CISA's Known Exploited Vulnerabilities catalogue, at version 2026.10.28, holds 1,762 entries. 278 of them were added during 2026. Every figure in this piece was counted from that feed rather than taken from anybody's summary of it.

Three of those 278 are the same product: Arista VeloCloud Orchestrator, added on 27 July, 22 September and 23 October. End to end that is 88 days.

Three different bug classes, one product

3 different weaknesses, rather than 1 flaw found three ways. 27 July was an OS command injection, 22 September improper input validation, and 23 October an SQL injection: different parts of the same on-premises orchestrator, each confirmed exploited before CISA listed it.

We covered two of them as they happened: the October SQL injection, where the lowest role the product offers is enough, and the pattern that keeps appearing in these advisories, where the fix and the investigation want the machine in different states.

An SD-WAN orchestrator is not an ordinary target either. It is the control plane for the fabric, which means an operator session on it reaches the networks of every tenant it manages.

Every one of them got the shortest deadline

All 3 carry a due date 3 days after the date added. That is the tightest window the catalogue issues, and it is not rare any more: of the 278 entries added in 2026, 149 carry a window of 3 days or less.

Read that number twice. More than half of this year's listings are telling federal agencies to patch inside a long weekend, which is a statement about how quickly the listed flaws get used rather than about the agencies.

The flag that did not exist in May

The feed carries a forensic triage field. 94 entries have it set, every one of them added in 2026, and the earliest is 25 June. All 94 also carry the short window, so the flag and the three-day deadline travel together, which means the catalogue invented a category this summer and has used it 94 times since.

It is worth knowing which products collected them. The Linux kernel has 6, SharePoint 4, SonicWall's SMA1000 appliances 4, and then three apiece for VeloCloud Orchestrator, Citrix NetScaler and N-able N-central. That is a list of edge appliances and management planes, with one operating system kernel in it.

A forensic triage flag is the catalogue saying that patching is not the whole instruction. The required action text points at CISA's own forensics triage requirements under BOD 26-04, which is a different kind of ask: look first, because the fix may remove what you needed to find.

What the 2026 list is made of

By vendor, the year so far: Microsoft 40, Cisco 19, then Linux, Google, Fortinet and Apple on 9 each, Adobe 7 and Ivanti 6. One vendor accounts for about 1 entry in 7, and the top 2 together for roughly a fifth of everything added this year.

By product it is more revealing. Windows leads with 14 and the Linux kernel follows with 9, but after those come Citrix NetScaler and Cisco Catalyst SD-WAN Manager on 5, SharePoint on 5, and a long tail of 4s and 3s that is mostly remote management software: SonicWall SMA1000, JFrog Artifactory, Plex Media Server, N-able N-central, SimpleHelp, PaperCut, Ivanti Endpoint Manager Mobile, Ubiquiti UniFi OS, SolarWinds Web Help Desk.

Two entries in that tail are worth their own line. Langflow has 4 and BerriAI LiteLLM has 3. AI tooling is now a standing category on the exploited list, not an outlier.

What to do

  • If you run VeloCloud Orchestrator on premises, treat it as a product with a history rather than as a device that had an incident. Three listings in 88 days is a pattern, and the next advisory is a reasonable thing to plan for.
  • Inventory management planes separately from endpoints. The catalogue says that is where the pressure is.
  • Treat a 3-day entry as its own class of work. If more than half of this year's listings carry one, a quarterly patch cycle is not a plan.
  • Where an entry carries forensic triage, collect before you patch, because the sequence is the whole point of the flag.

What is not established

  • Why CISA chooses a particular due date. The feed carries the dates and not the reasoning.
  • Whether the three VeloCloud flaws share a root cause, a researcher or a campaign. Nothing published connects them beyond the product.
  • What the forensic triage flag has found. No aggregate results have been published.
  • How complete any of this is. The catalogue lists what has been confirmed exploited, which is a floor rather than a measurement.
  • Whether the rise in short deadlines reflects faster exploitation or a change in CISA's own policy, which would look identical from outside.