Surge in Vulnerability Disclosures Amidst Low Exploitation Rates

• •Vulnerability disclosures have tripled in 2026, with 83,167 CVEs published by October 19.
• •Only 696 of these vulnerabilities have been confirmed exploited, indicating a low exploitation rate.
• •CVE-2026-104935 and CVE-2026-96951 are actively exploited and listed in CISA's KEV catalog.

In 2026, vulnerability disclosures have surged, with 83,167 CVEs published by October 19, a 73% increase from 2025. However, only 696 of these vulnerabilities have been exploited, indicating a troubling ratio of one in 119. Notably, CVE-2026-104935 and CVE-2026-96951, both published on October 13, have been added to the CISA KEV list due to confirmed. The trend shows that while the number of disclosed vulnerabilities has tripled, the rate of exploitation is declining, with September's figures showing under four exploited CVEs per 1,000 published. This discrepancy raises questions about the actual risk posed by the growing number of vulnerabilities. Security teams face challenges in prioritizing which vulnerabilities to address, as many older vulnerabilities remain unexploited despite being publicly disclosed.