The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Summary: Cisco Talos reports that CVE volume passed 70,000 by the end of September, a 105% year-over-year increase, while KEV additions grew 37%. The newsletter notes that 33% of KEV entries trace to CVEs from 2025 or earlier, and that networking gear accounts for 27% of CVEs, with a new forensicTriage column added to KEV under BOD 26-04.
What's compelling: More than a third of actively exploited vulnerabilities trace back to 2025 or earlier, so the exposure most likely to be used against you is patch debt you already had, not a zero-day published this quarter.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2014-125110CVE-2015-1000013
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026