An older CVE can still be the urgent item in a patch queue. Cisco Talos researcher Thorsten Rosendahl says CVEs from 2025 or earlier make up 33% of the Known Exploited Vulnerabilities (KEV) entries in his Q3 analysis. For teams that import CISA’s catalog into asset and ticketing systems, the immediate job is to make sure those older entries survive the feed-to-inventory join.
Rosendahl also flags two ingestion changes: CVE identifiers have organically reached six digits after the year, and KEV has a forensicTriage field. A parser that expects only four or five digits, or drops an unfamiliar column, can give an analyst an incomplete queue even while the feed import reports success. Test both conditions against your own importer before trusting its ticket count.
Discovery volume and exploited backlog
Talos says the number of CVEs crossed 70,000 by the end of September 2026, with its year-over-year CVE figure up 105% and KEV growth up 37%. KEV growth followed a 30% increase from 2024 to 2025. Rosendahl’s conclusion is direct: “discovery isn’t exploitation.” Treat the disclosure count as work for vulnerability intake; use the exploited catalog and your asset exposure to order the response.
Older flaws account for a sizable part of the work. Rosendahl puts 29% of the 2026 CVEs he examined in the group whose publication date matches the date added to KEV, two percentage points above his figure for 2025. He also says network-gear CVEs rose slightly to 27% of the figures he discusses. Use your installed-product inventory to find which long-lived KEV entries need work here, then reopen the matching patch tickets.
Two fields worth testing end to end
CISA’s machine-readable KEV catalog identifies a vulnerability with cveID and carries forensicTriage alongside fields including dateAdded, dueDate, requiredAction, and knownRansomwareCampaignUse. Its October 16 snapshot includes the six-digit CVE-2026-102764 with forensicTriage set to Yes. It also records CVE-2025-61624 with Yes and CVE-2026-105133 with No. A No value is still data: preserve it so a downstream rule can distinguish it from a dropped field.
Rosendahl says the new column flags high-risk vulnerabilities for mandatory forensic triage and incident-response workflows under CISA’s directive. The catalog’s requiredAction text points to BOD 26-04 and its implementation guidance. Federal operators should follow their applicable directive and agency workflow; other teams can use the flag to route review under their own policy. Treat a Yes value as a prompt for the applicable triage workflow; determine the condition of a particular machine through that investigation.
For a feed integration, the route is straightforward: CISA publishes a catalog row, your importer parses cveID and forensicTriage, an inventory join finds installed affected products, and the ticketing system routes a patch or investigation. A truncated identifier breaks that join. A missing triage value can send a Yes row down a routine patch path. Keep the raw feed record or an immutable ingest snapshot alongside the normalized record so you can compare the two when a queue looks too quiet.
Reconcile imports with the catalog
Test the importer with the CISA catalog rows above. Compare the raw cveID and forensicTriage values with the stored rows and the tickets created from them; expect the complete six-digit identifier and both literal Yes and No values to survive. If the import truncates an ID or erases the triage field, repair the mapping, replay the affected feed records, and recheck the resulting asset joins and ticket routes. That changes the queue an operator actually works from.
Reopen older exploited patch tickets
Then join the KEV entries for CVEs from 2025 or earlier to your current product inventory and patch tickets. Confirm the installed version against the applicable vendor fix for each product you actually run, and move unresolved affected systems into your normal remediation or incident-response path according to requiredAction and forensicTriage. Check reachable network devices as part of that inventory where they match a KEV product. An absent asset match deserves an inventory check before a ticket is closed: unmanaged devices and inconsistent product names can hide a real exposure from an otherwise correct feed import.
The useful result is a queue with complete IDs, retained triage values, and a disposition for the older KEV entries that match live assets. That queue gives the next analyst a concrete patch backlog.