Talos reports CVE volume up 105% on the year against 37% growth in CISA's KEV catalog
Cisco Talos counts more than 70,000 CVEs by the end of September, up 105% on a year earlier, while CISA's KEV catalog grew 37%. Its newsletter says the backlog of exploited bugs from older CVEs is where the patching work sits.
The Watch · Security desk
CISA's KEV catalog grew 30% from 2024 to 2025 and 37% year over year now, as counted by the Cisco Talos Threat Source newsletter.
| Measure | Value | As of | Claim |
|---|---|---|---|
| KEV growth, 2024 to 2025 | 30% | 2024 to 2025 | 5 |
| KEV growth, year over year | 37% | 4 |
What happened
- CVEs from 2025 or earlier make up 33% of KEV entries, and the Talos newsletter reads that share as a patch gap.
- Networking-gear CVEs ticked up slightly, to 27%, according to the newsletter.
- A new forensicTriage column in KEV flags high-risk vulnerabilities that require mandatory forensic triage and incident response workflows, per BOD 26-04.
- CVE sequence numbers have grown organically into six digits; the newsletter says the 2014 and 2015 IDs with that many digits were allocated artificially.
Why it matters
- Who has to decide decision Teams that treat KEV purely as a patch list now have to route flagged entries into incident response as well.
- Who's exposed exposure Legacy systems that missed earlier patches stay reachable through bugs already known to be exploited.
- What it limits constraint Tooling built for four- or five-digit sequence numbers needs testing against six-digit CVE IDs.
The newsletter's own line is that "discovery isn't exploitation, and that gap is exactly what the KEV numbers remind us of" [9]. By growth rate, CVEs ran about 2.8 times ahead of KEV [13].
KEV did not stay flat. It grew 30% from 2024 to 2025, and the newsletter says that makes this year's 37% less dramatic than it sounds [5]. The step up is seven points [14].
Exploitation evidence also arrives on its own timetable. Of the 2026 CVEs in KEV, 29% were added on the day they were published, so the other 71% reached the catalog on a different date [7][15]. A queue ordered by KEV reacts to a signal that, for most entries, is not issued at disclosure. We think it is still the better order: KEV entries that match installed software first, with the CVE total used to size scanner and ticket volume.
Patch debt is the part of the picture the newsletter weights most. It wrote: "Patch debt doesn't care how many new apocalypse-themed hashtags we invent" [10]. It does not call for panic or for relaxing. It puts the work in clearing the backlog one legacy system at a time [11].
The newsletter does not state the dataset or the date ranges behind its 105% and 37% comparisons, and it does not set out a prioritization method [12].
What to watch
- Whether Q4 data shows KEV growth staying near 37% or moving toward the CVE rate.
- Whether the share of 2026 CVEs added to KEV on their publication date moves above 29%.
- Which KEV entries carry the forensicTriage flag, and how BOD 26-04 guidance handles them.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap−15
- Incentives
- Insufficient
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The CVE count crossed 70,000 by the end of September.
- [2]
CVE numbering has grown organically into the six-digit range; the newsletter says IDs with that many digits in 2014 (CVE-2014-125110) and seven digits in 2015 (CVE-2015-1000013) were allocated artificially, and tells readers to check their tooling.
- [3]
Counting by volume, year over year, CVEs increased by 105%.
- [4]
Counting by volume, year over year, the CISA KEV catalog grew 37%.
- [5]
KEV grew 30% from 2024 to 2025; the newsletter says that makes this year's 37% increase less dramatic than it sounds.
- [6]
CVEs from 2025 or older account for 33% of KEV entries; the newsletter says a good third of KEVs suggest there is a patch gap.
- [7]
Among 2026 CVEs, the share where the publication date matches the date added to KEV is 29%, which the newsletter says is only 2% more than all of 2025.
- [8]
A new KEV column, forensicTriage, flags which high-risk vulnerabilities require mandatory forensic triage and incident response workflows; the newsletter points readers to BOD 26-04 and its Implementation Guidance.
- [9]
The newsletter wrote: "But discovery isn't exploitation, and that gap is exactly what the KEV numbers remind us of."
- [10]
The newsletter wrote: "Patch debt doesn't care how many new apocalypse-themed hashtags we invent."
- [11]
The newsletter says it does not think panic is warranted and does not think relaxing is either; it puts the real work in chipping away at the backlog, one legacy system at a time.
- [12]
The newsletter does not state the dataset or the date ranges behind its 105% CVE and 37% KEV comparisons, and does not set out a prioritization method.
- [13]
CVE growth (105%) ran about 2.8 times the rate of KEV growth (37%).
- [14]
KEV growth this year (37%) is seven percentage points above the 30% rise from 2024 to 2025.
- [15]
For 2026 CVEs in KEV, 71% were added on a date other than their publication date.
- [16]
The newsletter reports a slight uptick in networking gear-related CVEs, to 27%.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- blog.talosintelligence.comThe Q3 Vulnerability Pulse: Discovery ≠ Exploitation
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.