Q3 2026 Vulnerability Landscape Shows 70k New CVEs but Exploitation Lags
What Happened — Cisco Talos reports that more than 70 000 CVEs were assigned in Q3 2026, a historic volume. While the total CVE count rose 105 % year‑over‑year, the number of known exploited vulnerabilities (KEVs) grew only 37 %, indicating a widening gap between discovery and active exploitation. The report highlights that roughly one‑third of actively exploited flaws still stem from 2025 or earlier, underscoring lingering patch debt.
Why It Matters for Trust & Control Assurance
- Continuous vulnerability‑management programs must prove not just that new flaws are discovered, but that they are triaged, patched, and documented – the exact evidence a control‑assurance framework demands.
- The “forensicTriage” flag in the KEV list maps to the control objective of Vulnerability Management & Remediation, a single control that satisfies requirements across SOC 2, ISO 27001, NIST CSF 2.0 and others.
- Verisq’s Control Mapping capability lets you capture remediation evidence in real time, generate audit‑ready reports, and demonstrate ongoing compliance with that control.
Who Is Affected
- Enterprises with large, heterogeneous IT estates (e.g., manufacturing, financial services, healthcare).
- Vendors of networking gear and legacy platforms that often host older, unpatched code.
Recommended Actions
- Prioritize KEV‑listed vulnerabilities and any legacy CVEs still unpatched.
- Map each remediation step to the “Vulnerability Management” control objective in your chosen framework.
- Capture patch‑deployment evidence continuously to build a defensible audit trail.
Source: Cisco Talos – Q3 Vulnerability Pulse
Technical Notes
- CVE volume up 105 % YoY; KEV growth only 37 %.
- ~33 % of KEVs trace to 2025 or earlier; networking gear accounts for 27 % of new CVEs.
- New “forensicTriage” column in KEV flags high‑risk flaws that require mandatory incident‑response workflows.
Source: same as above