Patch what attackers actually exploit

Patch what's being exploited first. A 12-page data brief built from CISA's Known Exploited Vulnerabilities catalogue (version 2026.09.23), FIRST's EPSS scores (2026-09-23) and every CVE NVD published from 25 August to 24 September 2026.

Inside

• The KEV catalogue in numbers: 1,721 entries, 361 marked for ransomware use, 46 added in the last 30 days, top vendors, products and weaknesses
• How fast vulnerabilities reach KEV: the median for 2025–2026 additions is 18.5 days; 45.5% of the catalogue was listed more than a year after publication
• Why severity-only patching misses exploited bugs: 194 KEV entries score below CVSS 7.0
• EPSS cut-offs against KEV: EPSS ≥ 0.10 flags 4.6% of scored CVEs and covers 75.3% of KEV
• The month's 14,363 new CVEs by severity, NVD status, CNA, vendor and weakness
• A watchlist of the 20 new CRITICAL CVEs with the highest EPSS not yet in KEV, the 24 new CVEs already in KEV, and upcoming KEV deadlines
• Appendix: all 46 KEV additions of the last 30 days

You get the PDF, an HTML version, three CSV tables (KEV additions, upcoming deadlines, critical watchlist) and the Python script that computes every number from the public data, so you can check it or rerun it. Every figure comes from the data; nothing is estimated.

Who it's for: security and IT teams deciding what to patch this month, MSPs writing client updates, and analysts who need sourced numbers for a report.

Information only; not a substitute for your own vulnerability management. Not affiliated with CISA, FIRST or NIST.

Licence: use inside your organisation and quote figures with attribution; don't resell the brief as-is. One-time purchase, instant download. © 2026 CyberMax.