34 vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalogue so far in September. That is already the most of any month in 2026, with a week still to run.
The monthly counts this year.
- January 17
- February 28
- March 26
- April 31
- May 21
- June 23
- July 26
- August 31
- September 34, to 22 September
One month is not a trend. But the direction since May is up, and each of those 34 has confirmed exploitation behind it, not a theoretical score.
The practical point is capacity. If your team can close a handful of exploited findings a month and the catalogue is adding thirty, the answer is not to go faster. It is to find, on the day of addition, the two or three that are actually in your estate.
