Quarterly report · Q3 2026

Exploited vulnerabilities in Q3 2026: 100 added to CISA KEV, up 33% on Q2 2026

Mihai Marangoci, Gociux · 25 Oct 2026 · covers 1 Jul 2026 – 30 Sep 2026 · data: JSON · 4 min read

In Q3 2026 (1 Jul 2026 to 30 Sep 2026), CISA added 100 vulnerabilities to its Known Exploited Vulnerabilities catalog, up 33% on the previous quarter (75). That is 0.27% of the 36,953 CVEs published in the same period: a small list, and the one to patch first. 9 of the 100 (9%) were CVEs from 2024 or earlier, so old, unpatched systems remain a main entry point. Microsoft had the most entries (12), and 6 were known to be used in ransomware campaigns.

Compared with earlier quarters

Which vendors were exploited

New KEV entries by vendor, with the most affected products.

Old bugs, still exploited

Age of the vulnerabilities added this quarter, by the year in their CVE ID. Anything two years or older had a fix available long before it showed up as exploited.

What kind of flaws

The most common weakness types (CWE) among this quarter's additions.

Microsoft Patch Tuesday this quarter

1,946 Microsoft CVEs fixed across 3 releases; 6 already exploited at release and 214 rated critical.

What to do with this

• Hunt old CVEs, not just new ones. 9 of this quarter's 100 exploited vulnerabilities were at least two years old. Scan for them by CVE ID across everything internet-facing, including appliances nobody patches.
• Check the top vendors first: Microsoft, Cisco, Linux, Citrix, JFrog. Our stack check lists the exploited CVEs for the products you run.
• Plan for short deadlines. 78 entries had a federal remediation deadline of 7 days or less (median: 3 days). Set your own SLA for KEV entries and measure it.
• Microsoft: 12 KEV additions this quarter were Microsoft products, and Patch Tuesday fixed 6 vulnerabilities already exploited at release. Deploy those within days, the rest on your normal cycle.
• Report on it. For NIS2 (art. 21(2)(e)) and DORA, "we patch KEV entries within N days" is a measurable control an auditor can test.

Questions

How many vulnerabilities were exploited in Q3 2026?

CISA added 100 vulnerabilities to its Known Exploited Vulnerabilities catalog between 1 Jul 2026 and 30 Sep 2026. KEV only lists vulnerabilities with reliable evidence of exploitation and a clear fix, so the real number exploited is higher.

Which vendor had the most exploited vulnerabilities in Q3 2026?

Microsoft, with 12 new KEV entries. Next were Cisco (7), Linux (5), Citrix (4).

How is this report made?

Automatically, from public data only: the CISA KEV catalog for exploitation, the official CVE list (CVEProject/cvelistV5) for publication counts, and Microsoft's CVRF API for Patch Tuesday. The raw numbers are published as JSON so anyone can check or reuse them.

How this is made: generated automatically after the quarter ends from the CISA KEV catalog (date added, vendor, CWE, ransomware use, due date), the official CVE list (CVEs in PUBLISHED state, by publication date) and Microsoft's CVRF API (Microsoft-assigned CVEs first published on Patch Tuesday). KEV due dates are set for US federal agencies under BOD 22-01. Free to reuse with attribution (CC BY 4.0). Updated: 2026-10-25.