According to the Threat Source newsletter, published by Cisco Talos and available as a machine translation in the source feed, the CVE count passed 70 thousand by late September, and identifiers reached the six-digit range. The text notes that identifiers such as CVE-2014-125110 and CVE-2015-1000013 were assigned artificially and do not represent a real volume of vulnerabilities. In raw year-over-year terms, CVEs rose 105% and KEVs (known exploited vulnerabilities) rose 37%. After a 30% increase from 2024 to 2025, the author considers the KEV jump less dramatic.
Other points cited: about one third of KEVs still refer to CVEs from 2025 or earlier, which indicates delayed patching. Among 2026 CVEs, 29% had KEV inclusion dates equal to publication dates, 2 points above all of 2025. The share of CVEs related to network equipment rose to 27%. The source mentions a new forensicTriage column in KEV, flagging vulnerabilities that require forensic triage, and refers to BOD 26-04. The text also describes espionage activity attributed to UAT-6275; the summary gives no detail on targets or techniques.
The author's conclusion is that discovery is not exploitation: the CVE volume is real, but the patch backlog is the practical problem. To verify, consult the original article on the Cisco Talos site, check the cited BOD 26-04 and implementation guidance, and compare the figures with the official KEV catalog.