Your Vendor's Unpatched CVE Is Your Problem Too: Tracking Third-Party Findings and SLAs
kratikal, Friday, October 30th, 2026
Kratikal explains why a vendor's unpatched CVE is the customer's risk and how to track vendor findings and enforce remediation SLAs.
The post argues that an unpatched CVE at a payroll provider or other vendor reaches a company through the access, data and integrations it gave them, and regulators and customers will ask why it did not know.
It defines third-party vulnerability management as finding, tracking and closing flaws in vendor-run systems, agreeing how fast they must be fixed and proving it.
It says most teams stop at onboarding questionnaires and do not track CVEs that appear months later, and cites a figure that 48% of breaches involve third parties.
It covers tracking vendor CVEs, setting remediation SLAs and staying audit-ready.