The CVE Flood: Why Most Vulnerability Headlines Are Alarmism, the Bugs That Actually Matter, and the Hit to Security Stocks

Opinion and analysis as of Friday, Oct 23, 2026 (ET). Stock moves use daily closing prices through Thursday, Oct 22, unless noted.

The short version

• Volume is exploding. More than 67,000 new CVEs were published in 2026 by mid-September, and the full-year count is on pace for about 96,000. Microsoft (MSFT) alone shipped a record of roughly 1,410 fixes this month.
• Real-world exploitation isn’t keeping pace. CISA’s Known Exploited Vulnerabilities (KEV) catalog holds 1,754 entries, about half of one percent of every CVE ever published. Of Microsoft’s ~1,410 October fixes, exactly one was being exploited, and it needs a user to open a crafted file.
• Wick's view: most CVE headlines describe bugs that only work under lab conditions: a prior foothold, valid credentials, a non-default setup, a user click or a chain of other bugs. CVSS scores rate the worst case, not your case. A lot of the coverage is alarmism.
• But not all of it. A short list of bugs is being used right now, mostly on internet-facing VPNs, gateways and remote-access tools. Those should be patched today, and they’re listed below.
• For stocks, individual CVEs barely move the vendors that ship them. The money is following the AI-security narrative, and the clearest winners this month are the companies that help customers sort the noise: Tenable (TENB), Qualys (QLYS) and Rapid7 (RPD).

The flood, in numbers

• CVE volume: the US standards agency NIST says CVE submissions rose 263% from 2020 to 2025, and early 2026 ran about a third above early 2025. CISA put 2026 at more than 67,000 new CVEs as of Sept. 18, with a projection of about 96,000 for the year.
• AI is a big driver: Microsoft says its own use of AI to find and fix bugs means bigger monthly updates. It patched more vulnerabilities in October than in all of 2025 and has passed 4,000 for the year. Anthropic’s research effort alone has reported 6,157 findings across 591 open-source projects, producing 516 upstream patches and 584 CVE or GitHub advisory IDs as of Oct. 2.
• The database can’t keep up: NIST enriched nearly 42,000 CVEs in 2025, a record, and still fell behind. Since April 15 its National Vulnerability Database (NVD) only fast-tracks KEV entries, software used by the federal government and “critical software.” Backlogged CVEs published before March 1, 2026 were moved to “Not Scheduled.”
• Funding is settled, sort of: after the 2025 scare, when MITRE’s contract to run the CVE program nearly lapsed and was saved by an 11-month emergency extension, the program now sits on a protected line in CISA’s budget. The contract terms still haven’t been disclosed. In September, CISA published a “Quality Era” framework that openly worries about uneven submissions in an AI-accelerated world.

Why most of it doesn’t reproduce outside a lab

A CVE is a label for a flaw, not proof that anyone can use it against you. Read past the headline and most entries come with conditions that rarely line up outside a controlled test setup:

• “Elevation of privilege” means the attacker is already in. 677 of Microsoft’s October fixes, close to half, are privilege-escalation bugs. Each one assumes the attacker already has code running on the machine.
• Credentials and access first. The Palo Alto Networks (PANW) PAN-OS bug added to KEV on Oct. 14 (CVE-2026-0322) needs an authenticated session on the firewall’s management interface, which shouldn’t be reachable from the internet in the first place. Arista Networks (ANET) says its exploited VeloCloud Orchestrator flaw (CVE-2026-114625, CVSS 9.9) needs a valid logged-in session. The publicly disclosed .NET bug (CVE-2026-108398) needs an authenticated local attacker.
• A user has to cooperate. October’s one exploited Windows bug (CVE-2026-96951) bypasses the “Mark of the Web” download warning. In Microsoft’s words, “an attacker would have no way to force a user to view attacker-controlled content.”
• Chains, not single bugs. The Plex2Shell attack on Plex Media Server uses four CVEs, each rated only 4.3 to 7.2. They only become critical, about 9.8, when chained, and the final step needs admin-level access that the earlier bugs supply.
• CVSS rates the worst case. 54.7% of scored 2026 CVEs land in the High or Critical bands, yet only 0.2% carry an EPSS score (the industry model’s estimate of the chance of exploitation in the next 30 days) of 10% or more. When over half of everything is “high,” the label stops helping anyone prioritize. Microsoft even rescored three September SQL Server bugs after release, and still lists a SharePoint flaw as “Exploited: No” weeks after confirming attacks on it. Scores and flags are rough guides, not measurements.
• The report pipeline has its own noise. curl’s maintainer Daniel Stenberg shut the project’s bug bounty on Jan. 31 after a flood of AI-written junk reports. Fewer than 5% of 2025 submissions turned out to be real vulnerabilities. By this week he says the fabricated reports are “practically gone,” replaced by high-volume, mostly accurate AI-assisted reports that still struggle to tell a bug from a vulnerability, or to judge severity. That’s more real findings, but also more marginal ones, each still headed for a number.

The fair counterpoint: “hard to reproduce” isn’t the same as “safe.” Attackers only need one working path. Old bugs never fully die: on Oct. 8, CISA added a 2015 ProFTPD flaw and a 2015 BIND flaw to KEV because unpatched systems are still being hit. And chained mediums like Plex2Shell show why “only a 6.5” can still end in a hijacked server. The right takeaway isn’t to ignore CVEs. It’s to rank them by exploitation and exposure, not by count or CVSS.

The ones that ARE exploited: patch these now

These have confirmed or broad real-world exploitation, or a government “patch immediately” order. Internet-facing edge devices are the common thread.

×

• PHP2Shell (CVE-2026-109618 and -109619): unauthenticated remote code execution in PHP itself, affecting every PHP installation that serves web requests, which covers a large share of WordPress, Drupal and Magento sites. CISA, the NSA and the FBI urged immediate updates to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or taking systems offline. Amazon (AMZN) threat researchers saw an exploit attempt four days before the Oct. 21 disclosure, then broad attempts within hours of it. This is the exception that proves the rule: no preconditions, huge install base.
• Ivanti Connect Secure (CVE-2026-104935): an authentication bypass on an internet-facing VPN, with an EPSS of about 26%. Ivanti is privately held. Its VPN appliances keep showing up on this list.
• BeyondTrust Remote Support (CVE-2026-102764, CVSS 9.8): an authentication bypass in a remote-access tool, which is exactly the kind of foothold ransomware crews want. BeyondTrust is private.
• Cisco (CSCO) Secure Email Gateway (CVE-2026-76519, 9.8) and Fortinet (FTNT) path-traversal flaws in FortiMail (CVE-2026-104286) and across multiple products (CVE-2025-61624): mail and network appliances that face the internet by design.
• Citrix NetScaler (CVE-2026-88779): the latest of several NetScaler KEV entries since late September. Citrix is part of the privately held Cloud Software Group.
• PAN-OS (CVE-2026-0322): patch it, and take the management interface off the internet. That second step neutralizes the whole class.
• Arista VeloCloud Orchestrator (CVE-2026-114625): the third exploited VCO zero-day in four months. Arista says on-premises deployments are exposed by default.
• Windows Shell (CVE-2026-96951) and SharePoint (CVE-2026-65660): if any SharePoint server is missing the August update, install it now.
• Plex2Shell, if you self-host Plex: the fix (1.43.3.10861) has been out since Aug. 4, a public exploit followed on Oct. 19, and cryptominer attacks started almost immediately.

The federal rulebook now says the same thing. CISA’s Binding Operational Directive 26-04 tells agencies to prioritize KEV bugs on publicly exposed assets that give total control of the system, and explicitly allows “deferring action for lower-risk vulnerabilities.”

Impact on industry players

Security vendors: the fear bid is real, but it follows AI, not CVEs

• Oct. 14 is the cleanest test. The day Palo Alto’s PAN-OS flaw and Cisco’s email-gateway bug joined KEV, PANW fell 5.5%. But Cloudflare (NET) fell 6.7%, Okta (OKTA) 6.5%, CrowdStrike (CRWD) 4.6% and Tenable 7.7%, and none of them had a new KEV entry. The Amplify Cybersecurity ETF (HACK) fell 3.7%. That was a group move, not a CVE penalty.
• Oct. 21 shows the fear trade. On the day of the PHP2Shell warnings, Zscaler (ZS) rose 7.8%, OKTA 7.5%, CRWD and NET 5.3% each, TENB 4.3% and PANW 2.0%, while HACK gained 3.2%. Midday Friday the group added another 3–6%, with PANW and OKTA both up about 6% intraday.
• The month’s winners sell triage. From Sept. 30 to Oct. 22, RPD rose 20.5%, ZS 19.2%, Check Point Software (CHKP) 18.4%, TENB 15.4% and QLYS 11.2%. Meanwhile PANW (−10.7%), CRWD (−10.1%) and NET (−12.6%) lagged. When the CVE count doubles, the scarce product is knowing which 0.5% matter. That favors exposure-management and scanning vendors over another detection layer.
• SentinelOne (S) fell 5.0% on Oct. 14 and 5.3% from Sept. 30 to Oct. 22. Being cheaper hasn’t protected it from the group’s swings.

Vendors whose products carry the bugs

• MSFT shrugged off a record Patch Tuesday: up 1.6% from Sept. 30 to Oct. 22. Its earnings after the close on Oct. 28 matter far more to the stock than 1,410 CVEs.
• CSCO slipped 2.5% over the same span. That’s hard to pin on one email-gateway bug.
• The reputational hit lands on edge appliances. FTNT (down 3.2% over the month), PANW, Ivanti, Citrix and Arista keep recurring on KEV because VPNs, firewalls and gateways are internet-facing by design. The cost shows up slowly in renewal talks and displacement pitches rather than in one-day drops. It also feeds the sales pitch for cloud-delivered alternatives, which helps explain ZS’s run.

Cyber insurance

• US cyber insurance premiums were about $9.46 billion in 2025. Claims rose 20% to 56,323, and the loss ratio climbed to 53%. Rates are still falling in a soft market, though the cuts are slowing.
• Insurers increasingly ask about specific exposures, such as an unpatched VPN or remote-access tool, rather than raw patch counts. The KEV list is effectively becoming the underwriting checklist. Expect pricing to firm first for companies with internet-facing appliances from repeat-offender vendors.

Scenarios into year-end

Wick’s pickBase (55%), the noise keeps rising and the exploited set stays small: 2026 ends near the ~96,000 CVE projection, KEV keeps adding a couple of dozen a month concentrated in edge devices, and budgets tilt toward prioritization. TENB, QLYS and RPD keep their relative edge, and platform names trade on earnings and AI headlines.

Wick's take

Wick's pick is the Base case (55%). The CVE count is a measure of how much code is being examined, increasingly by AI, not of how much danger you face. Most of what gets a number won’t reproduce outside a lab without a foothold, credentials, a click or a chain. Treating every “critical” as a fire drill burns time that should go to the short list that is actually being exploited.

• Patch now: anything on KEV that faces the internet, plus PHP2Shell.
• Patch on schedule: the rest of Patch Tuesday, ordered by EPSS and exposure.
• Don’t panic over a high CVSS score that needs local access or a non-default setup.

For investors, the CVE flood is a tailwind for the companies that sell sorting, and mostly noise for the companies that ship the bugs.

What would change the view: a sustained jump in monthly KEV additions, or another precondition-free mass-exploitation event after PHP2Shell, would move Wick toward the AI-speed scenario.

What to watch

• Wed Oct 28, 4:05 PM ET: Microsoft FY27 Q1 earnings (after the close)..ics
• Wed Oct 28, 4:30 PM ET: Fortinet Q3 2026 earnings call..ics
• Mon Nov 2, 8:30 AM ET: Check Point Q3 2026 results call (results before the open)..ics
• Tue Nov 3: CISA’s federal deadline for the remaining Plex2Shell and Siemens Software Center fixes..ics
• Thu Nov 5, 5:00 PM ET: Cloudflare Q3 2026 earnings call..ics
• Tue Nov 10, 1:00 PM ET: Microsoft November Patch Tuesday..ics

Opinion and analysis, not investment or security advice. CVE details reflect public advisories as of Oct 23, 2026. Stock moves use daily closing prices except where marked intraday.

Add all 6 events to calendar (.ics) Times are ET. Each event has a 1-day reminder. Estimated dates are marked.