TL;DR: CISA's June 2026 Known Exploited Vulnerabilities (KEV) catalog updates landed in rapid succession: Check Point IKEv1 VPN (CVE-2026-50751, CVSS 9.3), Mirasvit Magento Cache Warmer (CVE-2026-45247, CVSS 9.8), Everest Forms Pro WordPress (CVE-2026-3300, CVSS 9.8), and SolarWinds Serv-U file server (CVE-2026-28318). Together they paint a four-front attack surface that hits NC SMBs disproportionately: remote access, e-commerce, content marketing forms, and file transfer. The fix is risk-based KEV-rate patching across all four surfaces, plus 24/7 monitoring and EDR/MDR on the systems that touch them.
Key takeaway: Single-vendor patch programs no longer scale in 2026. NC SMBs need a KEV-rate cadence program that covers firewalls, e-commerce, WordPress, and file servers simultaneously, with documented evidence for cyber insurance and CMMC review.
Worried your stack has unpatched KEV entries today? Preferred Data Corporation runs managed KEV-rate patching for NC small businesses. Call (336) 886-3282 or request a KEV gap assessment.
What landed on the CISA KEV catalog in June 2026?
Four critical, actively exploited vulnerabilities across four different SMB-relevant surfaces. Per The Hacker News' running coverage of CISA KEV additions and the official CISA Known Exploited Vulnerabilities catalog, the June 2026 entries that NC SMBs need to track are:
- Check Point CVE-2026-50751 (CVSS 9.3). Critical vulnerability in Remote Access VPN and Mobile Access gateways configured with the deprecated IKEv1 key exchange protocol. Actively exploited.
- Mirasvit Cache Warmer for Magento CVE-2026-45247 (CVSS 9.8). Critical vulnerability in a popular Magento full-page cache extension. Actively exploited and confirmed on CISA KEV.
- Everest Forms Pro CVE-2026-3300 (CVSS 9.8). Critical remote code execution vulnerability impacting all versions through 1.9.12 of a WordPress plugin with around 4,000 active installs. Actively exploited.
- SolarWinds Serv-U CVE-2026-28318 (CVSS 7.5). High-severity denial-of-service flaw in multi-protocol file server software. Added to CISA KEV based on evidence of active exploitation.
These four entries arrived in a matter of days. They are not the only KEV updates this quarter; per the Verizon 2026 DBIR, the median number of KEV entries SMBs need to close rose from 11 in 2024 to 16 in 2025, with 2026 trending steeper. The volume itself is the operational problem.
Why does the same SMB get hit on all four surfaces?
Because the modern SMB stack is structurally heterogeneous: Check Point on the perimeter, Magento on the storefront, WordPress on the marketing site, SolarWinds Serv-U for partner file transfers. Each surface is owned by a different vendor with a different patch cadence, change window, and ownership model.
| Surface | Typical SMB usage | Common gap |
|---|---|---|
| Edge / VPN (Check Point, Fortinet, SonicWall, Palo Alto) | Remote workforce, branch connectivity | Firmware deferred, legacy protocols on |
| E-commerce (Magento, Shopify, WooCommerce) | Online sales | Extensions / plugins under-patched |
| Content marketing (WordPress) | Marketing site, lead capture forms | Plugin sprawl, no central inventory |
| File transfer (SolarWinds Serv-U, MOVEit, GoAnywhere) | Partner / customer file exchange | Internet-exposed, narrow ownership |
| Productivity (M365, Google) | Email, collaboration | Identity gaps, OAuth sprawl |
| Endpoint (Windows, macOS) | Daily work | Patching delays, AV vs EDR gap |
A 25-500 person Piedmont Triad SMB can easily host 30-50 internet-exposed assets across these surfaces. Without an asset inventory and a KEV-rate cadence program, even one missed entry can produce the breach that ends the year. Per the BlackFog 2026 State of Ransomware report and Guardz's June 2026 MSP threat report, SMBs are the dominant ransomware victim profile in 2026.
What is the realistic SMB cost of one missed KEV entry?
Per industry reporting cited across the Verizon 2026 DBIR, BlackFog, and Guardz, the realistic 2026 SMB ransomware incident costs:
- $254,000 average recovery cost for SMB ransomware
- $120,000 to $1.6 million range for single-incident recovery
- 60% of SMBs hit by ransomware close within six months
- $3.31 million average total data breach cost for organizations under 500 employees per IBM cost reporting cited in industry coverage
- Cyber insurance premium impact of 50-300% on renewal even when the claim is paid
The single biggest mistake SMBs make is treating each KEV entry as a one-time IT ticket rather than a continuous program. KEV-rate cadence is the only structural defense.
Quotable definition: KEV-rate cadence is closing every CISA Known Exploited Vulnerabilities catalog entry that touches your stack inside its published federal deadline, with documented evidence available for cyber insurance and CMMC review, applied to internet-exposed assets first and supported by 24/7 monitoring and EDR/MDR.
What should an NC small business do this week?
Run a four-surface KEV gap assessment, patch the urgent four CVEs above, and build the managed cadence that catches July's KEV entries on time.
- Inventory every internet-exposed asset across all four surfaces. Edge appliances, e-commerce platform and plugins, WordPress and plugins, file transfer systems, plus M365 / Google identity and OAuth grants. A KEV cadence cannot defend what is not inventoried.
- Triage the four June 2026 KEV entries against your stack. Check Point IKEv1, Mirasvit Magento, Everest Forms Pro, SolarWinds Serv-U. Apply vendor patches inside the published KEV deadlines.
- Disable deprecated protocols. IKEv1 specifically. SMBv1 if it is still on. Legacy TLS. The pattern is the same: backward compatibility is the long tail that produces exploited CVEs.
- Add managed monitoring to every internet-exposed surface. Per the 2026 Verizon DBIR, median patch time stretched to 43 days while exploitation precedes patches by ~50 days. EDR/MDR with 24/7 SOC catches what patching delays let through.
- Document KEV closure evidence. Patch timestamps, exception list, risk acceptance, and evidence pack. Cyber insurers and CMMC assessors expect this in writing.
- Adopt a managed KEV-rate program. A single in-house IT generalist cannot economically run four-surface KEV cadence plus 24/7 SOC plus patch governance plus insurance documentation alone. This is the function that most clearly justifies an MSP in 2026.
Need this assessed and remediated for your business? Call (336) 886-3282 or contact Preferred Data Corporation for a KEV gap assessment.
Why is this a managed-program problem, not a tools problem?
Because the four-surface attack workload is multi-vendor, multi-disciplinary, and continuous. Per ConnectWise's 2026 MSP Threat Report, attackers refined how they gain access rather than innovating encryption: exploit, scan, steal, encrypt, often targeting backup infrastructure first. The defender stack that withstands that pressure (RMM + EDR/MDR + 24/7 SOC + managed patching + vCIO governance + IR retainer) is what an MSP runs across many clients at a price an SMB can absorb.
For a Piedmont Triad SMB, the right answer is to choose a partner that runs KEV-rate cadence across the full stack, evidences it for cyber insurance and CMMC, and bundles it with the EDR/MDR and SOC coverage that catches what patching delays let through. Preferred Data Corporation has delivered that managed protection to North Carolina small businesses since 1987, from our High Point headquarters and on-site across the Piedmont Triad, Charlotte, Greensboro, Raleigh, and Winston-Salem.
PDC supports this through managed cybersecurity, managed IT services, and network and infrastructure.
Frequently Asked Questions
What is the CISA Known Exploited Vulnerabilities (KEV) catalog?
A federal catalog of vulnerabilities for which there is reliable evidence of active exploitation in the wild. Published and maintained by CISA, each entry includes a published remediation deadline that federal agencies must meet under Binding Operational Directive 22-01. Cyber insurers and CMMC assessors increasingly treat private-sector compliance with KEV deadlines as a baseline expectation.
Do we need to patch every KEV entry, or only the ones that touch our stack?
Only the ones that touch your stack, but you need an inventory to know which ones do. The 2026 cadence assumes that you maintain an asset inventory of internet-exposed systems and applications, that you check each new KEV entry against that inventory, and that you close any matches inside the published federal deadline.
How do we monitor the CISA KEV catalog in practice?
Subscribe to the CISA KEV feed, but pair it with vendor PSIRT feeds (Microsoft, Check Point, Cisco, Fortinet, Palo Alto, SolarWinds, Adobe, Apple, WordPress / wpscan, and your CRM / ERP vendors). Most managed services partners ingest these feeds into a vulnerability management workflow and surface only the entries relevant to your stack.
Is WordPress plugin patching really a board-level concern?
For SMBs whose marketing site, lead-capture forms, and storefront run on WordPress, yes. Per the Everest Forms Pro CVE-2026-3300 entry, an unpatched plugin produces a remote code execution path that takes the marketing site, lead data, and adjacent infrastructure. Per The Hacker News' coverage, the active exploitation pattern hits SMBs disproportionately.
Can our in-house team operate KEV-rate cadence?
For very small businesses (under 25 endpoints, single tenant, minimal internet-exposed surface) possibly, with significant time investment. For 25-500 person Piedmont Triad SMBs with mixed cloud, on-prem, e-commerce, marketing, and partner file-transfer exposure, the structural answer is no. A managed program from an MSP that runs the stack across many clients is the economical way to maintain KEV-rate cadence at SMB scale.
Related Resources
- Managed Cybersecurity Services for NC Businesses - KEV-rate patching, EDR/MDR, 24/7 SOC
- Managed IT Services for NC Businesses - RMM, vCIO governance, patch evidence
- Network and Infrastructure Services - Edge appliance hardening
- Check Point IKEv1 CVE-2026-50751 NC SMB VPN Defense Plan - Edge appliance deep dive
- Magento Mirasvit CVE-2026-45247 NC E-Commerce SMB Plan - E-commerce surface
- Contact Preferred Data Corporation - KEV gap assessment for NC SMBs