The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

As cited

Copy frozen at 2026-10-15 20:18 UTC (site build).

vulnerabilities

The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

CVE volume crossed 70,000 by the end of September 2026, doubling year-over-year, though the Known Exploited Vulnerabilities (KEV) catalog grew only 37 percent, suggesting discovery outpaces active exploitation. Over a third of exploited vulnerabilities trace to 2025 or earlier, indicating a persistent patch debt despite the high absolute CVE count. A 27 percent share of new CVEs affect networking gear, prompting vendors and security teams to verify detection tooling coverage.

Why it matters: Enterprise defenders and vulnerability management teams must prioritize patching legacy vulnerabilities on their backlog rather than chase every new CVE discovery; organizations with networking equipment face elevated exposure and should audit their configurations and update tooling to detect these vulnerabilities.

Source published

2026-10-15 18:00 UTC

First seen by Cybersecurity Tracker

2026-10-15 19:02 UTC