CISA KEV Tops 1,739 Entries: The Failure of CVSS as a Standalone…

The CISA KEV catalog has surpassed 1,739 entries. Theoretical CVSS severity does not predict real-world exploitation: decade-old bugs with maximum scores suddenly become emergencies.

The CISA KEV catalog surpassed 1,739 entries on October 11, 2026. Twenty-eight new CVEs were added in the preceding thirty days, five of them linked to the China-linked group Flax Typhoon. The figure is not merely a quantitative alarm; it exposes a structural failure in legacy vulnerability management—the kind that still drives patching SLAs by CVSS score as if theoretical severity and impact risk were the same thing.

Key Takeaways

The CISA KEV catalog exceeded 1,739 entries as of October 11, 2026, with 28 additions in the last month per independent trackers.
Five vulnerabilities in the October 2026 batch are attributed to Flax Typhoon, which exploited bugs dating back to 2015 with maximum CVSS scores that were never effectively patched.
FIRST.org explicitly states that CVSS scores measure severity, not risk, and should not be used alone for assessment.
Only 19.9% of CVEs entering KEV had an EPSS score above 0.5 before CISA confirmation, highlighting the model's predictive limit.

From 1,739 Entries a Pattern Emerges: Decade-Old Flaws Return Overnight

KEV catalog growth is not linear. The 28 additions in the month leading up to October 11, 2026 include CVE-2015-3306 (ProFTPD, CVSS 10.0) and CVE-2021-3199 (ONLYOFFICE Docs, CVSS 9.8): both had been public for years with maximum scores, both became emergencies only when CISA confirmed active exploitation. The CVSS score did not change; only the exploitation status did.

According to the primary source, Flax Typhoon exploited five specific bugs in the October 2026 batch, some dating to 2015. The group did not necessarily "discover" unknown vulnerabilities; it simply activated known flaws, with maximum CVSS, that had lingered for years in the gray zone of unpatched systems. The discrepancy between "dangerous on paper" and "actively exploited right now" is the core of the problem.

CVSS Measures Technical Impact, Not Attack Likelihood

FIRST.org, the body that manages the CVSS standard, states clearly: "CVSS Base (CVSS-B) scores are designed to measure the severity of a vulnerability and should not be used alone to assess risk." The quote is not a fringe opinion; it is the framework's own definition. CVSS calculates theoretical technical impact (confidentiality, integrity, availability) in a hypothetical worst-case scenario, ignoring the operational environment, compensating mitigations, exploitation history, and intelligence on specific actors.

The result is a systematic distortion in security teams. A flaw with CVSS 9.8 or 10.0 triggers an accelerated patching cycle even when no exploit is documented; meanwhile, bugs with moderate CVSS but confirmed exploitation sit in the queue. The KEV catalog exists precisely to correct this gap, but it is reactive by definition: it responds after confirmation, not before.

EPSS Attempts Prediction, But Precision Is Low

The Exploit Prediction Scoring System (EPSS), in version v4 with model v2025.03.14, estimates the probability a CVE will be exploited within 30 days. The baseline exploitation rate across all CVEs with an EPSS score is 2-3%. However, per analysis cited by shattered.io, only 19.9% of CVEs entering KEV had an EPSS score above 0.5 before CISA confirmation.

The data is telling: EPSS, while the only predictive framework of the trio, fails to identify the majority of vulnerabilities that will become actual emergencies in advance. The gap between prediction and reality leaves exposure windows measurable in days or weeks—enough for actors like Flax Typhoon, who systematically monitor the interval between CVE publication and KEV inclusion.

"That gap between 'this looks dangerous on paper' and 'this is actively being exploited right now' is the entire reason security teams argue about CVSS score vs CISA KEV"

Discrepancies in the Numbers and Dossier Limits

KEV counts present a discrepancy worth flagging: shattered.io reports 1,739 total catalog entries as of October 11, 2026, while Senserva tracks roughly 1,350 actively exploited non-Microsoft CVEs on the same date, with 41 additions in the last 30 days and 244 vendors linked to ransomware campaigns. The two numbers are not in direct contradiction—the 1,739 total likely includes Microsoft entries absent from the Senserva tracker—but the dossier does not explicitly confirm the vendor composition of the CISA catalog.

The calculation of the so-called "5-Day Patch Gap" is not explicit in the primary source text: it is unclear whether it refers to an average, a median, or specific cases. The methodology of the "independent trackers" arriving at 1,739 entries is not described. It is also unconfirmed whether the CrowdStrike analysis on EPSS (19.9%) is current to October 2026 or refers to an earlier historical period. The actual extent of Flax Typhoon's exploitation—victim count, geography, sectors hit—is not quantified.

What to Do Now

Review patching SLAs that use only CVSS thresholds (>7.0, >9.0) as triggers: the source documents that maximum-score bugs can lie dormant for years, while decade-old flaws become emergencies overnight.
Integrate the KEV catalog into prioritization workflows even before formal mandate: BOD 22-01 (now BOD 26-04) imposes deadlines on federal civilian agencies, but private organizations follow KEV de facto for insurance compliance and government contracts.
Treat EPSS as a complementary indicator, not a standalone predictor: 19.9% pre-KEV precision means over 80% of future emergencies would not be caught early by EPSS score alone.
Map CVEs with maximum CVSS but no confirmed exploitation: they are prime candidates for removal from the fast-track, freeing resources for reactive KEV monitoring and intelligence on specific actors like Flax Typhoon.

The Incomplete Triangle: No Framework Suffices Alone

The reading that emerges from the dossier is of a prioritization triangle with three weak vertices: CVSS mismeasures risk, KEV arrives late, EPSS predicts little. None of the three frameworks, alone, guides an optimal vulnerability management strategy. CISOs must build manual overlays—between static severity, dynamic confirmation, and actor intelligence—because standardized tools do not provide them automatically.

The Flax Typhoon case is exemplary not for technical sophistication, but for operational patience: exploiting 2015 bugs with CVSS 10.0 means the group played on a field where defense had already lost, simply without realizing it. The true measure of risk is not the number in the CVSS column. It is the persistence of the vulnerability in the unpatched inventory, multiplied by the confirmation that someone is finally knocking.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter