1-minute read
What a defender needs to know
Cisco Talos researcher Thorsten Rosendahl says CVEs from 2025 or earlier account for 33% of the KEV entries in his Q3 analysis. Those older exploited vulnerabilities can remain in a current patch queue even as new CVE disclosures climb. Talos says CVE identifiers have organically reached six digits after the year and flags CISA’s new forensicTriage field. Teams importing the CISA KEV catalog into inventory and ticketing systems should verify that both values survive the import.
Compare a raw CISA row such as CVE-2026-102764, which has forensicTriage set to Yes in the October 16 catalog snapshot, with the stored row and the resulting ticket. Also test a No row so a missing field cannot be mistaken for a negative value. Repair mappings and replay records if an ID is truncated or the flag is lost. The flag routes forensic review under applicable policy; it is not evidence of compromise on a specific host.
Join pre-2026 KEV entries to your current product inventory. For affected systems you still operate, check installed versions against the vendor fix and review requiredAction and forensicTriage before routing the patch or investigation. If an entry has no asset match, check for unmanaged devices or inconsistent product names before closing the ticket. The expected result is a queue with full CVE IDs, retained triage values, and a disposition for older exploited entries on live assets.