CISA added three new vulnerabilities to its Known Exploited Vulnerabilities catalog in the seven days ending November 8, 2026, bringing the month's total to 35 new KEV entries in 30 days. The additions span three vendors - SonicWall, Apple, and WordPress - and join a catalog that now lists vulnerabilities confirmed exploited in the wild rather than merely theoretical.
For defenders, the KEV catalog is the closest thing to a government-backed patch priority list. When CISA adds a CVE, it means attackers are using it right now, not that someone in a lab discovered a flaw that might matter someday. Federal agencies face remediation due dates; everyone else gets the strongest fix-first signal available.
The pace matters more than any single entry. CISA confirmed 3 newly exploited vulnerabilities in the last seven days, down from 10 the week before and 17 across the two weeks before that. Thirty-five new KEV entries in 30 days is a lot of ground to cover for patch teams that still run monthly cycles.
Why the Volume Keeps Rising
Most-affected vendors this month are Plex, Ivanti, Cisco, and PHP Group. That is not a coincidence. These are the products that sit at the edge of networks, in identity stores, and in the frameworks that run public-facing sites. Attackers do not need to find novel bugs when the same categories of software keep producing exploitable flaws.
The Hacker News community has been focused on a parallel set of problems. CVE-2026-98432, a TCP use-after-free scored CVSS 9.8, drew 1,798 points. CVE-2026-109618 and CVE-2026-109619, both tied to a PHP remote code execution embargo breach, drew 1,428 and 1,204 points respectively. CVE-2026-20841, a Windows Notepad remote code execution flaw, drew 832 points. These are community attention signals, not CISA exploitation verdicts, but they point at the same problem: the software people use every day keeps shipping code that can be turned against them.
The SonicWall entry is worth particular attention. SonicWall SMA 1000 appliances were already added to the KEV catalog earlier this year with CVE-2026-15409 and CVE-2026-15410. A second round of additions means the vendor's edge devices continue to attract attacker interest, and organizations that delayed patching the first round are now exposed on two fronts.
Apple's inclusion is a reminder that client-side software is not immune. A vulnerability in a widely deployed operating system or browser component can be chained with other flaws to bypass security controls. The KEV catalog does not require the vulnerability to be in a server product; if attackers are exploiting it, it qualifies.
What This Means for Patch Teams
The gap between disclosure and exploitation keeps shrinking. CISA's due dates for federal agencies are typically measured in weeks, not months. For private organizations, there is no deadline at all, which means the KEV catalog is advisory rather than enforceable. That is the tension. The signal is strong but the mechanism to act on it is voluntary.
Security teams that still batch patches into monthly windows are the ones most exposed. A CVE added to KEV on a Tuesday can be in ransomware payloads by Friday. The 35 entries in 30 days means a new exploited vulnerability roughly every day, and most organizations cannot test and deploy a patch that fast.
Ransomware Use Is the Real Differentiator
Not every KEV entry carries a ransomware flag, but the ones that do deserve immediate attention. The catalog tracks whether a vulnerability is known to be used in ransomware campaigns, and that distinction separates a patch that can wait from one that cannot. When a CVE moves from theoretical to confirmed exploited, the question shifts from whether it will be used in attacks to how fast the patch can reach production.
The vendors recurring in the KEV catalog - Cisco, Microsoft, Apple, Adobe, Google, Palo Alto Networks, Fortinet, Ivanti - are not obscure. They are the infrastructure layer. That is the uncomfortable part. The products organizations trust most are the ones most frequently confirmed exploited.
EPSS scores add another layer of urgency. A high EPSS score means the probability of exploitation in the next 30 days is elevated. When CISA confirms active exploitation and the EPSS score is high, defenders have little room to defer. The combination of KEV listing and high EPSS is the closest thing to a red alert in vulnerability management.
What Defenders Should Do Now
Patch teams should treat KEV additions as same-week priorities, not next-month backlog items. The CISA catalog is free, published as JSON and CSV, and updated multiple times daily. There is no cost barrier to using it. The barrier is operational: can your team test and deploy a patch within days rather than weeks.
Organizations running SonicWall, Apple, or WordPress products should check their versions against the three newest entries immediately. For the broader set of 35 entries from the last 30 days, the Senserva tracker enriches each CVE with CVSS and EPSS scores and flags ransomware use.
It is not clear that the volume will drop. The count went from 17 entries in two weeks to 10 to 3, which looks like a decline, but the 30-day total of 35 is still high by historical standards. Whether the slowdown holds or the next wave arrives depends on whether vendors change how they ship code, not on how fast defenders patch.
For more on how CISA's catalog works and what a KEV entry means, see the official KEV catalog.
Organizations that want to track these additions automatically can use the CISA KEV JSON feed, which is free and machine-readable. The CISA cybersecurity advisories page often accompanies new KEV entries with additional context.
The economic case for faster patching is straightforward. A single ransomware incident can cost millions in downtime, recovery, and lost revenue. Against that, the cost of a patch management platform and the staffing to run it is small. The gap is not money; it is organizational will and the willingness to interrupt production for security work that never shows up on a revenue dashboard.
The next 30 days will likely look similar. Attackers have incentives to find the next edge-device flaw, and vendors have incentives to ship features fast. Defenders are left holding the patch queue.
Related coverage on this site: cybersecurity desk.