CVE volume in 2026 is far above any earlier year. The NVD lists 86,533 CVE records published by 25 October, against 48,151 in all of 2025 and 28,816 in 2023. January to June had 46 percent more records than July to December 2025. Every one of those numbers is real and every one of them gets quoted in board decks.
The part that rarely follows is the denominator. CISA added 272 vulnerabilities to its Known Exploited Vulnerabilities catalog in 2026 through 23 October, about 3 for every 1,000 CVE records. That compares two different populations, because KEV entries include older CVEs, so read it as a rough guide and not as an exploitation rate. Volume grew faster than the exploited population: KEV additions rose 29 percent over the previous half year, against 46 percent for CVE records.
This article covers the gap between those two curves, the vulnerabilities that landed on the wrong side of it, and what they had in common. Our post on this year’s CVE counts and what drives them explains how the totals were counted. For single flaws, the Knowledge Hub keeps profiles of exploited vulnerabilities.
| 86,533 CVE records published from 1 January to 25 October 2026, three times the 28,816 of 2023. | 146 vulnerabilities entered the CISA KEV catalog in the first half of 2026, and 272 by 23 October. | 1.3% of 1,061 vulnerabilities attributed to AI assisted discovery were confirmed exploited (VulnCheck, July 2026). | 80 days median from CVE publication to listing in VulnCheck’s KEV catalog, down from 120 in 2025. |
CVE Volume and the Denominator Nobody States
Volume statistics are quoted without a base rate because the base rate is unflattering to the statistic. Saying that tens of thousands of CVE records have been published this year sounds like an emergency. Saying that CISA added 272 known exploited entries over the same period, about 3 per 1,000 records, sounds like a planning problem, which is what it is.
The second figure is the one that changes behavior. A team that treats every new record as inbound work will burn its capacity on triage and still miss the ones that matter, because those are not spread evenly. They cluster in a few product classes, as the sections below show.
VulnCheck keeps a larger exploited list of its own. It puts the ratio of new KEV entries to new CVEs at 1.4 percent for January to June 2026, against a 2.7 percent peak in late 2023. In its State of Exploitation 1H 2026 report of 28 July 2026, it says it is too early to tell if exploitation will catch up. Evidence often appears months or years after disclosure.
AI Discovery and the Volume Curve
Part of the recent growth is plausibly automated and AI assisted discovery, but public data does not say how much. VulnCheck attributed 1,061 vulnerabilities to AI assisted discovery in the report named above. Fourteen of them, 1.3 percent, were confirmed exploited in the wild, roughly the rate for all vulnerabilities in the same half year.
That ratio needs careful reading. It does not mean AI discovered vulnerabilities are harmless. It means they have been exploited no more often than other bugs so far. In our assessment, a rising CVE count currently says more about how much is found and reported than about how much is used against us.
The CVEs That Actually Mattered Since December 2025
Abstractions about prioritization are easy to agree with and hard to act on. The concrete version is a short list of vulnerabilities that defenders had to act on fast, mostly from the CISA KEV catalog. It is our selection, not a ranking.
| CVE | PRODUCT | WHY IT MATTERED | FURTHER READING |
| CVE-2025-55182 React2Shell | React Server Components | Disclosed on 3 December 2025 with the maximum score of 10.0. Unauthenticated remote code execution in a widely used web framework. AWS reported exploitation attempts by China state linked groups, including Earth Lamia and Jackpot Panda, within hours. CISA listed it on 5 December 2025. | React2Shell vulnerability profile |
| CVE-2026-63030 CVE-2026-60137 WP2Shell | WordPress Core | Two flaws chained into unauthenticated remote code execution on default WordPress installations, according to CISA. The SQL injection scores only 5.9 alone, and the route flaw scores 9.8. CISA listed both on 21 July 2026, four days after NVD published them. | WP2Shell technical analysis |
| CVE-2026-64638 XSS2Shell | WordPress Core | Cross site scripting on the login page that can be escalated to remote code execution. NVD says this needs social engineering, a victim’s interaction and conditions outside the attacker’s control. It scores 8.9 on CVSS 4.0, as rated by HackerOne, and was not in the CISA KEV catalog on 23 October. | XSS2Shell technical analysis |
| CVE-2026-8037 | Progress Kemp LoadMaster | Unauthenticated command injection in a load balancer. Progress scores it 9.6 and NVD 9.8, and the record was published on 4 June 2026. According to eSentire, exploitation attempts began on 29 June 2026, when a public proof of concept appeared. CISA listed it on 7 August. | NVD record for CVE-2026-8037 |
| CVE-2026-1281 | Ivanti EPMM | Code injection in a mobile device management platform, scored 9.8, that allows unauthenticated remote code execution. Ivanti disclosed it on 29 January 2026. Unit 42 describes it as a zero day, and CISA listed it the same day. | NVD record for CVE-2026-1281 |
| CVE-2026-1731 | BeyondTrust Remote Support and Privileged Remote Access | Operating system command injection in privileged remote access software, reachable without authentication and scored 9.8 by NVD. CISA listed it on 13 February 2026 and marks its use in ransomware campaigns as known. | BeyondTrust CVE-2026-1731 profile |
| CVE-2026-21509 | Microsoft Office | Security feature bypass that needs a user to open a crafted file, scored 7.8. Microsoft shipped an out of band fix on 26 January 2026 and CISA listed it that day. Zscaler tied a campaign using it to APT28 with high confidence. | NVD record for CVE-2026-21509 |
What the Ones That Mattered Had in Common
Read down that list and the selection criteria write themselves. Severity score did not set these apart: the WordPress SQL injection scores 5.9 and the Office bypass 7.8.
| SHARED PROPERTY | WHY IT DECIDES EXPLOITATION |
| Reachable without credentials | React2Shell, WP2Shell, Kemp LoadMaster, Ivanti EPMM and BeyondTrust need no credentials. The Office flaw needs a victim to open a file, and XSS2Shell needs a victim to visit an attacker’s page. In our assessment, a flaw that requires an existing session competes with thousands of others for attacker attention and usually loses. |
| Sits in a concentrated product class | VulnCheck found that content management systems made up one third of the 495 vulnerabilities in its KEV catalog for the first half of 2026. It ties most of that volume to WordPress plugins. It calls network edge devices highly targeted and says device management platforms were exploited faster than most other categories. In our assessment, attackers pre position against categories, not products. |
| Ubiquitous deployment | A framework or CMS embedded in millions of sites turns one exploit into an untargeted campaign. In our assessment, scale of deployment is a stronger predictor than depth of impact. |
| Short path from disclosure to weaponization | In VulnCheck’s catalog the median time from CVE publication to listing fell from 120 days in 2025 to 80 days in the first half of 2026. For 23.4 percent of its entries, exploitation was seen on or before the publication day, against 28.9 percent in 2025. The window for a deliberate patch cycle is short, and for nearly one in four there is no warning at all. |
Replacing Volume With Four Filters
The practical answer to volume is not a faster queue. It is a smaller queue, produced by filters applied in this order.
| FILTER | THE QUESTION IT ANSWERS |
| 1. Reachability | Is this asset exposed to the internet, and can an unauthenticated request reach the vulnerable component? This filter can remove most published CVEs from your working set, and it is the only filter that can be applied before anyone knows whether a flaw will be exploited. |
| 2. Exploitation evidence | Is there public exploit code, observed scanning, or confirmed in the wild use? Evidence beats severity, and its absence is meaningful information rather than an excuse to defer indefinitely. |
| 3. Product class concentration | Does this sit in a category that attackers systematically target, meaning content management, edge security appliances, remote access or device management? A medium severity flaw in a concentrated class outranks a critical one in a niche product. |
| 4. Business dependency | If this system is taken offline as a containment measure, what stops? Knowing this in advance converts an incident decision into a pre made one. |
Applied to this year’s records, these four questions produce a list a human being can actually work through. Applied in the wrong order they produce the queue most teams have now, sorted by a severity score that was never designed to predict attacker behavior.
Brandefense Coverage
| CAPABILITY | WHAT IT ADDRESSES |
| EASM | Continuous discovery of externally exposed assets, subdomains, certificates and shadow IT, which is what answers the reachability filter without waiting for an internal inventory to be updated. |
| Cyber Threat Intelligence | Threat actor tracking, ransomware group activity and technique mapping, which is what supplies the exploitation evidence filter with something better than a severity score. |
| Dark Web Monitoring | Collection across surface, deep and dark web from more than 100,000 sources, with honeypots in more than 40 countries. It covers the channels where exploit capability and access to affected products are traded. |
RELATED READING
Vulnerability Exploitation Trends: H1 2026: What Threat Actors Are Actually Using The full exploitation picture behind the volume figures used here.
Why CVSS Scores Are Lying to Your Security Team (And What to Use Instead) Why the score you are currently sorting by does not predict what gets attacked.
From Disclosure to Exploit: How Fast Are Threat Actors Weaponizing New CVEs? How little time the filters above have to run before exploitation begins.
XSS2Shell (CVE-2026-64638): WordPress Login Page Pre-Auth XSS to RCE Chain Explained One of the vulnerabilities in the table above, taken apart in full technical detail.
Vulnpocalypse is a good word for a real phenomenon, but it describes the publishing rate rather than the threat. The organizations that handle 2026 well are not the ones that process tens of thousands of advisories. They are the ones that can answer, on the morning an advisory lands, whether the affected product was running anywhere they could be reached. That question has nothing to do with volume, and it is the only one that scales.
BeyondTrust CVE-2026-1731 and three other remote support and file transfer flaws flagged for ransomware use are covered in Remote support and file transfer flaws in ransomware attacks.