The common picture of an exploited vulnerability is a clever memory bug found by a skilled team. This year's catalogue does not look like that.
Of the 237 vulnerabilities CISA has added to its Known Exploited Vulnerabilities list in 2026, grouped by the weakness recorded against each one:
- 53 are injection. The system ran something it was sent.
- 45 are authentication or authorisation failures. The system did not properly check who was asking, or what they were allowed to do.
- 36 are memory safety bugs.
Authentication failures are 19% of this year's additions. In everything added before 2026 they were under 10%. Memory safety has gone the other way, from 25% to 15%.
Why that matters. A missing authentication check on an internet-facing management interface does not take skill to use once it is public. So the fix has two halves. Patch it. Then ask why it was reachable, because a management interface nobody on the internet can reach cannot be exploited from the internet, whatever its bugs.
