CVE 2026 | The Complete Guide to New, Critical & Actively Exploited Vulnerabilities (Updated Weekly)

CVE 2026 covers every publicly disclosed software flaw assigned a CVE-2026-NNNNN identifier this year, and it is already the largest annual list on record. This guide is refreshed weekly. It explains how CVE IDs work, tracks the newest and most critical flaws, logs what CISA has confirmed as exploited, and shows how to decide what to fix first.

What Is CVE 2026? How CVE IDs, NVD, CVSS and EPSS Work

CVE 2026 is the set of security vulnerabilities that received a CVE identifier in 2026, each carrying a shared public name such as CVE-2026-31431 so that vendors, scanners and defenders all mean the same flaw. By 20 October, vulnerability data firm Craci had counted 81,927 CVE records published this year, against roughly 48,000 in all of 2025. Trackers count slightly differently, but all show 2026 far ahead.

What a CVE ID means (CVE-2026-XXXXX format)

A CVE ID has three parts: the prefix CVE, a year, and a sequence number. The year reflects when the ID was reserved, or the flaw became public, not when the bug was written. Since 2014, the sequence can exceed four digits, so 2026 includes six-digit IDs such as CVE-2026-106931. CVE Numbering Authorities issue IDs, more than 530 as of August 2026, including software vendors, the Linux kernel project, and GitHub. An ID is only a name. It says nothing about severity or whether anyone is exploiting the flaw.

CVE vs NVD vs CISA KEV vs CVSS vs EPSS

These five terms answer different questions: CVE names a flaw, CVSS sizes it, EPSS predicts its likelihood, and KEV confirms it’s being exploited.

How to read a CVE entry: description, affected versions, references

A CVE entry is read in five places. The description names the product, the weakness, and the condition needed to exploit it. The affected-versions list tells you whether your build is in range. The CVSS vector shows how the flaw is attacked: over the network or locally, with or without login, with or without a user click. The CWE tag names the bug class, such as CWE-502 (deserialization of untrusted data) for the SharePoint flaw CVE-2026-45659. The references link to the vendor advisory and patch commit, which are better sources than third-party summaries. Since June 2024, CISA has also added exploitation status to many records through its own enrichment container.

Latest CVE 2026 Vulnerabilities (Last 24 Hours, This Week, This Month)

As of 23 October 2026, the newest activity centers on four Plex Media Server flaws chained as Plex2Shell, two other exploited products added to CISA’s catalog alongside them, and two PHP flaws rated 9.2 that were patched on 21 October. Volume is the bigger story: Google Threat Intelligence Group counted 5,045 disclosed vulnerabilities in January 2026 and 10,740 in August, a doubling in eight months.

Newly published in NVD.

The fastest way to see what was published in the last 24 hours is NVD’s search filtered by publication date, or the CVE Program’s public record repository, which updates throughout the day. Expect thin records. Since NIST narrowed enrichment on 15 April 2026 to KEV-listed, federal-use, and critical software, many new entries carry only the numbering authority’s description and score. One analysis found that 78.7% of 2026 CVEs published through 18 August were still awaiting NVD analysis, so read the CNA data and CISA’s enrichment rather than waiting for NIST.

New critical CVEs this week

The critical flaws to know this week are CVE-2026-109618 and CVE-2026-109619, two PHP interpreter bugs rated 9.2 and fixed on 21 October that can let attackers run code on servers, and the Plex2Shell chain. Plex2Shell links four Plex Media Server flaws into unauthenticated remote code execution. Plex shipped a fix in version 1.43.3.10861 on 3 August, a researcher published a proof of concept on 16 October, and attackers were using it the next day to install cryptominers and proxy malware. Microsoft’s 13 October Patch Tuesday also fixed more than 1,400 CVEs, although trackers differ on the exact count.

Monthly roll-up, January to present

Each month of 2026 had a defining story. This table is extended as each month closes.

Most Critical CVEs of 2026 (CVSS 9.0+ and High Severity)

The most critical CVEs of 2026 pair a CVSS score of 9.0 or higher with confirmed exploitation or a public exploit, and they are rare. Google Threat Intelligence Group found that only 0.23% of 2026 disclosures, roughly 1 in 431, were ever seen exploited in the wild. Severity alone misleads, so this section ranks flaws by impact and evidence.

How severity scoring works

CVSS rates technical severity from 0 to 10: 0.1 to 3.9 is low, 4.0 to 6.9 medium, 7.0 to 8.9 high, and 9.0 to 10.0 critical. The score measures potential damage, not the likelihood of attack, and a single CVE can carry several scores. The NGINX rewrite-module flaw CVE-2026-42945 is rated 9.2 under CVSS v4.0 by F5 and 8.1 under v3.1 in other trackers. Copy Fail scores only 7.8, a “high” rating, yet CISA listed it as exploited two days after disclosure.

Critical remote code execution (RCE) flaws

Remote code execution flaws top the critical list because they need no foothold. Notable 2026 examples include the marimo notebook pre-authentication RCE (CVE-2026-39987) and the Ivanti EPMM RCE (CVE-2026-1340), both confirmed exploited, plus the SharePoint deserialization flaw CVE-2026-45659 (CVSS 8.8) and NGINX CVE-2026-42945, where code execution depends on weakened memory randomization. Google’s analysis found that 50% of AI-discovered vulnerabilities lead to RCE, compared with 26% across all CVEs, so the share of code-execution flaws in the pipeline is likely to keep growing.

Privilege escalation vulnerabilities

Privilege escalation flaws rarely start an attack, but they finish one by turning a low-privilege foothold into root or SYSTEM. The Linux kernel saw an unusual run in 2026: Copy Fail on 29 April, Dirty Frag on 7 May, Fragnesia on 13 May, and Qualys’s CVE-2026-46333 on 20 May, the fourth in three weeks. On Windows, RoguePlanet (CVE-2026-50656) let a local user reach SYSTEM through Microsoft Defender’s own scanning engine, with a public exploit available before any patch.

Critical open-source package and dependency vulnerabilities

Open-source dependencies generate the largest and noisiest share of CVEs. GitHub issued the most CVEs in the first half of 2026, with 6,801 records, and the Linux kernel project’s automatic assignment produced roughly 5,000 CVEs from January to August, with no exploited zero-days among them, according to Google. A single advisory batch can overwhelm a team: Spring-related projects received 91 CVEs in advisories published on 20 August. Triage open-source flaws by whether the vulnerable code is reachable in your build and whether exploitation is confirmed, not by raw counts.

Actively Exploited CVEs in 2026: Zero-Days, In-the-Wild Attacks and Ransomware

An actively exploited CVE is a vulnerability with credible evidence that attackers are using it against real targets. Google Threat Intelligence Group recorded 141 such vulnerabilities from January through August 2026, more than the 127 for all of 2025, an average of 18 a month against 10.5 a month in 2025.

What “exploited at scale” means (definition and evidence criteria)

Exploited at scale means an attacker uses a vulnerability against many victims, usually through automated scanning, rather than in a handful of targeted intrusions. No formal threshold exists, so analysts look for converging evidence: honeypot or canary hits, incident-response confirmation, a statement from the vendor or a government agency, and several unrelated threat groups using the same flaw. BeyondTrust’s CVE-2026-1731 fits the pattern. One threat cluster exploited it within four days of disclosure and five more within seven days, according to Google.

Indicators of compromise (IOCs) and exploitation signals

Indicators of compromise are the artifacts attackers leave behind: IP addresses, domains, file hashes, web shells, and unusual process behavior. Exploitation signals usually arrive earlier and from outside your network. VulnCheck canary systems recorded attempts against NGINX CVE-2026-42945 on 16 May, three days after disclosure. Other signals include a jump in EPSS, a KEV listing, or a vendor updating its advisory with IOCs, as Plex did before CISA acted. For Copy Fail, Sysdig advises watching for unexpected processes opening kernel crypto sockets and for unexplained changes to setuid binaries.

Zero-day vs n-day exploitation

Attackers exploit a zero-day before a fix exists, while they exploit an n-day after a patch or advisory is public. Google’s data shows zero-days averaged 11 a month in 2026 versus 8 in 2025 and made up 62% of exploited vulnerabilities from January to August, with a spike to 22 in August. Most of the growth in exploitation, however, came from n-days: exploited high-risk flaws rose from 28 in all of 2025 to 75 in the first eight months of 2026. Google suggests attackers may be using AI to compare patches and weaponize them faster, which shrinks the window between a fix and an attack.

Proof-of-concept (PoC) exploits: when public code changes your risk.

A public proof of concept changes risk because it gives everyone working capability. Copy Fail’s 732-byte Python script worked across major distributions without a race condition, and CISA listed the flaw two days after disclosure. The RoguePlanet exploit appeared on 10 June, and Microsoft didn’t ship a fix until 9 July. Plex2Shell went from a published PoC on 16 October to observed attacks on 17 October. Treat a public PoC as a trigger for emergency patching of anything internet-facing, and handle PoCs carefully: Sekoia documented vulnerability researchers being targeted with trojanised exploit code in 2026, so run proof-of-concept code only in an isolated lab.

CVEs tied to ransomware and malware campaigns

CISA marks KEV entries known to be used in ransomware campaigns, and 361 of the catalog’s 1,754 entries carry that flag, about one in five. In 2026, the Qilin ransomware group was reported to have exploited the PAN-OS GlobalProtect bypass CVE-2026-0257, and Microsoft linked exploitation of SharePoint CVE-2026-45659 to Storm-2603 and Warlock ransomware activity. Plex2Shell attackers delivered cryptominers and proxy malware instead. Attackers favor remote-access and edge flaws because one unpatched gateway can give them a network-level foothold.

CISA KEV 2026: Known Exploited Vulnerabilities Log

CISA’s Known Exploited Vulnerabilities (KEV) catalog is the US government’s list of CVEs with confirmed in-the-wild exploitation. On 21 October 2026, it held 1,754 entries, 270 of which were added during 2026.

What the KEV catalog is and how to use it for patch priority

CISA launched the KEV catalog on 3 November 2021 under Binding Operational Directive 22-01. On 10 June 2026, BOD 26-04 consolidated that directive and its predecessor, 19-02, and made KEV status one factor in how federal civilian agencies rank patches, alongside asset exposure, exploit automation, and impact. Organizations outside the federal government can use the same logic: any KEV-listed flaw in software you run belongs at the top of the queue, and the catalog is available as a machine-readable feed for automated matching against your asset inventory.

Dated additions log (newest first)

CISA added 28 entries in February, 26 in March, 30 in April, and 23 in June. Notable additions:

• October 20–21: four Plex Media Server flaws (Plex2Shell), SiteGuard Server Edition CVE-2026-106931 and Siemens Software Center CVE-2026-110936
• 11 August: three additions, including Cisco ASA and Firewall Threat Defense CVE-2026-20349
• 15 July: two additions, including KNX protocol flaw CVE-2023-4346
• 1 July: Microsoft SharePoint Server CVE-2026-45659
• 29 May: PAN-OS GlobalProtect CVE-2026-0257
• 1 May: Linux kernel copy failure, CVE-2026-31431
• 30 April: cPanel & WHM CVE-2026-41940
• 8 April and 6 April: Ivanti EPMM CVE-2026-1340 and Fortinet FortiClient EMS CVE-2026-35616

Remediation deadlines

Every KEV entry has a due date for federal civilian agencies, and the dates vary by risk. Copy Fail was added 1 May with a 15 May deadline, cPanel’s CVE-2026-41940 received three days, and SharePoint CVE-2026-45659 was added 1 July with a 4 July deadline. Under BOD 26-04, SiteGuard’s CVE-2026-106931 was due 23 October with forensic triage required, while the Siemens Software Center flaw is due 3 November. The deadlines apply only to federal agencies, but they provide a useful outer bound for everyone else.

Most-Searched CVE-2026 IDs: Impact, Fix, Patch and PoC Status

The most-searched CVE-2026 IDs are dominated by Linux kernel privilege escalation flaws, led by CVE-2026-31431, known as Copy Fail. In Vulnerability-Lookup’s monthly report, it drew 279 sightings in April, the most of any vulnerability that month. The table below covers the ten IDs that draw the most searches.

Quick-reference table

Spotlight: CVE-2026-31431 (Copy Fail): affected kernels, distributions, mitigation, container-escape risk

CVE-2026-31431, Copy Fail, is a local privilege escalation flaw in the Linux kernel’s algif_aead crypto interface that lets an unprivileged user become root. Security researcher Taeyang Lee reported it on 23 March; a patch was merged on 1 April it was disclosed on 29 April. The root cause is a 2017 in-place optimization, and the flaw affects kernels from that era up to the fixed releases 7.0, 6.19.12 and 6.18.22, plus distribution backports. Ubuntu, Amazon Linux, RHEL, and SUSE were confirmed exploitable by a public 732-byte Python script.

The safest fix is to update the kernel and reboot. As an interim step, block the algif_aead module; Ubuntu shipped this mitigation and plans to retire it after the kernel update. On RHEL-family kernels, the module is compiled in, so blocking it isn’t enough; you need a boot parameter instead. Containers are exposed because they share the host kernel and page cache, which turns a pod compromise into a possible host escape. Sandboxes with their own user-space kernel, such as gVisor, do not share the vulnerable code.

The next most-searched IDs

The Linux kernel group continues beyond Copy Fail. Dirty Frag (CVE-2026-43284 and CVE-2026-43500) can be chained for root through shared page-fragment handling and the RxRPC subsystem; the Canadian Cyber Center warned on 8 May that no universal fix existed across stable kernels, and Ubuntu fixes followed in early June. Qualys found CVE-2026-46333 in the ptrace permission check, which can leak SSH host keys and the shadow password file. Setting kernel.yama.ptrace_scope to 2 reduces exposure until the kernel is patched. CVE-2026-43499, nicknamed GhostLock, is a use-after-free with a public exploit from 8 July, also demonstrated against Android 15.

The Microsoft group has two entries. RoguePlanet (CVE-2026-50656) is a Defender privilege escalation whose exploit was public a month before the 9 July fix. SharePoint CVE-2026-45659 is an exploited remote code execution flaw fixed in May that Microsoft tied to Storm-2603 and Warlock ransomware activity.

Three edge and web flaws round out the list. NGINX CVE-2026-42945 is an 18-year-old heap overflow in the rewrite module. Fortinet FortiClient EMS CVE-2026-35616 is a pre-authentication access-control bypass rated 9.1. PAN-OS GlobalProtect CVE-2026-0257 is an authentication bypass patched on 13 May and exploited in ransomware intrusions.

Finally, CVE-2026-25253 affects the OpenClaw AI agent. Before version 2026.1.29, it opened a WebSocket to a gateway address taken from a link and sent its authentication token without asking, enabling one-click takeover.

How to look up any CVE-2026 ID yourself

To look up any CVE-2026 ID, work through four sources in order. First, open the CVE record at cve.org or the NVD detail page, and confirm the record is not marked rejected. Second, read the description and affected versions against your build. Third, check whether the ID appears in the CISA KEV catalog and what its EPSS score is. Fourth, find the vendor’s own advisory for the fixed version: Ubuntu, Debian, Red Hat, SUSE, and Amazon Linux publish per-CVE pages, and Microsoft’s Security Update Guide maps CVEs to KB patches. If NVD shows the entry as awaiting analysis, rely on the numbering authority’s data and the vendor advisory.

CVE 2026 by Platform: Linux, Windows, Browsers, Web and Network Vendors

CVE 2026 risk clusters on Linux, Microsoft products, browsers, and edge appliances. Google found that edge and security appliances accounted for 14% of vulnerabilities exploited between January and August 2026, with enterprise directory and collaboration tools at 11%, and that more than 65% of exploited edge flaws rated high or critical.

Linux kernel and distributions (Ubuntu, RHEL, Debian, SUSE, Amazon Linux, Oracle Linux)

Linux leads 2026 by volume. SOCRadar’s trend data ranked it first by distinct CVEs in September, with 1,509 by 22 September, ahead of Microsoft with 1,000. Most kernel CVEs are low risk, so focus on the privilege escalation cluster: Copy Fail, Dirty Frag, Fragnesia, CVE-2026-46333, and GhostLock. Each distribution publishes its own fixes through Ubuntu Security Notices, the Debian Security Tracker, Red Hat advisories, SUSE, Amazon Linux, and Oracle Linux updates. Ubuntu warned that some 2026 kernel updates change the ABI, so third-party kernel modules must be reinstalled. Microsoft also confirmed that WSL was affected by Copy Fail.

Microsoft Windows, Exchange and SharePoint

Microsoft’s patch volume set records in 2026, from 206 CVEs on 9 June to more than 1,400 on 13 October. The flaws that mattered most were exploited ones: SharePoint CVE-2026-32201 (added to KEV 14 April) and CVE-2026-45659 (1 July), Windows Shell CVE-2026-32202 (28 April), and older Exchange flaw CVE-2023-21529 (13 April). Defender’s RoguePlanet zero-day showed that security tooling itself can be an escalation path. Prioritize internet-facing SharePoint and Exchange servers, and confirm patches by KB number rather than by Patch Tuesday date.

Chrome, Firefox, Android and iOS

Browser flaws reach almost every user, so they regularly enter KEV. Attackers exploited Chrome’s CVE-2026-2441 in February, and its Dawn use-after-free CVE-2026-5281 entered KEV on 1 April. Mozilla’s Firefox 150, released 21 April, fixed CVE-2026-6770, a private-browsing identifier leak, along with 271 bugs found by an AI-assisted harness. On mobile, we demonstrated kernel flaws such as GhostLock on Android 15. Android and iOS flaws are resolved through OS and browser updates, so control depends on update status across managed devices.

WordPress, plugins and CMS platforms (Joomla, Drupal, Magento, cPanel)

WordPress and other content management systems are exposed mainly through lagging updates and third-party extensions. Hosting company 20i found 88% of WordPress sites running outdated software in September 2026. The hosting stack matters too: cPanel & WHM CVE-2026-41940, an authentication bypass rated 9.8, entered KEV on 30 April with a three-day deadline, and the PHP flaws patched 21 October sit below WordPress and run before any plugin does. Extensions follow the same pattern; for example, Joomla’s iCagenda CVE-2026-48939 allowed code execution through arbitrary file upload.

Network and edge devices (Fortinet, Ivanti, Palo Alto, Cisco, Citrix, VMware)

Edge devices are the most valuable targets because they sit on the perimeter, often without endpoint monitoring. Fortinet FortiClient EMS CVE-2026-35616 and CVE-2026-21643 entered KEV in April; Ivanti EPMM CVE-2026-1340 on 8 April and Palo Alto GlobalProtect CVE-2026-0257 on 29 May. Cisco appeared repeatedly, from Catalyst SD-WAN Manager flaws in February and April to ASA and Firewall Threat Defense CVE-2026-20349 in August. Recorded Future also flagged zero-day exploitation of Citrix NetScaler in September. Treat any exposed management interface, on any of these platforms or on virtualization products such as VMware, as a first-tier patching target.

Web servers, databases, and infrastructure (nginx, OpenSSL, MongoDB, Docker, Kubernetes)

Infrastructure software combines wide deployment with deep access. NGINX CVE-2026-42945 affects every release from 0.6.27 through 1.30.0 and also hits NGINX Plus, ingress, and WAF products. OpenSSL’s 9 June advisory disclosed 18 vulnerabilities, the most severe rated High. MongoDB fixed a critical remote code execution flaw, CVE-2026-8053, in May, with no known exploitation at disclosure and no action needed for Atlas customers, and shipped a July release covering 26 vulnerabilities. Apache ActiveMQ CVE-2026-34197 entered KEV on 16 April. For Docker and Kubernetes, the key 2026 risk is shared-kernel flaws such as Copy Fail, which let a container compromise reach the host.

AI, LLM and Agent Framework CVEs in 2026

AI, LLM, and agent frameworks have become a major source of CVEs in 2026. Google Threat Intelligence Group tracked 2,076 AI-related CVE disclosures between January 2025 and August 2026, with more than 1,500 of them in 2026 alone, across eight layers of the AI stack.

Why AI tooling is a new attack surface

AI tooling is a new attack surface because it combines code execution, broad credentials, and fast-moving, lightly reviewed software. Agent orchestration frameworks account for half of all AI-related flaws and grew 347% in disclosures during 2026, according to Google, because workflow builders often include nodes that run code. AI gateways add a second risk: they hold third-party API keys and prompt streams, so one compromise can expose credentials and open a path into cloud environments. Google has not observed zero-day exploitation of AI infrastructure, but attackers are exploiting newly disclosed flaws in exposed AI middleware.

LLM serving frameworks (Ollama, vLLM and similar)

Google recorded 212 vulnerabilities in LLM serving frameworks such as Ollama, vLLM, LiteLLM, and Triton in 2026. Nearly a quarter came from unauthenticated API endpoints or server-side request forgery, which give remote attackers a direct route past the perimeter to exhaust GPU capacity or extract model checkpoints. The practical rule is simple: an inference server should never be reachable from the internet without authentication, and its admin interfaces should stay on internal networks.

MCP servers and AI agent vulnerabilities

Model Context Protocol servers and agent platforms have already had flaws exploited. LiteLLM CVE-2026-42271 allowed command injection through MCP preview endpoints, leading to host takeover and API credential theft, and Langflow CVE-2026-5027 allowed attackers to write files to the host through an upload handler. The notebook tool marimo’s CVE-2026-39987 entered KEV on 23 April. The OpenClaw agent platform alone accumulated 537 CVEs in the first half of 2026, including the one-click CVE-2026-25253.

Securing AI developer tooling

Securing AI developer tooling follows familiar rules, but with stricter enforcement. Require authentication on every inference and agent endpoint, keep management ports off the public internet, and run autonomous agent workloads in sandboxes with minimal permissions. Rotate API keys held by gateways after any suspected exposure, pin and update framework versions, and add AI frameworks to the same vulnerability-management process as the rest of your software. Google specifically recommends sandboxing agentic workloads and moving to risk-based triage.

How to Fix and Prioritize CVE 2026 Vulnerabilities

Fix CVE-2026 vulnerabilities by patching exploited and internet-exposed systems first, applying vendor mitigations where a patch lags, and ranking everything else using CVSS, EPSS, and KEV together. The need for triage is stark: roughly 17,000 CVEs published in the first half of 2026 were rated high or critical, yet only 85 of the half-year’s 35,364 CVEs, about 0.24%, were in the KEV catalog by midyear, according to Jerry Gamblin’s analysis.

Patch vs mitigation vs workaround

A patch removes the vulnerable code, a mitigation reduces exposure while the code remains, and a workaround is a temporary configuration change that may turn off functionality. Copy Fail shows all three: the kernel update and reboot is the patch, Ubuntu’s kmod change is a mitigation, and manually blocking the algif_aead module is a workaround. Mitigations buy time when a fix does not exist, as with RoguePlanet, which was exploitable for about a month before Microsoft’s fix, or with CVE-2026-46333, where raising ptrace_scope to 2 limits exposure. Plan to replace every workaround with the real patch.

Prioritizing with CVSS + EPSS + KEV

Prioritize in this order: first any KEV-listed flaw present in your environment, then flaws with a high EPSS score or a public exploit on internet-facing assets, and only then the rest by CVSS and asset value. NGINX CVE-2026-42945 shows why: its CVSS differs by version, but its EPSS places it among the most exploitable 1% of CVEs. BOD 26-04 uses the same logic, weighing KEV status with exposure, exploit automation, and impact. Do not read a 7.8 as “can wait” when the flaw is on the exploited list.

Finding official vendor patches and advisories

Find the official patch in the vendor’s own advisory, not in a third-party summary. Use Ubuntu Security Notices, the Debian Security Tracker, Red Hat’s CVE pages, SUSE, Amazon Linux and Oracle Linux advisories for Linux; Microsoft’s Security Update Guide for KB numbers, since SharePoint CVE-2026-45659 maps to specific KBs per edition; and the PSIRT pages of F5, Palo Alto Networks and Fortinet for edge products. Compare the fixed version string in the advisory with your installed build, and note that Linux kernel patches generally take effect only after a reboot.

Detection and scanning

Detection starts with knowing what you run. Authenticated vulnerability scanners match installed versions to CVEs, while quick local checks help during an incident: the running kernel with uname -r, and whether a module such as algif_aead is loaded. Endpoint rules can flag exploitation behavior, such as unexpected processes using kernel crypto sockets. Coverage is uneven, though: in one September analysis, only 8 of 30 newly exploited CVEs had a public scanner template, which does not mean the others are undetectable, only that you should not rely on one tool.

Containers and cloud workloads

Containers share the host kernel, so kernel flaws are fixed on the node, not in the image. Copy Fail’s page-cache corruption let a compromised pod reach the host, and researchers showed the path across major managed Kubernetes platforms. Patch node images, reboot nodes on a rolling schedule, and where patching lags, deny the AF_ALG socket family through seccomp or SELinux policy. OpenShift published a BPF-based mitigation that blocks the vulnerable bind without a reboot. Runtimes with a separate user-space kernel, such as gVisor, avoid the host’s algif_aead code.

Frequently Asked Questions (FAQ)

What is CVE 2026?

CVE 2026 means the vulnerabilities assigned a CVE identifier in 2026, written CVE-2026-NNNNN. Each ID is a shared name for one publicly disclosed flaw in software or hardware. Craci counted 81,927 such records by 20 October 2026.

Which CVE 2026 vulnerabilities are being exploited right now?

As of 23 October 2026, the most recently exploited flaws on CISA’s KEV list are the four Plex Media Server vulnerabilities known as Plex2Shell, SiteGuard CVE-2026-106931, and Siemens Software Center CVE-2026-110936. Earlier 2026 additions still worth checking include Copy Fail (CVE-2026-31431), SharePoint CVE-2026-45659, and PAN-OS CVE-2026-0257. The KEV catalog is the authoritative current list.

What does “exploited at scale” mean?

Exploited at scale means attackers are using a vulnerability against many victims, typically through automated scanning, rather than in a few targeted attacks. There is no formal threshold, so analysts rely on evidence such as honeypot hits, incident-response findings, vendor or government confirmation, and multiple unrelated threat groups using the same flaw.

Is CVE-2026-31431 patched, and how do I check if I’m affected?

Yes, CVE-2026-31431 (Copy Fail) is fixed upstream in Linux 7.0, 6.19.12, and 6.18.22, and distributions have shipped backports. To check, compare your running kernel (uname -r) with your distribution’s advisory, confirm the fix is listed in the kernel changelog, and see whether algif_aead is loaded. Reboot after updating—systems where the module is compiled in need the kernel update or a boot parameter.

What is CISA KEV?

CISA KEV is the Known Exploited Vulnerabilities catalog, a CISA list of CVEs with evidence of exploitation in the wild. It held 1,754 entries on 21 October 2026, and CISA assigns remediation due dates for federal agencies. Any organization can use it as a high-priority patching list.

Where can I find a full CVE list for 2026?

The complete list lives in the CVE Program’s records at cve.org and its public repository, and NVD offers a searchable view. With more than 80,000 records published by late October, filter by vendor, severity, or KEV status rather than reading the raw list. The monthly roll-up and KEV log on this page summarize the flaws that matter.

What’s the difference between CVE and CVSS?

A CVE is an identifier and record for a specific vulnerability, while CVSS is a 0-to-10 score describing its technical severity. A CVE has one ID but can carry different CVSS scores from the vendor, NVD, and other analysts. CVSS says how bad a flaw could be, not whether attackers are using it.

Catch CVE Exploitation Chatter Early with DeXpose

Patching closes the vulnerability, but it does not tell you whether someone has already used it. DeXpose watches dark web sources for the downstream evidence of exploitation, so your team hears about stolen credentials and exposed data before an attacker uses them.

How exploit code and initial access get traded on the dark web after disclosure.

Exploitation now follows disclosure within days. Plex2Shell went from a public proof of concept to observed attacks in one day, NGINX CVE-2026-42945 drew attempts three days after disclosure, and Google saw a cluster exploit BeyondTrust CVE-2026-1731 within four days. After a successful compromise, monetization follows: credentials, session tokens, and server access stolen from a breached system are traded or reused, alongside logs stolen by infostealer malware. Ransomware groups use the same pattern, which is why CISA tracks 361 KEV entries as ransomware-linked.

Monitor your domain, credentials, and brand with DeXpose.

DeXpose doesn’t patch your servers; it shows what exploitation looks like from the outside. Start with the Free Darkweb Report for an instant view of your exposure across dark web markets, malware logs and public breaches, or run the Email Data Breach Scan to check whether an address appears in breach data. For continuous coverage, Breached Credentials Monitoring and Dark Web Monitoring alert you when your organization’s credentials or data surface, and Attack Surface Mapping shows which of your exposed assets attackers can see. Pair them with your patching program so a missed update does not become an unnoticed breach.