Which CVEs to patch first this week (KEV + EPSS, 27 Sep 2026)

17 CVEs joined CISA's exploited list in the last two weeks, each with a 3-day federal deadline.