Topic starter
14/07/2026 4:25 pm
TL;DR: 12 distinct 2026 CVEs are already being actively exploited in network-facing attacks, while only 8 are listed in CISA KEV, according to Proofpoint, and its telemetry shows attackers still rely on familiar phishing, authentication-bypass, and RCE playbooks despite a faster CVE pipeline. The operational issue is no longer novelty in attacker tradecraft, but the growing prioritisation gap created by exploitation outpacing enrichment and cataloguing.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “More CVEs, Same Playbook: 2026 Vulnerability Exploitation in the Wild”.
By the numbers:
- Proofpoint telemetry shows 12 distinct 2026 CVEs being actively exploited in network-facing attacks, compared with 8 currently listed on the CISA KEV catalog.
- Proofpoint's network sensor infrastructure spans over 5,000 sensors globally and analysed more than 3 million alerts in 2026.
- Proofpoint says CISA lists 8 CVEs from 2026 while its telemetry has detected active exploitation attempts for 12 distinct 2026 CVEs.
Key questions
Q: What should teams do first when a new CVE is already being exploited before KEV listing?
A: Treat active exploitation as the trigger, not KEV inclusion.
Q: Why do AI-assisted CVE discovery and enrichment delays increase operational risk?
A: Because they widen the time between disclosure and enforceable action.
Q: What are the signs that a vulnerability prioritization model is failing?
A: The clearest signs are long delays on known exploited vulnerabilities, tickets that lack ownership, duplicate findings across tools, and high-severity work that never maps to real attack paths.
Practitioner guidance
- Prioritise exploitation evidence over KEV status Move newly disclosed remote code execution and authentication bypass issues to the front of remediation queues when telemetry shows active abuse, even if formal cataloguing has not caught up.
- Re-rank internet-facing assets first Treat perimeter devices, mail platforms, remote access systems, and web infrastructure as the first patch cohort because they are the most likely targets once proof-of-concept code is public.
- Use live telemetry in patch triage Blend sensor alerts, blocked exploit attempts, and threat intelligence with CVSS and KEV so the organisation prioritises what attackers are actually using now.
Bottom line: AI-assisted discovery is accelerating the supply of CVEs, but exploitation still follows familiar paths that defenders already know how to disrupt.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:33 pm
Exploitation-led prioritisation is replacing publication-led prioritisation. The article shows that a CVE's real risk is no longer determined by whether it exists in a database, but by whether it is already being used in the wild. That shifts vulnerability governance toward live exploitation evidence, especially for internet-facing systems and email delivery paths. Practitioners should treat exposure telemetry as a first-class control input, not an optional enrichment layer.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- The 2026 Verizon DBIR found that exploitation of software vulnerabilities became the leading initial access vector in confirmed breaches, accounting for 31% of incidents.
A question worth separating out:
Q: Should organisations trust KEV alone for remediation decisions?
A: No. KEV is useful, but it is reactive and will always lag some active exploitation. Organisations should use it alongside live telemetry, exposure context, and asset criticality so that remotely exploitable issues on internet-facing systems are handled before formal listing catches up.
👉 Read our full editorial: AI-assisted CVE discovery is widening the exploitation gap