This Week in Cyber RiskWeekly
This week in cyber risk: 7 newly confirmed-exploited CVEs
Updated 11 October 2026 · Timeframe: New KEV this week (7 days); 52-week trend chart
7 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is well above the recent average of about 4.
Why it matters
KEV entries are the vulnerabilities attackers are provably using right now; the EPSS movers are where exploitation is heading next.
What to do
- Security leaders. Confirm every KEV entry is on your mandatory-patch track and report coverage to the board.
- Lean IT orgs. Patch anything on the KEV list first — those are confirmed exploited, not theoretical.
- MSPs. Sweep client fleets for the week's KEV CVEs; prioritize internet-facing systems.
Our take
Resilience starts from assuming exploitation, not just possibility. The KEV list is the shortest path to cutting real attacker leverage.
Earlier issues
Past states of this signal, most recent first.
11 October 2026 This week in cyber risk: 6 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
6 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is well above the recent average of about 3.
06 October 2026 This week in cyber risk: 6 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
6 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is well above the recent average of about 3.
01 October 2026 This week in cyber risk: 9 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
9 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is well above the recent average of about 3.
26 September 2026 This week in cyber risk: 10 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
10 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is well above the recent average of about 2.
21 September 2026 This week in cyber risk: 7 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
7 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is well above the recent average of about 2.
14 September 2026 This week in cyber risk: 14 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
14 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is the most in any week we have tracked.
07 September 2026 This week in cyber risk: 10 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
10 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is well above the recent average of about 3.
31 August 2026 This week in cyber risk: 13 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
13 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is well above the recent average of about 4.
26 August 2026 This week in cyber risk: 12 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
12 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is well above the recent average of about 4.
21 August 2026 This week in cyber risk: 8 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
8 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is well above the recent average of about 5.
15 August 2026 This week in cyber risk: 3 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
3 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike. That is below the recent average of about 6.
10 August 2026 This week in cyber risk: 6 newly confirmed-exploited CVEs
Timeframe: New KEV this week (7 days); 52-week trend chart
6 CVEs entered CISA's KEV catalog in the last 7 days, and 6 more had their EPSS exploit-probability spike.