Volume Is Not Risk: Making Sense of the “Vulnpocalypse”
This article analyzes the projected surge in CVE disclosures—~66,000 expected in 2026—and argues that raw volume does not equate to exploitable risk. Critical-severity share has dropped from ~13% to ~7%, and actively exploited vulnerabilities remain under 1% of all disclosures. The real threat is the collapsing window between disclosure and exploitation, now measured in hours, combined with an overwhelmed NVD that fully analyzed only ~28% of 2025 CVEs. The author recommends shifting from volume-based metrics to exploitability-driven triage using CISA KEV and EPSS, supplemented by virtual patching and containment.
Detection / Hunteropenrouter
What Happened
Security researchers are forecasting that around 66,000 software vulnerabilities will be reported in 2026, a huge increase from previous years. However, the article explains that this big number does not mean the internet is suddenly much less safe: the percentage of truly critical flaws has actually dropped by half, and fewer than 1% of all reported vulnerabilities are being actively attacked by hackers. The real danger is that when a vulnerability does get attacked, it happens much faster than before—sometimes within hours of being disclosed, often before the software maker has released a fix. Organizations should stop panicking over raw vulnerability counts and instead focus on prioritizing the small number of flaws that are actually being exploited, using tools like the CISA Known Exploited Vulnerabilities list and exploit prediction scoring. They should also consider virtual patching (protective shields that block attacks without changing the software code) to buy time until official fixes are available.
Key Takeaways
- CVE disclosures are projected to reach ~66,000 in 2026, up from ~48,185 in 2025, but the share of critical-severity flaws has halved from ~13% to ~7%.
- Actively exploited vulnerabilities remain under 1% of all disclosed CVEs; EPSS data shows only ~5% of CVEs are ever observed being exploited in the wild.
- The disclosure-to-exploitation window is collapsing from weeks to hours, with increasing pre-patch exploitation, making speed the primary risk factor rather than raw volume.
- CISA has retired its flat 14-day KEV remediation deadline in favor of a risk-based model that can require action in as little as three days for highest-risk entries.
- NVD is overwhelmed, fully analyzing only ~28% of newly disclosed CVEs in 2025, and has shifted to triaging enrichment by risk tier rather than analyzing every CVE.
Affected Systems
- Linux kernel (noted for high CVE volume due to per-bugfix CVE assignment by its CNA, with near-zero exploitation rate)
- All organizations relying on NVD/CVE data for vulnerability triage and prioritization
Vulnerabilities (CVEs)
None identified.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in this article. It is an analytical piece on vulnerability management strategy.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | N/A | This article does not describe specific malware, intrusion techniques, or endpoint behaviors to detect. |
| Network Visibility | N/A | No network-based indicators or attack patterns are discussed. |
| Detection Difficulty | N/A | This is a vulnerability management strategy article, not a threat detection or hunting piece. Detection difficulty is not applicable. |
Required Log Sources
- Vulnerability scanner output (e.g., Nessus, Qualys)
- CISA KEV catalog feed
- EPSS scoring data feed
- NVD/CVE enrichment data
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider evaluating whether your vulnerability management program is prioritizing based on raw CVE counts versus exploitability metrics such as CISA KEV inclusion and EPSS scores. | Vulnerability scanner results cross-referenced with CISA KEV catalog and EPSS percentile data | Vulnerability Management | Low — this is a process improvement recommendation, not a detection rule |
Control Gaps
- Organizations relying solely on NVD severity ratings may face triage bottlenecks since NVD fully analyzed only ~28% of 2025 CVEs.
- Programs using flat remediation deadlines rather than risk-based SLAs may miss urgent exploitation windows that now collapse to hours.
- Lack of virtual patching or containment capabilities leaves an open exposure window between disclosure and vendor patch availability.
Key Behavioral Indicators
- Vulnerabilities appearing in CISA KEV catalog should be treated as highest-priority confirmed exploitation signals.
- EPSS scores in the top percentiles can serve as a secondary prioritization filter for pre-exploitation risk.
- Incomplete NVD metadata (missing severity or product data) on newly disclosed CVEs may indicate the need for third-party enrichment sources.
False Positive Assessment
N/A — this article does not describe detection rules or indicators that would generate alerts.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider auditing your current vulnerability triage process to determine whether it is driven by raw CVE counts or exploitability-based prioritization.
- Consider cross-referencing your current open vulnerability backlog against the CISA KEV catalog to identify any confirmed-exploited flaws requiring immediate remediation.
- Evaluate whether your patch SLAs align with a risk-based model rather than a flat deadline, particularly for KEV-listed and high-EPSS vulnerabilities.
Infrastructure Hardening
- Consider deploying virtual patching or workload-level containment controls for internet-facing systems where vendor patches may lag behind active exploitation.
- Evaluate whether your vulnerability intelligence pipeline incorporates EPSS scoring and KEV catalog data as automated enrichment feeds.
- If applicable, consider integrating third-party vulnerability enrichment sources to compensate for incomplete NVD metadata on newly disclosed CVEs.
User Protection
- Consider ensuring that edge devices and internet-facing systems are covered by network-level virtual patching or WAF rules where supported by your tooling.
- Evaluate whether endpoint detection and response coverage extends to systems running software with known actively exploited vulnerabilities.
Security Awareness
- Consider updating executive reporting metrics to focus on exploitability trends and KEV remediation status rather than raw CVE counts.
- If applicable, consider briefing security team leadership on the collapsing disclosure-to-exploitation window and the need for risk-based rather than volume-based prioritization.
- Consider rolling training on EPSS and KEV-based triage workflows into existing analyst onboarding or cross-training programs.
