The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

Cisco Talos's latest Threat Source newsletter examines whether the vulnerability landscape is truly spiraling out of control, as nicknames like "Vulnpocalypse" and "Bugmageddon" suggest. The data shows total CVE disclosures surpassed 70,000 by the end of Q3, a 105% year-over-year jump, and CVE identifiers have now organically grown into six digits. However, CISA's Known Exploited Vulnerabilities (KEV) catalog rose only 37% in the same period, and about a third of actively exploited flaws still trace back to 2025 or earlier, pointing to a persistent patch-management gap rather than a wave of fresh zero-day exploitation. Talos also flags a new "forensicTriage" field added to the KEV catalog under CISA's BOD 26-04 to mark vulnerabilities requiring mandatory incident-response workflows, alongside separate coverage of UAT-6275 espionage activity against CIS governments, an Ivanti Connect Secure zero-day chain (CVE-2026-104935) enabling root-level VPN compromise, and a maximum-severity SSRF flaw under active attack in SonicWall SMA appliances.