DAILY CyberSecurity’s Q3 2026 CVE report tracks every entry CISA added to the Known Exploited Vulnerabilities (KEV) catalog between 1 July and 30 September 2026. In this quarter, 100 actively exploited vulnerabilities were added, up from 75 in Q2, with nearly half rated critical. Microsoft led vendors with 12 entries, and exploitation picked up quickly, with a quarter of publish-date entries attacked within seven days of disclosure. The report also notes a rising monthly pace: 26 flaws in July, 31 in August and 43 in September.
Among the notable CVEs, several carry high CVSS scores and EPSS values. CVE-2026-72898 (SQL injection via password reset endpoint) tops the list with a CVSS of 10.0 and an EPSS around 94%. Other highly ranked entries include CVE-2026-85706 (CWE-22, CVSS 10.0, EPSS ~93%), CVE-2026-48908 (JoomShaper SP Page Builder, CVSS 10.0), CVE-2026-39808 (CVSS 9.8), and CVE-2026-63077 (CVSS 9.8).
The report notes many exploits are tied to software pipelines and management consoles, with products from Metabase, GitLab, FortiSandbox, JoomShaper, Cisco, and Progress highlighted for their elevated risk exposure. Exploitation status for these entries is confirmed, with PoCs available via Nuclei, Metasploit, and other repositories.
Practical response emphasised includes patching the ten top EPSS flaws first, treating every KEV entry with urgency, prioritising internet-facing systems within seven days of disclosure, auditing legacy software (notably CVE-2021-23758), and removing firewalls, VPNs and management consoles from direct internet exposure where feasible. The report argues that EPSS should be used alongside CVSS to prioritise patch queues as exploitation accelerates.