cyber.hendryadrian.com
Security Insights · iru.com

CVE Disclosures More Than Doubled in 2026, but Confirmed Exploitation Rose 31%

· Original article ↗

Summary

The article finds 2026 CVE disclosures rose about 2.3x year over year through late October, while CISA KEV additions rose about 31%. It argues defenders should prioritize exposed edge devices, rapid patching and behavioral detection.

Key points

  • The NVD recorded about 88,700 CVEs from January 1 to October 29, 2026, versus about 39,300 in the same period of 2025; automated assignment, more CVE Numbering Authorities and incomplete severity enrichment affect the totals.
  • CISA added 278 vulnerabilities to KEV through October 28, versus 212 in the same 2025 period. The article cautions that KEV listing lags exploitation and that older flaws continue to be added.
  • CyberHire counted 769 CVEs in 2026 with an AI system credited as the finder, compared with 34 in the same 2025 period. That is less than 1% of the total, and incomplete crediting means AI’s contribution to the disclosure surge is uncertain.
  • The article says exploitation is concentrated on internet-facing edge equipment: 15 of 38 KEV additions from September 21 to October 20 involved firewalls, VPNs, gateways or remote-access tools.
  • Volexity observed actor UTA0576 chaining three zero-days to obtain root access on a fully patched Ivanti Connect Secure appliance at one customer.
  • PHP2Shell exploitation attempts were reported on October 17, before the October 21 patch; CISA added both related CVEs to KEV on October 26.
  • The recommended response is to identify exposed assets, rapidly patch or mitigate edge devices, investigate for compromise, and prioritize behavioral detections over writing signatures for every disclosure.

Article Details

Topic
Vulnerability disclosures increased sharply in 2026 while confirmed exploitation grew more slowly, highlighting the need to prioritize and rapidly mitigate exploited edge-device vulnerabilities.

CVE

CVE-2026-96951Microsoft · Microsoft Edge (Chromium-based); Microsoft · Outlook.com; +18 moreExactly one was confirmed exploited: a Windows Shell Mark of the Web bypass, CVE-2026-96951.

Threat Actors

UTA0576Volexity tracks UTA0576 as a previously unknown actor that chained three zero-days to gain root access to a fully patched Ivanti Connect Secure appliance. Volexity observed the activity on one customer's device.

Products

BeyondTrust Remote SupportCitrix NetScaler and BeyondTrust Remote Support were exploited for weeks before the flaws were disclosed.Citrix NetScalerCitrix NetScaler and BeyondTrust Remote Support were exploited for weeks before the flaws were disclosed.Ivanti Connect SecureIvanti Connect Secure fell to a previously unknown actor Volexity tracks as UTA0576, who chained three zero-days to get root on a fully patched appliance from October 3.

Related Articles