The Q3 vulnerability pulse shows a widening gap between the number of vulnerabilities being disclosed and the smaller subset known to be exploited. Cisco Talos published its analysis on 15 October 2026, highlighting record CVE issuance, ageing patch debt and important changes to vulnerability data feeds.
This is not a single vulnerability affecting one vendor or product. It is a broad change in the volume, format and prioritisation of vulnerability information that security teams and their supporting tools must process.
Q3 vulnerability pulse records rapid CVE growth
Talos asserted that more than 70,000 Common Vulnerabilities and Exposures, or CVEs, had been issued by the end of September 2026. According to its Q3 vulnerability pulse, CVE volume increased by 105 per cent year on year, while additions to CISA’s Known Exploited Vulnerabilities catalog grew by 37 per cent.
The contrast is central to the report. CVE publication records the identification and disclosure of a vulnerability, but it does not establish that attackers are exploiting it. The KEV catalog covers the narrower group for which reliable evidence of exploitation in the wild exists.
The reported figure of more than 70,000 CVEs should be treated with some caution. At publication, the official CVE Program metrics page had only reconciled figures through the second quarter of 2026, when 35,872 records had been published during the year. Official Q3 totals were not yet available to corroborate the Talos figure, and live third-party dashboards can use different counting methods.
Independent research nevertheless supports the wider conclusion. VulnCheck’s analysis of the first half of 2026 found that CVE volume increased by about 45 per cent compared with the previous six months, while KEV entries rose by about 10 per cent. The resulting decline in the KEV-to-CVE ratio also indicates that vulnerability discovery is growing faster than confirmed exploitation.
Exploitation at disclosure became less common
VulnCheck found that 23.43 per cent of KEV vulnerabilities were exploited at or before their publication during the first half of 2026, a lower proportion than in 2025. It also calculated that the median interval between CVE publication and KEV listing fell from 120 days in 2025 to 80 days in 2026.
These figures do not mean exploitation is declining across the board. CISA continued adding exploited vulnerabilities to KEV during September 2026. They instead show why disclosure totals alone cannot provide a reliable measure of immediate attack activity.
Older flaws remain prominent in the Q3 vulnerability pulse
Talos reported that CVEs dating from 2025 or earlier accounted for 33 per cent of the known exploited vulnerabilities in its analysis. This means approximately one third of the observed exploitation burden related to flaws that organisations may already have had time to identify and remediate.
Among CVEs published in 2026, Talos found that 29 per cent were added to KEV on the same date they were published. This was only two percentage points above the figure for all of 2025, leading Talos to reject the idea that organisations are facing a widespread zero-day crisis.
The Q3 vulnerability pulse also classified 27 per cent of the relevant vulnerabilities as related to networking equipment. That proportion is based on Talos’ own classification and has not been independently confirmed, but it draws attention to devices such as routers, firewalls and other network appliances that may be internet-facing and operationally difficult to patch.
No indicators of compromise were published with the report because it describes an ecosystem-wide trend rather than one intrusion campaign. Exploitation status must therefore be assessed for each individual CVE through KEV entries, vendor advisories and relevant incident evidence.
Six-digit CVEs can expose tooling weaknesses
A practical issue identified by Talos is the organic arrival of six-digit CVE identifiers during 2026. Public security trackers now contain identifiers such as CVE-2026-103111, demonstrating that longer references are in active use rather than being only a theoretical possibility.
The CVE syntax permits four or more digits in the numeric section after the year. However, vulnerability scanners, ticketing platforms, spreadsheets, regular expressions, databases and reporting dashboards may still assume that an identifier contains only four or five digits.
A fixed-length assumption could cause a six-digit CVE to be truncated, rejected or missed during matching. This could produce false negatives, break links between scanner findings and asset records, or prevent an applicable KEV entry from triggering a remediation task.
The Q3 vulnerability pulse therefore affects any product or internal process that parses CVE identifiers. There are no particular affected software versions to list. Compatibility depends on how each tool validates, stores, exchanges and displays CVE data.
CISA adds the forensicTriage field to KEV
Talos also highlighted a schema change in CISA’s KEV feed. The structured feed already provides fields including the CVE identifier, required action and remediation due date. It now includes a field named forensicTriage.
CISA defines this field as Yes when Binding Operational Directive 26-04 requires forensic triage for the listed vulnerability. CISA issued BOD 26-04 on 10 June 2026 to support risk-based security update prioritisation across organisations within the directive’s scope.
The distinction matters because a flagged entry calls for more than installing an update. Applicable federal organisations must conduct the required forensic triage and incident response activities before or alongside remediation, following CISA’s implementation guidance. For organisations outside the directive’s scope, including UK businesses, the flag can still provide a useful indication that compromise assessment should accompany patching.
Automated systems built against an older KEV schema may ignore the field or fail when the feed changes. Security teams should confirm that their integrations ingest and retain it, and that a Yes value can activate the appropriate investigation workflow.
What organisations should do following the report
The Q3 vulnerability pulse supports focused validation rather than indiscriminate emergency patching. Organisations should prioritise vulnerabilities with evidence of exploitation while ensuring that data and automation changes do not hide relevant findings.
- Test scanners, databases, ticketing systems and regular expressions with a six-digit identifier such as CVE-2026-103111.
- Confirm that KEV feeds use the current CISA schema and correctly process the forensicTriage field.
- Treat forensicTriage entries as potential incident response triggers, not solely as patching tasks.
- Review unresolved KEVs from 2025 and earlier, particularly on internet-facing systems and network appliances.
- Keep CVSS severity in context by combining it with exploitation evidence, exposure and asset importance.
The disclosure surge increases the workload for vulnerability management teams, but the Q3 vulnerability pulse does not show that every new CVE presents the same immediate danger. The more pressing issue is whether organisations can reliably process longer identifiers, consume current KEV data and close older exploited weaknesses before attackers continue to benefit from patch debt.
Originally reported by blog.talosintelligence.com.
