Exploited vulnerabilities in 2026: what to patch first

Between January 1 and October 29, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added 280 vulnerabilities to its KEV (Known Exploited Vulnerabilities) catalog: the public list of flaws with confirmed exploitation in real attacks. We cross-referenced that catalog with FIRST’s EPSS exploitation probability and with the CVSS severity published on cve.org to answer a practical question: if you cannot patch everything, what do you patch first?

Key figures

• 280 entries added to KEV between January and October 29, 2026; 27 (9.6%) with known use in ransomware campaigns.
• 106 distinct vendors; Microsoft accounts for 40 entries (14.3%) and Cisco for 20 (7.1%).
• Of the 193 vulnerabilities with a CVE-2026 identifier, the median time from CVE publication to KEV entry was 4 days; 116 (60.1%) were added within 7 days.
• 29 of 280 (10.4%) have medium or low CVSS severity: a “critical and high only” filter would have missed them.
• 117 (41.8%) have an EPSS above 0.5, but 17 are below 0.01: EPSS alone is not enough either.

Method

We used public data only, downloaded on October 30, 2026 (03:12 UTC):

• CISA KEV catalog, version 2026.10.29 (1,764 entries in total).
• FIRST EPSS, model v2026.06.15, scores of October 29, 2026.
• CVE records from cve.org (cveawg.mitre.org API) for the publication date, vendor and CVSS score of each vulnerability.

Calculation rules:

• Period: entries whose KEV date added falls between 2026-01-01 and 2026-10-29, inclusive. We count by date added, not by CVE year, so older flaws confirmed as exploited this year are included.
• Days to exploitation: KEV date added minus the CVE publication date on cve.org, in calendar days. It is an approximation: KEV records when CISA confirms exploitation, not when it began.
• CVSS: base score published by the CNA (the organization that assigns the CVE), in the order v3.1, v3.0 and v4.0; if the CNA publishes none, we use CISA-ADP’s. Result: 222 CNA scores and 58 from CISA-ADP; 223 in v3.1, 51 in v4.0 and 6 in v3.0. Bands: low below 4.0; medium 4.0 to 6.9; high 7.0 to 8.9; critical 9.0 and above.
• EPSS: score as of October 29, 2026, not the score each CVE had on the day it was added to KEV.
• Verification: every CVE we name was checked against its cve.org record (vendor and product). The verification list is published alongside the script.

To reproduce the analysis:

# 1. Input data, pinned to the version used (SHA-256 at the end)
#    KEV 2026.10.29 from CISA's official GitHub mirror; EPSS of 2026-10-29
curl --create-dirs -o data/raw/known_exploited_vulnerabilities.json https://raw.githubusercontent.com/cisagov/kev-data/94ce630f87d58623e4c45b30f5fbdf398ab10af5/known_exploited_vulnerabilities.json
curl -o data/raw/epss_scores-current.csv.gz https://epss.empiricalsecurity.com/epss_scores-2026-10-29.csv.gz

# 2. cve.org records and analysis (Node 22 or later, no dependencies)
node analyze.mjs fetch
node analyze.mjs

# 3. Check every named CVE against cve.org
node verify-cves.mjs

# KEV  38a7172a5f26470dc7632aaa1c6cff4a51fe7bfec8cdce978a19b816a751e34d
# EPSS 221453f92968acfb993022670cd551664d0b42efdb7000b9a3746b7060ecbf0e

The script, the results, the full table of the 280 entries and the verification list are at astrum.company/research/2026-kev-chile.

Findings

1 · The pace is not slowing

The month with the most additions was September (43) and the one with the fewest, January (17). Of the 280 entries, 193 have a 2026 identifier, 38 a 2025 one and 49 are from 2024 or earlier. The most striking case is CVE-2008-4250, the Windows flaw known as MS08-067, added to KEV on May 20, 2026: legacy systems are still a target.

2 · A few vendors concentrate the risk

The vendors with the most additions were Microsoft (40); Cisco (20); Apple, Fortinet, Google and Linux (9 each). By product, those with five or more:

Among the 27 entries with known ransomware use, the vendors with two or more were Microsoft (4); SmarterTools (3); Cisco, JetBrains, SimpleHelp and SonicWall (2 each).

3 · The patching window is measured in days

For the 193 CVEs from 2026, the median was 4 days. 157 (81.3%) were added within 30 days, and 50 on the same day they were published. Across all 280 entries, the median rises to 14 days because older flaws confirmed late are included.

There are 3 cases with a negative day (added one day before the cve.org publication). The most likely cause is time zones: KEV records only a date, while cve.org records a date and time in UTC.

The practical consequence: a monthly patch cycle is too slow for internet-facing systems. Those need a fast track.

4 · Why CVSS is not enough (and neither is EPSS alone)

Of the 280 entries, 127 are critical, 124 high, 28 medium and 1 low. In other words, 29 vulnerabilities (10.4%) were exploited despite medium or low severity. Those with the highest EPSS in that group:

CVSS measures how technically severe a flaw is, not how likely it is to be used against you. EPSS estimates the probability of exploitation activity in the next 30 days: 180 of the 2026 KEV entries (64.3%) are above 0.1 and the median is 0.29. But 17 entries already confirmed as exploited have an EPSS below 0.01. The conclusion is an order: KEV first (confirmed exploitation), then EPSS to rank within KEV, and CVSS to size the impact.

What to patch first

Criteria: vulnerabilities added to KEV in 2026, with an EPSS of at least 0.1, from vendors widely used by Chilean companies (Microsoft, Fortinet, Cisco, VMware / Broadcom, Ivanti, Citrix, Apache, WordPress, SonicWall, Palo Alto Networks, Oracle, SAP, Atlassian). Sorted by EPSS, with at most two per vendor. 71 meet the criteria; these are the top 8. The vendor list is an editorial choice, not a measurement of installed base.

Action for each one:

1. CVE-2026-10520 · Ivanti Sentry. Apply the fix in Ivanti's advisory. According to KEV, the flaw is exploited when the Sentry appliance is unmanaged and its interfaces are reachable from outside; until you patch, keep them off the internet. Vendor advisory.
2. CVE-2026-21589 · Atlassian (multiple products). Update the affected Data Center editions (Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye) to the versions listed in Atlassian's advisory. An unauthenticated attacker can read application files. Vendor advisory.
3. CVE-2008-4250 · Microsoft Windows. This is MS08-067, a 2008 flaw that KEV added in 2026. Look for legacy Windows machines with the Server service exposed; apply Microsoft's bulletin or, if that is not possible, isolate or retire them and block SMB from untrusted networks. Vendor advisory.
4. CVE-2026-1281 · Ivanti Endpoint Manager Mobile (EPMM). Apply Ivanti's mitigations and, as the KEV note asks, check every internet-facing EPMM instance for signs of compromise. Vendor advisory.
5. CVE-2026-34486 · Apache Tomcat. Update Tomcat to the fixed version in Apache's advisory. The flaw bypasses the cluster EncryptInterceptor and, according to KEV, can be chained with another Tomcat vulnerability. Vendor advisory.
6. CVE-2026-34197 · Apache ActiveMQ. Update ActiveMQ per Apache's advisory. The flaw allows code injection; do not leave the broker or its console reachable from the internet. Vendor advisory.
7. CVE-2026-21643 · Fortinet FortiClient EMS. Apply the fixed version listed in Fortinet's FG-IR-25-1142 advisory. It is an unauthenticated SQL injection in the FortiClient EMS web interface; restrict who can reach it. Vendor advisory.
8. CVE-2026-35273 · Oracle PeopleSoft Enterprise PeopleTools. Apply Oracle's security alert. It allows an unauthenticated takeover of PeopleTools, and KEV flags it as known to be used in ransomware campaigns. Vendor advisory.

Recommendations

1. Cross-check your inventory against KEV. The catalog is free and downloadable as JSON or CSV. Checking it weekly against the products and versions you run already removes much of the noise.
2. Prioritize in this order: KEV, then EPSS and internet exposure, then CVSS. A medium CVSS that is in KEV comes before a critical one with no known exploitation.
3. Start with what is exposed: VPNs, mobile device management, email, admin consoles and published applications. They show up on the list again and again.
4. Define a fast track. With a median of 4 days from publication to KEV entry, exposed systems cannot wait for the monthly cycle.
5. Do not forget legacy systems. MS08-067 in the 2026 KEV is a reminder: if a system cannot be patched, isolate or retire it.
6. If you cannot patch today, mitigate and check. Restrict access, apply the vendor’s mitigations and look for signs of compromise, as KEV asks for several of these flaws.

Limitations

• KEV is a US government catalog: it includes what CISA confirms, not everything that is exploited. A flaw missing from KEV is not proof that it is not being exploited.
• EPSS changes daily. We used the scores of October 29, 2026; another day will give a slightly different order.
• The KEV date added is not the date of first exploitation, and the date comparison can be off by one day because of time zones.
• CVSS scores mix versions (v3.1, v3.0, v4.0) and sources (CNA and CISA-ADP), so they are not strictly comparable.
• “Widely used by Chilean companies” is an editorial criterion; we do not have public installed-base data by country.
• An “unknown” ransomware flag in KEV does not mean the flaw is not used in ransomware.
• We did not include local sources, such as alerts from Chile’s government CSIRT; cross-referencing them is a natural next step for a second version.

Sources

• CISA · Known Exploited Vulnerabilities Catalog (version 2026.10.29).
• FIRST · Exploit Prediction Scoring System (EPSS) (model v2026.06.15).
• CVE Program · cve.org (CVE JSON 5 records via cveawg.mitre.org).
• FIRST · Common Vulnerability Scoring System (CVSS).
• Astrum · script, results and verification for this analysis.

At Astrum, cybersecurity is our core line of work. If you want to apply this same method to your inventory and decide what to patch first, let’s talk.