Security Leader Briefing
Week ending 16 October 2026 — what changed, whether it affects you, and what to tell the board. Composed from live exploit-risk signal, the AI Hype Index, and our control mappings.
Last updated: 16 October 2026 10:19 UTC
Board talking points
The headline read, in plain language.
- 7 newly confirmed-exploited vulnerabilities entered CISA’s KEV catalog this week.
- Highest-exposure vendors this week: Ahsay, Atlassian, Cisco, Palo Alto Networks.
- The AI Hype Index is 73/100 (down 2 pts) — overall CVE disclosure is on pace for a record year (~123,542 projected vs 49,972 in 2025). Volume is climbing to new highs, but still runs well below the most aggressive LLM-discovery forecasts: the AI-driven surge is real and accelerating, not yet the predicted flood.
- Control leverage concentrates in Information Input Validation (SI-10) — the mitigation most often cited against this week’s exploited CVEs.
This week’s material changes — exploited in the wild
New CISA KEV additions (last 7 days). Each carries the confirmed-exploitation rationale, affected technology, CISA’s required action, and a link to the evidence.
Likely to be exploited next
CVEs whose exploit probability (EPSS) is rising fast, plus fresh criticals with an exploit indicator. Not yet on KEV — watch or pre-emptively patch.
- 100 CVE-2026-72898 EPSS 97.3% · rising
- 99 CVE-2026-35273 EPSS 96.7% · rising
- 99 CVE-2026-93616 EPSS 75.9% · rising
- 95 CVE-2015-2468 EPSS 43.4% · rising
- 94 CVE-2026-85102 EPSS 50.4% · rising
- 61 CVE-2001-1342 EPSS 30.7% · rising
- 88 CVE-2026-59774 CVSS 9.8 Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository…
- 72 CVE-2026-87689 CVSS 9.8 · PoC The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store…
AI risk signal
A record year for CVE volume — but is it the predicted AI-driven flood? AI Hype Index →
Two things are true at once. CVE disclosure is on pace for a record year — roughly 123,542 projected for 2026 versus 49,972 in all of 2025 — so overall vulnerability volume is climbing to new highs. Yet that surge still runs well below the most aggressive LLM-discovery forecasts, which is why the Hype Index reads high. The AI-driven acceleration is real; the predicted explosion has not (yet) landed. Sustain the patch program — no emergency AI-exposure action is indicated this week.
Control implications
The NIST 800-53 controls most often cited as mitigating this week’s exploited CVEs — where to focus verification effort.
- SI-10 Information Input Validation cited for 6 of this week’s CVEs
- AC-3 Access Enforcement cited for 6 of this week’s CVEs
- IA-2 Identification and Authentication (Organizational Users) cited for 4 of this week’s CVEs
- IA-8 Identification and Authentication (Non-organizational Users) cited for 4 of this week’s CVEs
- AC-6 Least Privilege cited for 3 of this week’s CVEs
Recommended decisions
Concrete, imperative next steps.
- Patch or mitigate the 7 newly-KEV CVEs on your standard exploited-in-the-wild priority track.
- Verify SI-10, AC-3 are enforced on Ahsay, Atlassian, Cisco systems.
- Brief leadership that CVE volume is on track for a record year but still short of the aggressive LLM-discovery forecasts — sustain the patch program; no emergency AI-exposure action this week.