Third-quarter vulnerability overview: discovery is not exploitation

What happened and what to do

The analysis published by Cisco Talos, in its Threat Source newsletter, compares the growth of CVEs and KEVs in the third quarter. CVEs grew 105% in raw volume, while KEVs grew 37%. About a third of KEVs still refer to CVEs from 2025 or earlier, indicating a patching delay. Among 2026 CVEs, 29% had a publication date matching their KEV inclusion date, and 27% of CVEs relate to network equipment. The forensicTriage column was added to KEV to flag vulnerabilities requiring forensic triage. The text also describes espionage activity attributed to UAT-6275.

In practice, a company can treat the patching backlog as the central problem: inventory assets, cross-reference the inventory with the KEV list, and prioritize exposed systems with old unpatched vulnerabilities. A collection pipeline that ingests CVEs and KEVs, maps them to real assets and produces a backlog dashboard by criticality shortens the time between disclosure and remediation. Network equipment deserves dedicated monitoring, and forensic triage flagged by KEV can feed an incident response workflow with defined owners.

How the consultancy can help

Assessment of exposure to known exploited vulnerabilities across the company's technology estate, with asset inventory and prioritization of patching backlog. Implementation of a CVE and KEV collection pipeline, matched against assets, with a tracking dashboard, operated on the client's infrastructure.

Next step

Send a brief description of your environment, such as approximate asset count, key systems and current patching process, and receive a scoped proposal.