Research / Report #3
What 194 verified CVEs from Jul–Sep 2026 daily briefings reveal about exploitation speed, severity calibration, and where CVSS misleads.
What this is. Across Jul–Sep 2026, defend.network published 92 daily threat briefings and 13 weekly vulnerability reports. Every CVE mentioned is looked up against the NIST National Vulnerability Database and cross-referenced with the CISA Known Exploited Vulnerabilities (KEV) catalog before publication. This report analyzes that quarter’s corpus.
Honesty up front. 194 unique CVEs is a small sample – we report counts, not confidence intervals, and flag every place n gets thin. Where the data could not support an analysis, we dropped it rather than padding (see Limitations). Every figure states its source, method, and n.
128 of the 194 CVEs covered this quarter (66.0%) are in the CISA KEV catalog – a catalog that holds only 1,730 entries in total. An exploitation-first feed massively over-represents confirmed-exploited vulnerabilities relative to the general CVE population.
Exploitation evidence across the corpus (n=194)
briefings.json (cveList) and vulnerabilities.json (topCVEs) within the window, deduplicated → 194. KEV membership checked against the full CISA KEV catalog (1,730 entries). Exploitation tier from the pipeline’s _state.exploitationState. CVSS uses NVD base scores only (n=193; 109 score ≥9.0).Across 92 publish-time severity decisions this quarter, the evidence layer overruled the AI’s proposed rating 42 times. The AI’s instinct runs hot; the data pulls it back.
Publish-time severity decisions, AI vs. evidence (n=92 days)
Severity is computed from NVD CVSS and CISA KEV exploitation state, with text signals capped – the same function on every briefing. The quarter’s published severity mix: 12 critical, 51 high, 27 medium, 2 low.
data/pipeline-health.json, which records the AI’s proposed severity (severityAi) and the published severity per day. n=92 days in window; small n stated as-is.For the 128 KEV-listed CVEs this quarter with both dates on record, the median gap from NVD publication to CISA KEV listing was 8.0 days – 58 of 128 (45%) within a week, 23 the same day. But “old” is not “safe”: CVE-2008-4128 took 6,507 days from disclosure to KEV listing. The distribution is bimodal; the mean (226.2 days) describes nothing.
Days from NVD publication to KEV listing, per CVE (n=128, sorted)
Of the 77 KEV CVEs first seen in a daily briefing, 9 were covered before CISA listed them and 7 the same day – source-reported exploitation often precedes the official catalog.
| CVE | Vendor (KEV) | NVD published | KEV added | Lag |
|---|---|---|---|---|
| CVE-2026-87886 | Acronis | 2026-09-17 | 2026-09-16 | -1d |
| CVE-2026-85706 | GitLab | 2026-09-12 | 2026-09-11 | -1d |
| CVE-2026-60004 | Gitea | 2026-08-26 | 2026-08-25 | -1d |
| CVE-2026-88771 | Citrix | 2026-09-27 | 2026-09-27 | 0d |
| CVE-2026-88772 | Citrix | 2026-09-27 | 2026-09-27 | 0d |
| CVE-2026-94127 | F5 | 2026-09-22 | 2026-09-22 | 0d |
| CVE-2026-93616 | Check Point | 2026-09-22 | 2026-09-22 | 0d |
| CVE-2026-81963 | Microsoft | 2026-09-08 | 2026-09-08 | 0d |
| CVE-2026-85880 | Microsoft | 2026-09-08 | 2026-09-08 | 0d |
| CVE-2026-76460 | Cisco | 2026-09-16 | 2026-09-16 | 0d |
| CVE-2026-76461 | Cisco | 2026-09-14 | 2026-09-14 | 0d |
| CVE-2026-87491 | 2026-09-09 | 2026-09-09 | 0d | |
| CVE-2026-20349 | Cisco | 2026-08-11 | 2026-08-11 | 0d |
| CVE-2026-68820 | Microsoft | 2026-08-11 | 2026-08-11 | 0d |
| CVE-2026-20316 | Cisco | 2026-07-29 | 2026-07-29 | 0d |
| CVE-2026-16812 | Arista | 2026-07-27 | 2026-07-27 | 0d |
| CVE-2026-16232 | Check Point | 2026-07-22 | 2026-07-22 | 0d |
| CVE-2026-15409 | SonicWall | 2026-07-14 | 2026-07-14 | 0d |
| CVE-2026-15410 | SonicWall | 2026-07-14 | 2026-07-14 | 0d |
| CVE-2026-56155 | Microsoft | 2026-07-14 | 2026-07-14 | 0d |
| CVE-2026-56164 | Microsoft | 2026-07-14 | 2026-07-14 | 0d |
| CVE-2026-93952 | Arista | 2026-09-22 | 2026-09-22 | 0d |
| CVE-2026-32201 | Microsoft | 2026-04-14 | 2026-04-14 | 0d |
| CVE-2026-20262 | Cisco | 2026-06-15 | 2026-06-15 | 0d |
| CVE-2026-50751 | Check Point | 2026-06-08 | 2026-06-08 | 0d |
| CVE-2026-11645 | 2026-06-09 | 2026-06-09 | 0d | |
| CVE-2026-86950 | Apple | 2026-09-28 | 2026-09-29 | 1d |
| CVE-2026-35273 | Oracle | 2026-06-11 | 2026-06-12 | 1d |
| CVE-2026-58704 | 2026-09-15 | 2026-09-16 | 1d | |
| CVE-2026-85046 | 2026-09-03 | 2026-09-04 | 1d | |
| CVE-2026-72530 | TrueConf | 2026-08-19 | 2026-08-20 | 1d |
| CVE-2026-72529 | TrueConf | 2026-08-19 | 2026-08-20 | 1d |
| CVE-2026-18577 | N-able | 2026-08-02 | 2026-08-03 | 1d |
| CVE-2026-75650 | Adobe | 2026-09-07 | 2026-09-08 | 1d |
| CVE-2026-83548 | SonicWall | 2026-09-01 | 2026-09-02 | 1d |
| CVE-2026-72898 | Metabase | 2026-08-10 | 2026-08-11 | 1d |
| CVE-2026-83549 | SonicWall | 2026-09-01 | 2026-09-02 | 1d |
| CVE-2026-56291 | Balbooa | 2026-07-09 | 2026-07-10 | 1d |
| CVE-2026-54420 | LiteSpeed | 2026-06-14 | 2026-06-15 | 1d |
| CVE-2025-48595 | Android | 2026-06-01 | 2026-06-02 | 1d |
| CVE-2026-28318 | SolarWinds | 2026-06-04 | 2026-06-05 | 1d |
| CVE-2026-64849 | MLflow | 2026-08-17 | 2026-08-19 | 2d |
| CVE-2026-86218 | N-able | 2026-09-06 | 2026-09-08 | 2d |
| CVE-2026-58644 | Microsoft | 2026-07-14 | 2026-07-16 | 2d |
| CVE-2026-10520 | Ivanti | 2026-06-09 | 2026-06-11 | 2d |
| CVE-2026-87902 | WordPress | 2026-09-22 | 2026-09-25 | 3d |
| CVE-2026-84869 | ConnectWise | 2026-09-08 | 2026-09-11 | 3d |
| CVE-2026-82078 | PaperCut | 2026-08-28 | 2026-08-31 | 3d |
| CVE-2026-81578 | PaperCut | 2026-08-28 | 2026-08-31 | 3d |
| CVE-2026-18556 | N-able | 2026-08-01 | 2026-08-04 | 3d |
| CVE-2026-60137 | WordPress | 2026-07-17 | 2026-07-21 | 4d |
| CVE-2026-63030 | WordPress | 2026-07-17 | 2026-07-21 | 4d |
| CVE-2026-7473 | Arista | 2026-06-05 | 2026-06-09 | 4d |
| CVE-2026-82329 | JFrog | 2026-08-28 | 2026-09-02 | 5d |
| CVE-2026-33017 | Langflow | 2026-03-20 | 2026-03-25 | 5d |
| CVE-2026-86060 | MikroTik | 2026-09-05 | 2026-09-10 | 5d |
| CVE-2026-67277 | MikroTik | 2026-09-05 | 2026-09-10 | 5d |
| CVE-2021-27137 | DD-WRT | 2026-07-16 | 2026-07-21 | 5d |
| CVE-2026-20245 | Cisco | 2026-06-04 | 2026-06-09 | 5d |
| CVE-2026-48282 | Adobe | 2026-06-30 | 2026-07-07 | 7d |
| CVE-2026-12569 | PTC | 2026-06-18 | 2026-06-25 | 7d |
| CVE-2026-73570 | Synacor | 2026-08-13 | 2026-08-21 | 8d |
| CVE-2026-50522 | Microsoft | 2026-07-14 | 2026-07-22 | 8d |
| CVE-2026-33825 | Microsoft | 2026-04-14 | 2026-04-22 | 8d |
| CVE-2026-56290 | Joomlack | 2026-06-29 | 2026-07-07 | 8d |
| CVE-2026-20253 | Splunk | 2026-06-10 | 2026-06-18 | 8d |
| CVE-2026-45247 | Mirasvit | 2026-05-26 | 2026-06-03 | 8d |
| CVE-2026-63077 | JetBrains | 2026-07-27 | 2026-08-05 | 9d |
| CVE-2026-48907 | Widget Factory | 2026-06-05 | 2026-06-16 | 11d |
| CVE-2026-65400 | Apple | 2026-08-06 | 2026-08-18 | 12d |
| CVE-2026-85102 | Check Point | 2026-09-09 | 2026-09-22 | 13d |
| CVE-2026-55255 | Langflow | 2026-06-23 | 2026-07-07 | 14d |
| CVE-2026-66384 | JFrog | 2026-08-12 | 2026-08-27 | 15d |
| CVE-2026-0257 | Palo Alto Networks | 2026-05-13 | 2026-05-29 | 16d |
| CVE-2026-48558 | SimpleHelp | 2026-06-12 | 2026-06-29 | 17d |
| CVE-2026-48908 | JoomShaper | 2026-06-20 | 2026-07-07 | 17d |
| CVE-2026-9198 | IBM | 2026-07-17 | 2026-08-04 | 18d |
| CVE-2026-59310 | Broadcom | 2026-07-30 | 2026-08-18 | 19d |
| CVE-2026-67279 | MikroTik | 2026-09-05 | 2026-09-25 | 20d |
| CVE-2026-48939 | iCagenda | 2026-06-20 | 2026-07-10 | 20d |
| CVE-2026-19490 | Citrix | 2026-08-19 | 2026-09-09 | 21d |
| CVE-2026-20230 | Cisco | 2026-06-03 | 2026-06-25 | 22d |
| CVE-2025-5777 | Citrix | 2025-06-17 | 2025-07-10 | 23d |
| CVE-2026-42018 | JFrog | 2026-08-12 | 2026-09-11 | 30d |
| CVE-2026-42271 | BerriAI | 2026-05-08 | 2026-06-08 | 31d |
| CVE-2026-34910 | Ubiquiti | 2026-05-22 | 2026-06-23 | 32d |
| CVE-2026-34909 | Ubiquiti | 2026-05-22 | 2026-06-23 | 32d |
| CVE-2026-34908 | Ubiquiti | 2026-05-22 | 2026-06-23 | 32d |
| CVE-2026-55040 | Microsoft | 2026-07-14 | 2026-08-18 | 35d |
| CVE-2026-25089 | Fortinet | 2026-06-09 | 2026-07-16 | 37d |
| CVE-2026-45659 | Microsoft | 2026-05-22 | 2026-07-01 | 40d |
| CVE-2026-71362 | Adobe | 2026-08-11 | 2026-09-24 | 44d |
| CVE-2026-65660 | Microsoft | 2026-08-11 | 2026-09-25 | 45d |
| CVE-2026-42016 | JFrog | 2026-07-27 | 2026-09-11 | 46d |
| CVE-2026-9586 | Sangoma | 2026-07-17 | 2026-09-02 | 47d |
| CVE-2026-46817 | Oracle | 2026-05-28 | 2026-07-15 | 48d |
| CVE-2026-5430 | WSO2 | 2026-08-06 | 2026-09-24 | 49d |
| CVE-2026-53362 | Linux | 2026-07-04 | 2026-08-27 | 54d |
| CVE-2026-59822 | BerriAI | 2026-07-08 | 2026-09-02 | 56d |
| CVE-2026-8452 | Citrix | 2026-06-30 | 2026-08-26 | 57d |
| CVE-2026-8037 | Progress | 2026-06-04 | 2026-08-07 | 64d |
| CVE-2026-49869 | Kestra | 2026-06-26 | 2026-09-02 | 68d |
| CVE-2026-53266 | Linux | 2026-06-25 | 2026-09-18 | 85d |
| CVE-2026-39808 | Fortinet | 2026-04-14 | 2026-07-16 | 93d |
| CVE-2026-7273 | Zyxel | 2026-06-16 | 2026-09-21 | 97d |
| CVE-2026-48710 | Kludex | 2026-05-26 | 2026-09-02 | 99d |
| CVE-2025-67038 | Lantronix | 2026-03-11 | 2026-06-23 | 104d |
| CVE-2026-34486 | Apache | 2026-04-09 | 2026-08-04 | 117d |
| CVE-2026-33824 | Microsoft | 2026-04-14 | 2026-08-18 | 126d |
| CVE-2025-68686 | Fortinet | 2026-02-10 | 2026-07-27 | 167d |
| CVE-2026-0770 | Langflow | 2026-01-23 | 2026-07-21 | 179d |
| CVE-2026-20079 | Cisco | 2026-03-04 | 2026-09-09 | 189d |
| CVE-2026-21962 | Oracle | 2026-01-20 | 2026-08-24 | 216d |
| CVE-2025-25249 | Fortinet | 2026-01-13 | 2026-09-09 | 239d |
| CVE-2025-62593 | Ray-Project | 2025-11-26 | 2026-08-17 | 264d |
| CVE-2024-42009 | Roundcube | 2024-08-05 | 2025-06-09 | 308d |
| CVE-2025-39964 | Linux | 2025-10-13 | 2026-09-18 | 340d |
| CVE-2025-39682 | Linux | 2025-09-05 | 2026-09-18 | 378d |
| CVE-2024-21182 | Oracle | 2024-07-16 | 2026-06-01 | 685d |
| CVE-2023-49105 | ownCloud | 2023-11-21 | 2026-08-27 | 1,010d |
| CVE-2023-4346 | KNX Association | 2023-08-29 | 2026-07-15 | 1,051d |
| CVE-2022-0492 | Linux | 2022-03-03 | 2026-06-02 | 1,552d |
| CVE-2022-0995 | Linux | 2022-03-25 | 2026-08-26 | 1,615d |
| CVE-2021-23758 | Ajax.NET Professional | 2021-12-03 | 2026-08-26 | 1,727d |
| CVE-2019-1068 | Microsoft | 2019-07-15 | 2026-08-26 | 2,599d |
| CVE-2015-5287 | Red Hat | 2015-12-07 | 2026-08-26 | 3,915d |
| CVE-2015-3246 | Red Hat | 2015-08-11 | 2026-08-26 | 4,033d |
| CVE-2008-4128 | Cisco | 2008-09-18 | 2026-07-13 | 6,507d |
dateAdded minus NVD published (both from cached authoritative records; day granularity, so same-day = 0). n=128 KEV CVEs with both dates; the rest lack a cached NVD record and are excluded rather than guessed.Among the 190 CVEs with both a CVSS score and a FIRST.org EPSS probability, 72 rated CVSS ≥9 (“critical”) carry an EPSS exploitation probability below 4% – while the highest EPSS in the corpus (1.00) belongs to CVE-2025-5777, rated only 7.5. Patch by CVSS rank alone and both lists betray you.
CVSS base score vs. EPSS exploitation probability (n=190)
_epss) joined with their NVD CVSS base score and KEV membership. n=190 and biased toward recently-enriched CVEs. Overlapping points are jittered a few pixels so dots stay visible; exact values are in the dataset. An observation about this corpus, not a general CVSS/EPSS claim – n is far too small.194 CVEs map to 90 distinct vendors – 56 of them appear exactly once.
Most-recurring vendors in the corpus (unique CVEs; n=194 attributed)
The long tail (56 of 90 vendors appearing once) matches what defenders experience: most risk arrives from software you forgot you ran.
vendorProject → NVD CPE vendor → the report’s vendor string (first token). 194 of 194 CVEs attributable; counts are unique CVEs. Name normalization is light (case-folding + a short alias list) – treat ±1 as noise.Small n, one quarter. 92 briefings, 194 CVEs, one calendar quarter. These are counts from one young corpus, not industry statistics – descriptive, not predictive, and not to be extrapolated beyond this dataset.
Reproduce it. Raw data: /api/v1/cves.json and /api/v1/briefings.json (the live feeds this site serves – they keep growing, so current counts exceed this fixed 2026-07-01 → 2026-09-30 window), plus the public CISA KEV catalog and NVD. Found an error? contact@defend.network – we correct promptly and say so.
License. This dataset (the CVE selection, annotations, and aggregates) is licensed CC BY 4.0 – reuse it freely with attribution to defend.network. The underlying NVD and CISA KEV records are public data.
The corpus behind this report grows by one briefing every day at 04:00 UTC. Free for security professionals.