs published at CVSS 9.0 or above has increased substantially in the past 18 months, driven partly by vendors revising scoring methodologies and partly by the increased prevalence of remotely exploitable vulnerabilities in networked products. The consequence is that "critical" now describes a much larger pool of vulnerabilities than it did when FINMA's 14-day requirement was written — a pool that includes both genuinely imminent exploitation threats and theoretical weaknesses unlikely to be weaponised for months. When everything is critical, nothing is critical, and security teams end up either treating all 9.0+ CVEs as equally urgent (operationally unsustainable) or developing their own informal prioritisation logic that may not survive regulatory audit.
Third, the combination of faster exploit development and more CVEs at the critical threshold creates a backlog dynamic that compounds over time. An organisation that starts a given quarter with 200 open critical CVEs will not reduce that backlog by patching 14-day critical CVEs on schedule — because the flow rate of new critical CVEs exceeds the rate at which existing ones can be remediated through manual processes. The backlog grows, the risk exposure increases, and the organisation is technically compliant (meeting its stated SLA percentage) while being practically non-compliant (maintaining a growing pool of exploitable critical vulnerabilities).
The Swiss Regulatory Framework and Its Calibration Gap
FINMA Circular 2023/1, Technology and Outsourcing (applicable to banks, securities firms, and insurance companies), requires that critical vulnerabilities — those with a CVSS score of 9.0 or above, or those confirmed as actively exploited regardless of score — be remediated within 14 calendar days. The ISA minimum information security standards for critical infrastructure operators use equivalent language. Both frameworks were written when the median time-to-exploitation for a newly published high-severity CVE was measured in weeks, not hours, and when the volume of CVSS 9.0+ CVEs on a typical Patch Tuesday was in the single digits rather than the current range of 15 to 30.
The 14-day requirement was a reasonable approximation of "respond urgently" in 2023. In 2026, for internet-facing assets, it is a fiction. The SharePoint CVE-2026-58644 zero-day was being actively exploited before the patch was even published. By the time a Swiss bank's vulnerability management team completed its standard triage process — asset identification, impact assessment, change-management scheduling — on day two or three after Patch Tuesday, the exploitation window was already measured in days, not days remaining. The 14-day SLA provides no meaningful protection for internet-exposed assets when exploits are available before the patch is.
This is not an argument for abandoning the regulatory framework. It is an argument for updating it — and for Swiss organisations to get ahead of that update by adopting tighter internal SLAs before regulators mandate them. FINMA's supervisory dialogue with banks already includes questions about automated patch deployment and emergency change-management procedures; the 14-day figure in the circular is likely to be revised downward in the next review cycle. Organisations that have not built the underlying infrastructure to support sub-14-day SLAs for internet-facing assets will face a disruptive compliance remediation project on a regulator-imposed timeline.
Prioritisation Tools That Actually Work in 2026
The mismatch between CVSS as a triage signal and CVSS as a practical exploitation predictor is well-documented. Two alternatives provide materially better signal. The Exploit Prediction Scoring System (EPSS), maintained by the Forum of Incident Response and Security Teams (FIRST), estimates the probability that a given CVE will be exploited in the wild within 30 days, based on a model trained on historical exploitation data. An EPSS score above 0.5 (50% probability of exploitation within 30 days) is a far more reliable indicator of imminent operational risk than a CVSS score above 9.0. For a typical Patch Tuesday with 15 to 30 CVSS 9.0+ vulnerabilities, EPSS will identify three to five that warrant emergency response — a manageable number for automated deployment pipelines.
CISA KEV membership is an even simpler signal: if a CVE is listed in the Known Exploited Vulnerabilities catalog, it is confirmed exploited in the wild. KEV-listed CVEs should carry a 48-hour emergency SLA regardless of CVSS score, for internet-facing assets. This is already the de facto standard in US federal civilian agencies under CISA's Binding Operational Directive 22-01; it is not yet codified in Swiss regulation, but it reflects the operational reality that the Q2 2026 data describes.
SBOM-based reachability analysis provides a third layer of prioritisation. Not every CVE that scores 9.8 in a library is reachable from an exploitable code path in a given application. Organisations that maintain Software Bills of Materials and run reachability analysis against them can reduce the effective critical CVE count for a specific application by 60 to 80 percent. This does not reduce the total patching workload, but it correctly sequences it — the reachable, exploitable vulnerabilities in internet-exposed applications come first, the theoretical vulnerabilities in internally-used libraries come when resources permit.
What Swiss Organisations Need to Change
The Q2 2026 exploit speed data does not call for faster manual patching. Manual patching cannot scale to 8-hour exploit windows. It calls for automation, emergency governance structures, and a regulatory engagement strategy.
On automation: Swiss organisations should deploy automated patching pipelines for internet-facing asset classes — web application servers, VPN concentrators, email gateways, collaboration platforms — with pre-approved change templates that do not require full Change Advisory Board approval for KEV-listed or PoC-published vulnerabilities. The patch should deploy to a canary or pre-production segment automatically, run a defined regression suite, and if the suite passes, proceed to production within 24 hours. The CAB approval function shifts from deciding whether to patch to reviewing the canary results and approving production rollout — a review that can happen in under an hour rather than days.
On emergency governance: FINMA-supervised institutions should document an emergency change-management procedure that explicitly covers KEV-listed and actively exploited CVEs. The procedure should define the roles and decision rights (who can approve an out-of-cycle patch deployment without a full CAB), the evidence threshold (CISA KEV listing or public PoC is sufficient without further internal risk analysis), and the audit trail (automated deployment logs satisfy the change record requirement). This procedure does not need to be invented from scratch; it is a specialised variant of the emergency change procedure that most organisations already have for production outages.
On regulatory engagement: Swiss security leaders should engage with FINMA's ICT supervisory function and with the NCSC's minimum standards working groups to advocate for SLA recalibration that reflects the Q2 2026 reality. A revised framework might retain 14 days for internal-only assets with low exploitation probability, reduce to 72 hours for internet-facing assets with EPSS above 0.3, and mandate 48 hours for KEV-listed CVEs regardless of exposure. Presenting the Q2 2026 data and concrete programme proposals in supervisory dialogue — rather than waiting to receive updated requirements — positions Swiss organisations as proactive partners rather than reactive compliance subjects.
◆ Key Takeaway
The Q2 2026 exploit speed data makes clear that manual patch management cannot satisfy the spirit of FINMA and ISA requirements for internet-facing assets. Swiss organisations need automated patching pipelines, emergency change-management procedures that treat KEV-listed CVEs as pre-approved, and EPSS- or KEV-based triage to replace CVSS as the primary prioritisation signal. The 14-day SLA was calibrated for a different threat environment; building the infrastructure to support 48-hour remediation for actively exploited CVEs now is the only realistic path to staying ahead of the regulatory update that will eventually mandate it.
- Replace CVSS-only triage with EPSS + KEV membership. Configure your vulnerability management platform to surface KEV-listed CVEs at the top of the remediation queue, followed by CVEs with EPSS above 0.3 for internet-facing assets, before applying CVSS as a secondary signal.
- Build automated patching pipelines for internet-facing asset classes. Web servers, VPN appliances, email gateways, and collaboration platforms should have pre-approved change templates and canary deployment pipelines that can complete the patch-test-approve cycle within 24 hours.
- Document an emergency change procedure specifically for KEV-listed CVEs. Define the decision authority, evidence threshold, and audit trail format. Review the procedure annually against FINMA's ICT supervisory expectations.
- Implement SBOM-based reachability analysis for application portfolios. Prioritise this for external-facing applications first. Reachability analysis eliminates the noise of theoretical CVEs in unreachable code paths and sharpens the signal for genuinely critical exposures.
- Track CVSS inflation in your board-level reporting. Present not just the count of open critical CVEs but the EPSS distribution within that count. This shifts the conversation from "we have 300 open criticals" to "we have 8 criticals with exploitation probability above 50% and 12 with public PoCs" — a materially more informative risk picture.
- Engage FINMA's ICT supervisory function proactively. Present your emergency change procedure and automated patching programme as evidence of controls that exceed the 14-day baseline. Supervisors respond better to organisations that are ahead of the regulatory curve than to organisations asking for clarification after an incident.
The gap between regulatory SLAs and operational reality in Swiss patch management is not a compliance problem. It is an engineering problem that has compliance consequences. The Q2 2026 data quantifies it precisely enough that there is no longer room for "we are working on it" as a board-level answer.