Record WatchRecord
A record month for exploited vulnerabilities: 43 added to CISA KEV
11 October 2026 · Timeframe: Monthly; record across all months since January 2023
43 vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog in 2026-09, the most in any month on record. Confirmed exploitation is running at a record monthly pace.
Why it matters
Monthly KEV volume is the clearest measure of how much confirmed exploitation teams have to keep up with. A record month is a capacity signal, not a scare.
What to do
- Security leaders. Check whether your patch SLA and staffing keep pace with a record month of confirmed exploitation.
- Lean IT orgs. A record KEV month means the exploited-first list is longer than usual; prioritize ruthlessly.
- MSPs. Scale the maintenance-window sweep to match a record month of exploited vulnerabilities.
Our take
Record monthly exploitation is why a bounded, exploited-first worklist beats chasing every CVE. Capacity planning, not panic, is the response.
The data behind this