200 CVEs a Day: Why CVSS Scores Mislead Defenders

The Q2 2026 numbers from Talos are out, and the number that matters most isn’t the headline one. Thorsten Rosendahl’s quarterly analysis clocked approximately 200 CVEs published daily by the end of June — a 49% year-over-year increase. That part will get quoted. What’s less likely to get quoted is this: CISA’s Known Exploited Vulnerabilities catalog grew only 13% over the same period.

Forty-nine percent. Thirteen percent. The distance between those two numbers is where most patch queues go wrong.

Rosendahl runs the math carefully. Of roughly 3,700 CVEs carrying a CVSS score of 9.0 or higher, 95% come with EPSS scores below 5% — meaning the modeled probability that a given vulnerability is being actively exploited in the wild is, in practice, negligible. If you’re treating a CVSS 9+ score as a signal to drop everything, you’re chasing the same vulnerability that 95% of your peers are also chasing, for something that may never materialize as a real-world attack in your environment.

Of the 32 CVEs that cross both thresholds — CVSS 9+ and EPSS at or above 50% — 25 were already on CISA’s KEV list. Which means the list was already doing the prioritization work. The outliers worth monitoring are seven.

Seven isn’t a scary number. Seven is manageable.

This week made it concrete

The week that just passed illustrated the problem in real terms. Clop’s new data theft campaign targets internet-exposed PTC Windchill and FlexPLM instances — production-floor PLM systems that organizations tend to treat as “working fine, don’t touch.” Check Point’s SmartConsole authentication bypass went from vendor advisory to confirmed exploitation and a KEV addition in under 48 hours. The RefluXFS privilege escalation in the Linux kernel was nine years in the code before Qualys triggered it in a controlled environment and found that default Red Hat Enterprise Linux installations could meet the conditions for exploitation.

Three stories. Three different exploitation timelines. None of which CVSS alone would help you sort by urgency. The Check Point flaw hit KEV in under two days; the Linux bug was dormant for nearly a decade before anyone confirmed the race condition. A flat CVSS queue treats them identically. The real questions — is this being exploited now, is my surface exposed, is a patch available — are answered by KEV status and EPSS score, not by a severity rating that characterizes the theoretical worst case.

The perimeter problem

Rosendahl also flags a trend that deserves more attention than it typically gets: networking gear now accounts for 24% of KEV additions, up from 20% in Q1. Perimeter devices — firewalls, VPN concentrators, management consoles — run the oldest firmware the longest. They’re accessed least frequently, and institutional resistance to changes that “might break something” is strongest there. They are also, increasingly, where active exploitation begins. That 4-point shift in KEV composition isn’t noise.

The closing window

The other thread running through the Talos analysis is what Rosendahl calls the “artificial buffer zone” — the shrinking gap between vulnerability discovery and weaponization that human defenders have historically relied on to get patching done. The Kimi K3 story from this week is illustrative: AI research agents found multiple Redis zero-days and produced working proof-of-concept exploit chains in a single research session. Redis shipped seven security releases in response. The old assumption that defenders have a meaningful window between public disclosure and active exploitation is becoming less reliable as machine-speed discovery compresses the timeline on both ends.

The response to a faster threat environment is not to patch faster — it’s to patch smarter. The math says you cannot keep up with 200 CVEs a day regardless of headcount or tooling velocity. The question is which ones to catch. KEV status and EPSS score are the two most actionable signals in that decision. CVSS severity characterizes the theoretical worst case; it does not tell you whether anyone is walking through that door in your environment right now.

Rosendahl’s closing line lands the point: “Don’t swing at everything — swing at what you have good reason to believe is coming for you.” That’s less a philosophy than a production constraint. The 3,693 swings you don’t take leave time for the seven that matter.

The 0dayNews KEV tracker surfaces CISA additions as they happen. If that’s not in your monitoring rotation, you’re making patching decisions without the most direct signal available.