Known exploited vulnerabilities, July to September 2026: what the CISA catalogue says about the office boundary

The Known Exploited Vulnerabilities catalogue is kept by the Cybersecurity and Infrastructure Security Agency in the United States. An entry needs three things: a CVE identifier, reliable evidence that attackers have used the flaw against real systems, and a fix or mitigation from the vendor. The catalogue carries no severity score, because every entry has already been used. Australian guidance treats the same evidence the same way: a flaw with a working exploit in an internet-facing service goes into the shortest patch window the Essential Eight sets.

We read the catalogue’s public JSON feed on 11 November 2026, in the version CISA released on 9 November 2026, and took every entry whose date added falls between 1 July and 30 September 2026. The entries were counted by calendar month and by the vendor name the catalogue gives each one; a vendor with several affected products counts once in the vendor count. The date added never changes once an entry is listed, so the counts for the quarter are the same in every later version of the catalogue. The two earlier quarters of 2026, the months to October and the same quarter of 2025 were counted from the same version, the same way.

The ransomware figure is the catalogue’s own flag for entries CISA has tied to a known ransomware campaign, as it stands in the version we read. CISA sets the flag when the evidence arrives, which can be months after the entry is listed, so the count for a recent quarter starts low and rises. The date added is the day CISA listed the entry; the flaw may have been exploited for weeks before that. Every figure here is a floor, and no CVE is named, because the point is the volume and where it falls.

Run the same match against your own boundary

The feed is a file anyone can download, and it carries the vendor, the product and the date added for every entry. Write down every device and service your firm exposes to the internet, with its vendor, model and firmware version, including the ones a provider runs for you: the office firewall, the VPN or remote access gateway, the router at each site, the email gateway, any server published for staff or clients, and the consoles that manage them. Match the feed’s vendor and product fields to that list each week and open a ticket for every match.

A match on a boundary device is due in two days at every maturity level. A match elsewhere takes the window the maturity model sets for that class of software. Where the vendor has published a fix and it cannot be applied in time, the compensating step is the same each time: restrict the device to known addresses, turn off the affected feature, or take the service off the internet until the fix is in.

The list is where the match usually breaks. A patch report from the desktop management tool covers the laptops and says nothing about the firewall, whose firmware is updated by whoever installed it, when they remember. The boundary devices in the catalogue are the ones nobody owns on paper.