Q3 Vulnerability Data: CVEs Surge, but Exploitation Grows More Slowly

More vulnerabilities are being recorded, but the rise in known exploitation is moving at a slower pace. That gap is the most useful signal in this quarter’s data: teams face a growing intake of findings, alongside a persistent backlog of older flaws that attackers still use.

By the end of September, the count of Common Vulnerabilities and Exposures (CVEs) had passed 70,000, a record at that point in the year. The CVE identifier system has also reached six digits through its ordinary allocation process. Earlier six- and seven-digit examples appeared in 2014 and 2015, but those identifiers were assigned artificially. Before 2014, 9999 was the highest possible identifier. The increase has a practical consequence for security teams: check that scanners, ticketing systems, asset inventories and reporting pipelines can store and process longer CVE identifiers.

Discovery and exploitation are moving at different speeds

The Known Exploited Vulnerabilities (KEV) list offers a more grounded view of attacker activity than raw CVE volume alone. Year over year, CVEs increased by 105%, while KEV entries grew by 37%. That is still a substantial rise, but it follows a 30% increase in KEV entries from 2024 to 2025, making the latest growth less striking by comparison.

The age of exploited flaws is another reason to focus on remediation capacity. CVEs from 2025 or earlier account for 33% of KEV entries—roughly one in three. That share points to a patch gap: a significant portion of the vulnerabilities with known exploitation activity had already been disclosed in an earlier year.

For 2026 CVEs, 29% were added to KEV on the same date they were published, only two percentage points above the figure for all of 2025. This comparison has limits; publication and list-entry dates don't capture every step between discovery, exploitation and confirmation. Still, it doesn't support the idea that newly disclosed flaws are automatically turning into exploited vulnerabilities at an exceptional rate. The data suggests a growing vulnerability supply, with older remediation debt remaining a major part of the risk.

Networking equipment makes up 27% of the vulnerabilities discussed in the source’s latest breakdown, a slight increase. For teams managing exposed appliances, that trend reinforces the value of tracking vendor advisories and patch status alongside general-purpose endpoint and server work.

A data field that may affect response workflows

The KEV data has gained a new forensicTriage column. It flags high-risk vulnerabilities that call for forensic triage and incident response workflows. Teams that ingest KEV data into internal dashboards or automation should check whether their parsers recognize the new field and whether it needs to influence prioritization or escalation. The source points readers to BOD 26-04 and its implementation guidance for details.

The data doesn't justify panic, but it does argue against complacency. A rising CVE count can strain triage, while the older entries in KEV show why teams need to keep closing known patch gaps. Prioritization based on exploitation evidence, exposure and asset importance is more useful than treating every new identifier as an equal emergency.

Espionage activity targets organizations in the CIS

Cisco Talos and Recorded Future’s Insikt Group report that UAT-6275 is targeting government and critical infrastructure organizations across the Commonwealth of Independent States. Researchers say operational security mistakes by the group exposed parts of its infrastructure and malware development. Their analysis describes four infection chains that deliver custom reverse shells through macro-enabled documents, scripts hosted on GitHub and a WinRAR vulnerability.

The group’s use of a familiar code-hosting service as a payload source complicates detection based on destination alone. The researchers also found tooling that suggests UAT-6275 may broaden its reach to Linux systems and internet-facing appliances. Defenders in the affected regions and sectors can watch for unexpected PowerShell activity, downloads from public services, suspicious scheduled tasks and changes to the Windows Startup folder. Keeping archive utilities patched can reduce exposure to exploit-assisted delivery. The research report includes detection signatures and indicators of compromise.

Other security items to track

Among the week’s reported incidents and vulnerabilities, an attack on supermarket refrigeration equipment in France reportedly abused an older control system’s defrost function, driving some units to temperatures as high as 50°C (Hack Read). SecurityWeek reported a zero-day exploit chain affecting Ivanti Connect Secure, identified as CVE-2026-104935, that could enable unauthenticated remote code execution with elevated privileges (SecurityWeek).

Dark Reading also reported active attacks against a maximum-severity server-side request forgery flaw in SonicWall SMA devices. The vendor described the issue as stemming from an unintended alternate access path (Dark Reading). These reports are reminders that the practical response depends on affected products, exposure and available fixes—not the headline count of new vulnerabilities.

More from Talos

You've got to lurk before you can smirk discusses exposing cybercriminal operations and disrupting their activity inside online forums.

Microsoft Patch Tuesday for October 2026 covers the month’s update, which addresses 1,415 vulnerabilities across Microsoft products, including 85 classified by Microsoft as critical.

One breach, please, and make no mistakes looks at preparation for threats involving autonomous agents.

Upcoming events

• VB, Oct. 14–16, Seville, Spain
• CAMLIS, Oct. 21–23, Arlington, Virginia
• SecurityOnion Conference, Oct. 23, Augusta, Georgia
• BsidesAugusta, Oct. 24, Augusta, Georgia
• SAINTCON, Oct. 26–30, Provo, Utah
• CYBERWARCON, Nov. 20, Arlington, Virginia
• AVAR 2026, Dec. 2–4, Hyderabad, India
• Black Hat Europe, Dec. 7–10, London

Malware files seen in Talos telemetry

SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
MD5: 2915b3f8b703eb744fc54c81f4a9c67f
Example filename: sample.exe
Detection name: W32.9F1F11A708-100.SBX.TG
Talos reputation: view file details

SHA256: 73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f
MD5: 63f3351cfdf618bec6045f60203e7978
Example filename: f_00478d.exe
Detection name: W32.PUP:PulseBrowser.29kh.in12.Talos
Talos reputation: view file details

SHA256: 58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681
MD5: f1fe671bcefd4630e5ed8b87c9283534
Example filename: KMSAuto Net.exe
Detection name: W32.58D6FEC4BA-95.SBX.TG
Talos reputation: view file details

SHA256: fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f
MD5: 207d9d891ac756b2bfad88aba5682c65
Example filename: sample.exe
Detection name: W32.FED979F93B-95.SBX.TG
Talos reputation: view file details

For security teams, the quarter’s clearest operational takeaway is the age of the flaws already under active exploitation. The CVE count measures discovery; KEV and local asset context help direct the work that reduces exposure.