Record Vulnerability Counts Are Not the Same as Record Attacks, Says Cisco Talos

Cisco Talos has looked at the current vulnerability landscape and found that the headline numbers need context. The count of published vulnerabilities (CVEs) has passed 70,000 and it is only the end of September. CVE identifiers have also naturally grown into six digits, so the author urges readers to check that their tooling can handle the longer numbers.

The picture looks calmer when you consider the Known Exploited Vulnerabilities (KEV) catalogue, which lists flaws confirmed as being used in attacks. Year on year, CVEs rose 105%, while KEV grew 37%, following a 30% rise from 2024 to 2025. About a third of KEV entries relate to CVEs from 2025 or older, which suggests a patch gap. For 2026 CVEs, 29% were added to KEV on the day they were published, only 2% above the 2025 figure. Networking gear accounts for a slightly higher share, at 27%. The author says this is not the whole story, but it indicates we are not in a zero-day apocalypse.

The KEV also has a new column, "forensicTriage", which flags high-risk vulnerabilities that need mandatory forensic triage and incident response workflows. This is covered in BOD 26-04 and its implementation guidance. Talos concludes that discovery is not exploitation, and that vendors appear to be keeping pace at least partly.