Vulnerability exploitation in H1 2026 centers on network edge devices, identity platforms and AI tooling, often attacked before a patch exists. CISA added 146 vulnerabilities to its Known Exploited Vulnerabilities catalog between January and June 2026. The threat actors behind it include state-sponsored groups, ransomware crews with initial access brokers, and automated internet scanners.
A data-driven analysis of the first half of 2026. It covers CVE volume, exploitation speed, zero-day vs. n-day ratios, the most targeted technology categories, and how exploitation is spread across sectors.
For a share of vulnerabilities, exploitation begins on or before the day the CVE is published. In those cases there is no patch to apply and no advisory to read. Often there is no signal at all that a vulnerability is being actively weaponized. That reality changes how vulnerability management has to work.
The first half of 2026 confirms that this is not an edge case. It is the new operational baseline. CVE volume keeps rising: the National Vulnerability Database published 37,126 CVE records between 1 January and 30 June 2026. The technology categories hit hardest are network edge devices, identity platforms, and a newly emerging AI infrastructure attack surface. These are precisely the categories that traditional patch management programs handle most poorly.
This is Brandefense’s first-half vulnerability exploitation analysis. Every figure comes from CISA’s KEV catalog or NIST’s National Vulnerability Database, and each was checked on 8 October 2026. The H2 edition will follow in December with the second-half picture. The goal of both editions is the same. It is not a catalog of scary numbers. It is a data-grounded answer to one operational question: what do threat actors actually use to get in, and how does that change what defenders need to prioritize? Profiles of single flaws are in the Knowledge Hub list of vulnerabilities used in real attacks.
| 1,630 entries in the CISA KEV catalog on 30 June 2026 (CISA) | 146 vulnerabilities added to KEV in H1 2026, 21 of them flagged for known ransomware use (CISA) | 37,126 CVE records published in NVD from January to June 2026 (NIST) | 94 older vulnerabilities, with CVE IDs from before 2025, added to KEV during 2025 (CISA) |
Zero-Day, N-Day: Why the Distinction Matters in H1 2026
Before the data, two terms that appear throughout this analysis need a precise definition. They describe structurally different threat scenarios that require different defenses.
A zero-day vulnerability is one that is being actively exploited while it is still unknown to the public, the vendor, and the defender. No patch exists because no one outside the attacker knows the vulnerability is there. Detection is impossible through standard patch-gap analysis because there is no disclosed CVE to check against.
An n-day vulnerability (where n = number of days since disclosure) is one that has been publicly disclosed and for which a patch typically exists. It is still being exploited against organizations that have not yet applied the fix. ‘N’ can be 1 day, 30 days, 180 days, or, as CISA’s KEV catalog documents, 18 years. The n-day category is where the majority of successful exploits occur. This is not because zero-days aren’t dangerous. It is because n-day exploitation scales across thousands of unpatched organizations at once.
Both matter at the same time: zero-day exploitation leaves defenders no warning, and legacy n-day exploitation targets organizations that have never patched known vulnerabilities. This is not a paradox; it reflects two distinct attacker populations operating at opposite ends of the capability spectrum, both finding success.
How Many New Vulnerabilities Are We Actually Dealing With?
The velocity of vulnerability disclosure has fundamentally changed the math of vulnerability management. In 2023, the National Vulnerability Database published about 85 new CVE records per day. In the first half of 2026, that figure reached about 205 per day. For the year-to-date count and what is driving it, see our year-to-date CVE numbers for 2026.
Likely contributors include:
- AI-assisted vulnerability discovery, which lets researchers (and attackers) surface software defects at machine speed.
- The CVE program’s expansion to additional CNA (CVE Numbering Authority) partners. More organizations now have authority to assign CVEs directly.
- The software attack surface itself. It expands with every new AI platform, cloud service, and connected device category added to enterprise environments.
| Period | CVE records published (NVD) | YoY Change | Daily Average |
| 2023 | 30,949 | Baseline | ~85 / day |
| 2024 | 40,704 | +31.5% | ~111 / day |
| 2025 | 49,972 | +22.8% | ~137 / day |
| H1 2026 (Jan to Jun) | 37,126 | Half year only | ~205 / day |
Source: NIST NVD CVE API, counts by publication date, queried 8 October 2026
The volume problem creates a prioritization crisis. Manual triage is no longer viable. CVSS scores, the industry-standard severity rating system, describe how severe a flaw is, not whether anyone is exploiting it. Organizations that rely exclusively on CVSS scores to decide what to patch first are missing the exploitation signal.
| 💡 What Should Replace CVSS? The answer is not to abandon CVSS; it still provides useful severity context. The answer is to augment it with exploitation signals: EPSS (Exploit Prediction Scoring System) scores, which estimate exploitation probability based on real-world telemetry, and direct exploitation evidence from sources like the CISA KEV catalog. A CVSS 6.5 vulnerability actively exploited by ransomware groups is a higher priority than a CVSS 9.8 vulnerability with no documented exploitation activity in your sector. |
How Fast Are Attackers Moving? The H1 2026 Exploitation Speed Data
Speed is the dimension of the 2026 vulnerability landscape that most fundamentally challenges traditional security operations. The window between ‘this vulnerability exists’ and ‘this vulnerability is being exploited against real targets’ has shrunk. In some cases it has closed before the vulnerability is disclosed at all.
Can Vulnerability Exploitation Start Before Disclosure?
When a vulnerability is exploited on or before the day its CVE is published, the defender has zero warning time from disclosure. By the time the CVE exists, exploitation has already begun.
Discovering and weaponizing undisclosed vulnerabilities takes resources that put this capability beyond most criminal actors. But the downstream effect is a shrinking window for defenders across all vulnerability types. This affects every organization, whether or not it is a direct espionage target.
| 🔴 The Legacy N-Day Problem Nobody Talks About While attention focuses on zero-days and sub-24-hour exploitation, CISA added 94 pre-2025 vulnerabilities to the KEV catalog in 2025. The oldest: CVE-2007-0671, an 18-year-old Microsoft Office Excel vulnerability still being actively exploited in 2025. The implication: patching new CVEs fast is necessary but not sufficient. Organizations also carry vulnerability debt from past years that attackers continue to exploit against systems that were never remediated. A comprehensive H1 2026 vulnerability program must address both the front end (new disclosures) and the long tail (legacy exposure inventory). |
What Technologies Are Threat Actors Targeting Most in H1 2026?
Attackers select targets rationally. They prefer technologies with:
- wide deployment (more potential victims)
- high access value (more damage per compromise)
- slow patching cycles (longer exploitation windows)
The H1 2026 targeting distribution reflects exactly this logic.
Network Edge Devices: A Prime Target
Network edge devices, meaning VPN appliances, firewalls, network access controllers, and SD-WAN infrastructure, are a prime target for exploitation. CISA’s KEV catalog shows the vendors whose products were the subject of the vulnerabilities. Of the 146 entries added between January and June 2026, 27 are Microsoft products, 11 Cisco, 5 Ivanti and 3 Fortinet. The Knowledge Hub also has the Salt Typhoon telecom intrusions and Cisco SD-WAN exploitation incident pages. Cases in our incident library include FortiCloud SSO exploitation in January, the SharePoint exploitation wave of 2026 and, later, the NetScaler zero-days.
The reason is structural. Edge devices sit at the network boundary by design. In many configurations they are internet-facing without additional authentication. They are also significantly harder to patch than desktop software, because patching often requires maintenance windows, planned downtime, and physical access.
Wireless controllers have had critical flaws too. In October 2026 HPE fixed eight ArubaOS flaws rated CVSS 10.0 that need no login, and none was known to be exploited at release. Our ArubaOS CVE-2026-79844 page lists the affected and fixed versions.
Identity and Authentication Platforms
Identity infrastructure is another high-value target category: SSO providers, Active Directory, LDAP directories, and cloud identity platforms. An identity platform compromise does not provide access to one system. It provides access to every system connected to that identity fabric.
AI Developer Tooling: The New Attack Surface
Two AI developer tools were added to the CISA KEV catalog in H1 2026.
- CVE-2026-39987: pre-authentication remote code execution in the Marimo Python notebook platform, added 23 April 2026.
- CVE-2026-42208: SQL injection in BerriAI’s LiteLLM AI proxy, which routes queries to multiple LLM providers, added 8 May 2026.
AI infrastructure platforms often hold broad network access, sensitive API credentials for cloud services and LLM providers, and large volumes of processed enterprise data. The security scrutiny applied to traditional web applications has not always been applied to AI infrastructure deployed in the same environments.
Six Exploited CVEs to Know in H1 2026
The following entries represent the most operationally significant CVEs of H1 2026 drawn from the CISA KEV catalog. Each reflects a different dimension of the exploitation landscape described above.
| CVE-2026-39987 | Marimo Python notebook; AI developer tooling |
| CVSS: 9.8 (Critical) | KEV listing: Added 23 April 2026 Exploited By: Not named in the KEV entry Impact: Pre-authentication remote code execution: an unauthenticated attacker can get shell access and run arbitrary system commands. |
| CVE-2026-21509 | Microsoft Office |
| CVSS: 7.8 (High) | KEV listing: Added 26 January 2026 Exploited By: Not named in the KEV entry Impact: Security feature bypass caused by reliance on untrusted inputs in a security decision. Some affected products may be end-of-life, and Microsoft advises moving to a supported version. |
| CVE-2025-53770 | Microsoft SharePoint Server |
| CVSS: 9.8 (Critical) | KEV listing: Added 20 July 2025 Exploited By: CISA lists known use in ransomware campaigns Impact: Deserialization of untrusted data in on-premises SharePoint Server lets an unauthorized attacker execute code over a network. It can be chained with CVE-2025-53771 and is a patch bypass for CVE-2025-49704. |
| CVE-2026-42208 | BerriAI LiteLLM; AI infrastructure |
| CVSS: 9.8 (Critical) | KEV listing: Added 8 May 2026 Exploited By: Not named in the KEV entry Impact: SQL injection that lets an attacker read, and potentially modify, the proxy’s database, leading to unauthorized access to the proxy and the credentials it manages. |
| CVE-2025-64446 | Fortinet FortiWeb |
| CVSS: 9.8 (Critical) | KEV listing: Added 14 November 2025 Exploited By: Not named in the KEV entry Impact: Relative path traversal that may let an unauthenticated attacker execute administrative commands through crafted HTTP or HTTPS requests. |
| CVE-2025-54313 | eslint-config-prettier (npm) |
| CVSS: 7.5 (High) | KEV listing: Added 22 January 2026 Exploited By: Not named in the KEV entry Impact: Embedded malicious code in a published npm package: installing an affected version runs an install.js file that launches malware on Windows. A software supply chain case. |
Source: CISA KEV Catalog; NIST NVD (CVSS v3.1 base scores)
Which Sectors Are Being Hit Hardest in H1 2026?
Vulnerability exploitation is not uniformly distributed. The sectors facing the highest exploitation volume are not always those with the lowest defenses. Some high-value targets attract sophisticated actors regardless of security investment. But the sectors with the longest remediation timelines face compounding risk. The risk comes not just from the current period’s disclosures but also from unpatched exposure built up over prior years.
| Sector | Primary Exploit Type | Primary Threat Actor |
| Government | Zero-day + rapid n-day | State-sponsored APT (China, Russia, NK) |
| Telecom | Network edge device | Salt Typhoon, Volt Typhoon |
| Financial Services | Authentication bypass, identity | Ransomware, FIN groups |
| Healthcare | Legacy n-day, unpatched infra | Ransomware |
| Manufacturing | OT/IT boundary, VPN, MFT | Ransomware, Clop |
| Technology | AI tooling, CI/CD, SaaS | State APT, supply chain actors |
| Education | CMS, remote access, VPN | Ransomware, opportunistic |
| Critical Infrastructure | Network edge, OT protocols | Volt Typhoon, Sandworm |
Note: the sector rows are Brandefense’s qualitative assessment, not measured figures.
Sectors with operational limits on patching, such as healthcare and education, face a particular problem. Against an exploitation window that can close before a patch is applied, they cannot outpace attackers through patching alone. The implication is not that these organizations should simply patch faster; operational constraints make that impossible for much of their infrastructure. The implication is that compensating controls (network segmentation, behavioral detection, access restriction) must carry the defensive burden that patching alone cannot.
Who Is Behind H1 2026’s Exploitation Campaigns?
The exploitation landscape in H1 2026 is driven by three structurally distinct attacker populations. They do not share targets, timelines, or objectives; but they share the same vulnerability pipeline.
State-Sponsored APTs: Zero-Day Operators
Chinese APT groups run the most active nation-state exploitation campaigns. Most notable are Salt Typhoon, which targets telecommunications backbone infrastructure, and Volt Typhoon, which targets critical infrastructure for persistent pre-positioning. Russian GRU-linked actors (Sandworm, APT28) continue targeting critical infrastructure and government networks.
These actors have the resources to discover and weaponize undisclosed vulnerabilities. They also benefit from a defensive asymmetry: their zero-day exploitation generates no CVE, no vendor advisory, and no patch to detect via gap analysis. Detection requires behavioral telemetry and threat intelligence that identifies attack patterns independent of CVE status.
Ransomware Groups and Initial Access Brokers: The N-Day Economy
Ransomware operators and the IABs who supply them operate mainly in the n-day space. They exploit vulnerabilities days to weeks after public disclosure, against organizations that have not yet patched. This is an economic decision. N-day exploitation scales across thousands of unpatched organizations at once. It generates far higher returns per exploit development investment than targeted zero-day campaigns.
CISA’s KEV catalog flags 31 of the 245 vulnerabilities added in 2025 as known to have been used in ransomware campaigns. Once an IAB sells access to a ransomware affiliate, defenders have little time left before deployment. This makes initial access detection, not lateral movement detection, the operationally critical control layer.
Opportunistic Actors: Mass Exploitation at Scale
The third category consists of automated campaigns that scan the entire public internet for any reachable instance of a newly disclosed vulnerable product. Internet-facing products such as FortiWeb (CVE-2025-64446) are exactly this target pool. Opportunistic exploitation is not targeted: it hits every unpatched internet-facing instance regardless of the organization’s sector, size, or perceived value. It is the automation of the n-day economy at mass scale.
| Topic | State-sponsored APTs | Ransomware and IABs | Opportunistic actors |
|---|---|---|---|
| Where they work | Zero-day | N-day | N-day at mass scale |
| Method | Discover and weaponize undisclosed vulnerabilities | Exploit unpatched organizations days to weeks after public disclosure | Scan the public internet for any reachable vulnerable instance |
| Key point | Beyond most criminal actors, but shrinks the defenders’ window for everyone | Scales across thousands of unpatched organizations at once | Not targeted; hits every unpatched internet-facing instance |
What H1 2026 Means for Your Vulnerability Program
Six operational conclusions emerge directly from the H1 2026 data. Each addresses a specific assumption in traditional vulnerability management that the data no longer supports.
| What the H1 2026 Data Says | What Your Program Needs to Do |
| Exploitation can begin on or before the day a CVE is published | Sequential patch workflows cannot close the zero-day window. Compensating controls (segmentation, behavioral detection) must be ready to activate before patches exist for high-risk technology categories. |
| CVSS describes severity, not whether a flaw is being exploited | CVSS-only prioritization leaves you working from incomplete risk signals. Augment with EPSS scores and exploitation evidence such as the CISA KEV catalog. |
| CISA KEV is a strong exploitation signal, but one input among several | Use KEV together with EPSS scores and your own exposure data, so prioritization reflects both exploitation evidence and what you actually run. |
| Sectors with patching constraints, such as healthcare and education | Sectors with structural patching constraints need compensating controls as primary defense, not patching velocity. Network segmentation, default-deny policies, and behavioral analytics carry the load that patching cannot. |
| AI tooling reaching KEV in H1 2026 (CVE-2026-39987, CVE-2026-42208) | AI infrastructure platforms require the same external attack surface scanning and vulnerability monitoring applied to traditional web applications. This surface is new but already actively exploited. |
| Access sold by IABs can quickly become a ransomware deployment | Detection at the lateral movement stage is too late. Dark web IAB monitoring for your organization’s credentials and infrastructure is the only layer that provides actionable response time before deployment. |
How Brandefense Supports Vulnerability Intelligence
The H1 2026 data picture requires intelligence that operates at the speed of actual exploitation. Brandefense’s EASM and CTI platform provides three layers that address the specific gaps documented above.
| Brandefense Capability | H1 2026 Vulnerability Landscape Application |
| Continuous External Attack Surface Monitoring | Discovers and assesses all externally exposed assets including network edge devices, identity platforms, and AI tooling; cross-references discovered assets against active CISA KEV entries and exploitation telemetry in real time |
| Vulnerability Exploitation Intelligence | Dark web monitoring for exploit code, PoC releases, and threat actor discussions; provides early warning when vulnerabilities in your technology stack enter active exploitation cycles before KEV catalog addition |
| Threat Actor TTP Intelligence | Tracks which threat actor groups are actively exploiting which CVE families; enables prioritization based on the actual actors targeting your sector, not just generic CVSS severity rankings |
| Initial Access Broker Monitoring | Dark web surveillance for IAB listings targeting your organization; detection at the IAB preparation stage is the layer that provides real response time |
| Ransomware Group Exploitation Tracking | Real-time monitoring of ransomware KEV exploitation campaigns; cross-references your technology stack against active ransomware exploitation portfolios |
| 24/7 Analyst-Supported Escalation | High-severity findings involving active KEV exploitation against your specific technology stack receive immediate analyst escalation with remediation guidance |
| This is the H1 2026 edition of Brandefense’s half-year vulnerability exploitation trend series. The H2 2026 edition will be published in December 2026 covering the July-December exploitation period; trend comparisons to H1 will show whether the patterns documented here accelerated, stabilized, or shifted across the second half of the year. |
For newer 2026 detail, see cyber incidents of 2026 and the lessons agencies drew.
The VPN and firewall flaws that carry the CISA flag “known ransomware campaign use” are listed in Five edge VPN flaws CISA flags for ransomware use. One example is the WatchGuard Firebox flaw CVE-2025-14733, which CISA lists as exploited and flags for known ransomware campaign use.