Two critical vulnerabilities are under active exploitation right now, with direct implications for UK small businesses. Adobe ColdFusion CVE-2026-48282 carries a perfect CVSS 10.0 score and was weaponised within two hours of public disclosure. The vulnerability allows unauthenticated remote code execution on affected servers. Meanwhile, SimpleHelp RMM CVE-2026-48558 enables attackers to create Technician accounts on unpatched servers, granting access to every client system managed through that infrastructure. Hundreds of vulnerable SimpleHelp servers remain exposed worldwide weeks after patches became available. Both vulnerabilities highlight a structural problem: attackers now operate at machine speed whilst defenders, particularly in under-resourced environments, operate at human speed. Monthly patch cycles are structurally inadequate when exploitation timelines are measured in hours. This episode provides three specific, answerable questions to ask your IT provider before the end of the week, with guidance on why written responses matter for cyber insurance and due diligence. The NCSC’s vulnerability management and supply chain security guidance is referenced throughout. Your MSP’s patch status is your risk, not theirs.
