2025 saw 48,185 CVEs published — roughly 131 a day, up 20.6 percent on the 2024 record of 40,009, which had itself been a 38 percent jump. July 2026 set a new high with 9,771 entries in a single month. By mid-August 2026 the cumulative total of CVEs ever published stood at 376,310.
CISA's KEV catalogue lists 1,665 of them — 0.44 percent.
The conclusion you must not draw from that number
The obvious arithmetic runs: 0.44 percent in KEV, therefore 99.5 percent of vulnerabilities are never exploited. We drew that conclusion ourselves in the first version of this piece. It is wrong.
The KEV catalogue does not measure what gets exploited. It measures what CISA was able to confirm and considers relevant to the US federal government. That is a function of analyst capacity, not attacker behaviour. The clearest evidence: annual additions came to 186 and 187 in 2023 and 2024 respectively. Two near-identical figures in consecutive years say nothing about attackers. They look like throughput.
Credible estimates of actual exploitation sit orders of magnitude above the KEV share. The practical consequence is unchanged — only the reasoning has to hold: you cannot patch everything, and the running order cannot be derived from CVSS.
What changed fundamentally since April
The most important finding of the year is not in a threat report. It is in a NIST announcement.
Since 15 April 2026 the NVD no longer enriches every CVE. NIST has moved to a triage model: enrichment now prioritises CVEs in the KEV catalogue, software used by the federal government, and critical software as defined by Executive Order 14028 — an estimated 15 to 20 percent of intake. Roughly 29,000 backlog CVEs were reclassified as "Not Scheduled". Where the reporting CNA has already supplied a score, NIST no longer issues its own severity rating.
That changes the starting position for any vulnerability management process built on NVD data: the reference dataset is deliberately no longer complete. Pull CVSS from the NVD and for a substantial share of your inventory you will now get nothing at all — or a value the vendor assigned to itself.
The second finding is equally uncomfortable. Mandiant's M-Trends 2026 puts the mean time to exploit a vulnerability at minus seven days. On average, exploitation now happens before a patch exists. The handoff from initial access broker to ransomware affiliate has collapsed to 22 seconds.
A patch cycle that thinks in weeks is defending against an adversary that hands off in seconds.
Why CVSS does not carry prioritisation
CVSS rates theoretical severity, not exploitability in a specific environment. A 9.8 in software you do not run is irrelevant. A 6.5 on an exposed system with a circulating exploit is urgent. The score does not distinguish between them.
The distribution compounds it: only 7.4 percent of 2025 disclosures were rated critical, down from 12.8 percent the year before. Filtering on "everything at 9.0 and above" yields a set that is shrinking but still consists almost entirely of vulnerabilities nobody is attacking.
What counts instead:
- EPSS — the FIRST-maintained prediction of exploitation probability over the next 30 days. A score about likelihood, not severity.
- KEV status — as a confirmed floor, not a claim to completeness.
- Asset context — exposure, criticality, data handled, high-value targets such as domain controllers, VPN gateways or the SIEM itself.
- Compensating controls — segmentation, WAF rules, simple unreachability.
One pattern in the 2025 KEV cohort deserves particular attention: 35 percent of additions concerned network appliances. Microsoft led the vendor list with 54 entries, Cisco with 28, Fortinet with 22. Weight your prioritisation by server count and you weight straight past the perimeter.
Where AI helps, and where it does not
At 48,000 CVEs a year, manual review is not an option. What automates well:
Matching. Which CVE affects which asset at which version? Tedious, error-prone by hand, and the clearest automation gain available.
Correlation. Vulnerability data against threat intelligence: is this CVE being used in campaigns against our sector, and with what tradecraft?
The enrichment the NVD no longer provides. The exact gap NIST left open in April is machine-closable — from CNA records, vendor advisories and exploit sources.
What does not automate is whether a system is business-critical, whether a patch means downtime, and whether a regulatory deadline applies. That information comes from the organisation, not from a model. And for zero-days without a CVE number there is nothing to prioritise.
What to do
- Asset inventory first. Without a complete inventory every prioritisation is guesswork. Network devices, OT and cloud resources included — not just servers.
- Supplement CVSS, do not replace it. EPSS for likelihood, KEV for confirmation, asset context for relevance.
- Check your NVD dependency. If your process waits for NVD enrichment, it has been waiting in vain for four out of five CVEs since April. CNA records and vendor advisories become the primary source.
- Perimeter first. Network appliances account for a third of confirmed exploitation. They rarely appear in patch management because nobody "owns" them.
- Separate the emergency process from the regular cycle. With a mean time to exploit of minus seven days, the monthly patch window is irrelevant for the cases that matter.
- Vulnerability data into the SIEM. When a vulnerable system also shows suspicious traffic, alert priority has to rise automatically.
From practice
Risk-based prioritisation is built into our XIEM® stack. We correlate EPSS, KEV status, asset context and threat intelligence, and deliver not a list of 48,000 entries but a reasoned running order of what needs closing now.
The part that has paid off most clearly this year is the link into the SIEM: when a vulnerable system also shows suspicious traffic, alert priority rises automatically. That turns vulnerability management into part of detection rather than a list running alongside it.
One sentence from the original stands unchanged: not every CVE is a risk, and not every risk has a CVE.
Is your team drowning in CVEs? We help with prioritisation — driven by data, not instinct.
Sources