To view older blog posts, please visit the archives section.

Is the apocalypse there yet?

You might remember a previous article I wrote about the impact of Mythos on the CISA KEV catalog. Mythos and, post Mythos AI models were still very recent at that time. The exploration I had done then led me to conclude that, at that point, nothing particularly out of the ordinary was seen. That is even if there was a slight increase in vulnerabilities added to the catalog within 5 and 30 days of being published to the NVD. 

Is this still true? With 2 more months of available data, this is the question we will be exploring here.

Building on the previous article

The data gathered while writing the previous article will be used as a baseline for this one. That dataset included all CVEs that were added to CISA KEV within 5 and 30 days of their publication between 2023-01-01 to 2026-05-31. Of importance, the following was extracted from the data:

• Average percentage of CVEs added to CISA KEV within 5 days of publication 0.2071%, standard deviation 0.1108;

• Average percentage of CVEs added to CISA KEV within 30 days of publication 0.2830%, standard deviation 0.1304;

• Average volume of CVEs added to CISA KEV within 5 days of publication 6.8048, standard deviation 2.9087;

• Average volume of CVEs added to CISA KEV within 30 days of publication 9.4146, standard deviation 3.5845.

Now let's observe the recent data.

The volume analysis

The following graphic shows the volume of CVEs added to KEV within 30 days after the CVE was published for the year 2026. Notably, 20 CVEs in June and 16 CVEs added to KEV for the month among those published in July. I think this is noteworthy.

The volume of CVEs added to KEV, within 30 days of publication, for vulnerabilities published in June 2026, is at +2 standard deviation of the average. This is not a first. It also happened in September 2023 (17) and March 2025 (17). It is, however, an all time high. It also borderlines on being at +3 standard deviation of the average.

July on the other hand, is at +1 standard deviation of the average. Excluding 2026, this only occurred 5 times since January 2023.

So far in 2026, 4 of the 7 observable months have seen the volume of CVEs added to the CISA KEV Catalog within 30 days deviate from the mean by at least +1 standard deviations. By comparison, this occurred in 4 of 12 months in 2025, just 1 of 12 months in 2024, and 2 of 12 months in 2023. 

Based on volume alone, it does appear like 2026 is warming up from a CISA KEV perspective. 

Based on volume alone, it does appear like 2026 is warming up from a CISA KEV perspective. However, is it really that bad given the total volume of CVEs being published lately?

Percentage of CVEs added to CISA KEV

When looking at the percentage of CVEs added to CISA KEV for the 5 and 30 days time frame,  we are observing an interesting story.

In June, 0.1258% and 0.2517% of the published CVEs were respectively added to CISA KEV within 5 and 30 days of publication. This is within 0 and -1 standard deviation from the average, respectively 0.2071% and 0.2830%.

In July, 0.1227% and 0.1637% of the published CVEs were respectively added to CISA KEV within 5 and 30 days of publication. This is also within 0 and -1 standard deviation from the average.

The 2026 data for CVEs added to CISA KEV within 5 and 30 days is presented in the graphs below.

Said simply, while the volume of vulnerabilities added to CISA KEV is indeed increasing, the ratios of vulnerabilities added to KEV is declining.

What can we make of this data?

I believe the data shows 2 important things:

1. We are indeed starting to see more vulnerabilities being actively exploited shortly before or after their publication;

2. While CVE publication volume is trending upwards, the percentage of newly published vulnerabilities being added to CISA KEV within 30 days is declining. 

This potentially indicates an increase in low value vulnerabilities being published. It should, however, be noted that the current dataset that I am pulling this information from is strictly limited to exploitation within a maximum of 30 days after the publication of a CVE. Threat actors could very well be focussing on older, unpatched, vulnerabilities at the moment. The current analysis would not show this.

Ok cool but what does this mean for my vulnerability management team?

Triaging is the key.

The data points to the utmost importance of implementing a strong triage approach as part of your vulnerability management program. Your strategy should be built on top of fact-based metrics that, as much as possible, avoid human in the loop. 

As I am writing this. It also happens that I am personally developping a new approach to vulnerability triaging. I hope that I will be able to share this strategy with you in a coming blog post. Until then, stay safe and automate everything you can!