69,615 CVEs have been published in the US National Vulnerability Database so far in 2026. 156 CVEs with a 2026 number are on CISA's Known Exploited Vulnerabilities list. That is about one in 450.
Two cautions before reading too much into it.
- The KEV list is confirmed exploitation, not all exploitation. The true figure is higher.
- Exploitation lags publication. Some of this year's CVEs will be added in 2027 and later. 81 of this year's 237 additions carry an older number.
Even so, the order of magnitude is the point. Most of what a scanner shows you will never be exploited against anyone. A small fraction will be exploited widely. A programme that treats every critical finding as equally urgent spends most of its capacity on the first group.
The flag that separates them is public and free. The work is joining it to your own findings every day.
