Q2 2026 Vulnerability Trends Report

Q2 2026 saw 20,701 new CVEs including 2,317 critical flaws and a 62.5% increase in critical vulnerabilities versus Q1; 75 new entries were added to the CISA KEV (52% critical), indicating active exploitation. Major cases include RCEs, privilege escalations, authentication bypasses, and a supply‑chain trojan in an official installer, while attacks concentrated on externally exposed management/authentication interfaces; defenders are advised to prioritize KEV-listed patches, harden admin portals, and restrict public exposure.