2026 State of the Attack Surface
Critical Exposures Intelligence Hub
In 2026, CVEs represent only part of the exposure landscape. The first half of 2026 produced record CVE volume and an all-time remediation high for a Patch Tuesday. But studying the full attack surface tells a broader story. Misconfigurations, control gaps, and end-of-life assets are just as exploitable, and far less visible. We analysed the 2026 vulnerability landscape for the first half of the year alongside aggregated data from 800,000+ IT assets to show you where the average enterprise is exposed today.
One in three IT assets are missing at least one critical control
Your attack surface is bigger than you think
Exposures at Scale
end-of-life
A Decade of CVEs in Review:
CVE volume has grown steadily since 2016. What makes 2026 different is the pace. Based on the rate from the first half of the year, 2026 is already on track to surpass 2025's total, which itself set a record at 42,253 CVEs.
The critical and high-severity mix is intensifying alongside raw volume, compressing the window security teams have to assess, prioritise, and act.
Adding to that pressure, nearly 10% of CVEs published so far in 2026 — roughly 3,000 — are still awaiting CVSS analysis, meaning organisations are making prioritisation decisions without complete severity data on a meaningful portion of the landscape.
In an environment where patch capacity is finite and the backlog is growing, knowing which vulnerabilities are exploited in the wild matters more than ever.
- 5,297
- 5,191
- 7,939
- 6,504
- 6,454
- 14,714
- 16,557
- 17,344
- 18,325
- 20,171
- 25,226
- 29,065
- 40,289
YoY Vulnerability CVSS v3 Severity Breakdown
Total
Take a look at the
Top 10 Vulnerabilities
of 2026 (so far)
SimpleHelp
CVE-2026-48558
Authentication bypass vulnerability allows unauthenticated attackers to forge OpenID Connect login tokens.
Critical
GNU
CVE-2026-24061
Login input flaw allows attackers to instantly obtain a root shell without authentication.
Critical
Ivanti
CVE-2026-24061
App distribution injection flaw allows unauthenticated remote code execution on MDM devices.
Critical
Palo Alto Networks
CVE-2026-0257
VPN authentication bypass lets attackers forge session cookies and gain unauthorised network access.
Critical
Cisco
CVE-2026-20127
SD-WAN authentication bypass grants full control of network fabric via unauthenticated admin access.
Critical
Microsoft
CVE-2026-20964
SharePoint deserialisation bug enables arbitrary code execution via crafted payloads.
Critical
Citrix
CVE-2026-3055
SAML request manipulation leaks credentials and enables session hijacking and MFA bypass.
Critical
Palo Alto Networks
CVE-2026-0300
Captive portal buffer overflow enables unauthenticated root-level code execution on firewalls.
Critical
Fortinet
CVE-2026-35616
Unauthenticated API flaw allows full endpoint management takeover via remote code execution.
Critical
Microsoft
CVE-2026-21509
Malicious Office documents can bypass protections and load unsafe embedded components.
Critical
Five Patterns Defining the Vulnerability Landscape
So far this year, the most exploited vulnerabilities are associated with assets organisations are least likely to see, patch, or protect.
Edge Devices under sustained exploitation
SD-WAN controllers, NGFWs, & VPN/ADC appliances account for a disproportionate share of critical KEV entries. Cisco SD-WAN alone contributed 4 KEV filings.
Backup and recovery infrastructure targeted
Ransomware groups increasingly target backup systems first (CVE-2026-22769) to eliminate recovery options before detonating payloads.
SAML and authentication layer attacks rising
Ivanti EPMM appeared twice on KEV in the first half of 2026. Compromising mobile device management cascades to thousands of endpoints in a single exploit.
MDM/EMM platforms remain high-value
Multiple critical authentication bypass CVEs in 2026 exploit SAML IDP flows, password reset mechanisms, and alternate path authentication — targeting the identity layer directly rather than application logic.
Supply chain poisoning re-emerges
Several 2026 KEV entries involve embedded malicious code in open-source packages, signalling a continuation of software supply chain attack trends from 2024–2025.
Adversary Trends and Patterns
Threat actors are optimising tried and true playbooks to move faster, against the same gaps, with a more effective toolkit
Logging in,
not breaking in
65% of non-BEC IR cases involved abuse of remote access tools like RDP, VPN, RMM. Up from 24% three years ago.
Zero-days
not required
All of the top 10 most-exploited CVEs had patches available before exploitation at scale.
Misconfiguration
abuse surging
11x data extortion without ransomware
Shrinking exploit windows
June marks all-time Patch Tuesday record
Ready to
get started?
We’re here to help. Reach out to schedule a demo with one of our team members and learn more about how Arctic Wolf can benefit your organisation.
General Questions
