Q3 2026 Vulnerability Trend Report

Q3 2026 vulnerability trends report: 36,971 CVEs disclosed with a large proportion rated High or Critical, 100 new CISA KEV additions (58 rated critical), and confirmed active exploitation across products such as SharePoint, PaperCut, Gitea, WSO2, Adobe Commerce, Cisco ISE and Check Point; impacts include remote code execution, privilege escalation, credential leakage and expanded attack surfaces (APIs, collaboration platforms, AI/ML tooling). The report highlights rapid weaponization after disclosure, large-scale scanning, and recommends identifying exposed assets, prioritized patching, MFA, permission minimization, and continuous monitoring and log verification.