VULNCHECK STATE OF EXPLOITATION 2026

Summary from the TLDR InfoSec newsletter

VulnCheck identified 884 Known Exploited Vulnerabilities in 2025, with 28.96% exploited on or before CVE publication, up from 23.6% in 2024, highlighting the continued prevalence of zero-day and rapid n-day exploitation. Network edge devices such as firewalls, VPNs, and proxies were the most targeted technologies, followed by content management systems and open source software. Organizations should prioritize the timely remediation of newly disclosed vulnerabilities affecting internet-facing infrastructure while maintaining visibility beyond CISA KEV through additional exploitation intelligence sources.