The Cyber Threat Pressure gauge reads 55.2 for October 2026, in the Elevated zone, down from 67.0 in September, when it sat in High. The drop hides a busier picture than the headline suggests. CISA added 36 flaws to its catalog of vulnerabilities already being exploited in the wild, after 43 in September, and the last three months together are the fastest run of additions since mid-2022. What pulled the score down was the count of newly published critical CVEs, which has been unusually low since the spring.
Scoreboard
| Reading | Month | Score | Zone | Change to now |
|---|---|---|---|---|
| Now | October 2026 | 55.2 | Elevated | |
| Month ago | September 2026 | 67.0 | High | -11.8 |
| Year ago | October 2025 | 55.3 | Elevated | -0.1 |
Three inputs, one outlier
The score is the plain average of three inputs, each scaled so that 50 means normal. Two of the three point to more pressure than usual.
| Input | What it measures | October | Normal month | Score | Zone |
|---|---|---|---|---|---|
| Exploited flaws | Additions to CISA’s known exploited vulnerabilities catalog | 36 | 25.7 | 70.1 | High |
| Critical CVEs | New CVEs published with a critical CVSS v3 rating | 112 | 235.1 | 23.8 | Low |
| Cyber stocks | Cybersecurity ETF (CIBR) 3-month return against the S&P 500 | +8.6 pts | 0 pts | 71.5 | High |
The exploited-flaw count is the input that matters most for defenders, because every entry is a bug someone is already using. October’s 36 additions ran about 40% above the trailing twelve-month average of 25.7 a month. September’s 43 was the most in any month since June 2022, and August through October added 110, against 62 in the same three months a year earlier. The 2026 total so far is 282, already more than the 245 added in all of 2025.
The critical CVE count tells a different story. October brought 112 new critical CVEs against a normal month of 235.1, and every month from May on has come in well under that average. Part of this is likely a scoring lag, since recent CVEs often get their severity rating weeks after publication, so this input tends to rise when it is rechecked. Even so, it shows the flood of new critical bugs seen in late 2025 and early 2026 has not continued.
Cyber stocks have beaten the broad market by 8.6 points over three months, after a much bigger lead in early summer. The cybersecurity ETF ended October at $101.03, up from $62.62 at the end of March.
What moved the gauge
The biggest change this year is how fast federal agencies must act. CISA’s Binding Operational Directive 26-04, issued in June, replaced the old patch deadlines with a risk-based model, and the most dangerous catalog entries now carry a three-day deadline. The effect shows up in the catalog itself. In 2025 the median deadline was 21 days and only 19 of 245 additions had a week or less. Since July, 78 of 100 additions in the third quarter and 29 of 36 in October came with a deadline of a week or less, and the median is three days.
October’s list leaned hard on the devices that sit at the network edge. Ivanti Connect Secure appeared three times, Cisco firewalls and email gateways twice, and Fortinet, Palo Alto Networks, Citrix NetScaler and BeyondTrust remote access once or more. CISA added two PHP flaws on October 26, three days after cyber stocks jumped when CrowdStrike’s chief executive warned of a wave of breaches tied to PHP. The ESX logging flaw and the Linux kernel root bug added on October 28 are covered in our post on those two KEV additions.
The catalog also kept reaching back in time. On October 8 CISA added five old flaws in one batch, including bugs in ISC BIND and ProFTPD from 2015 and Apache Struts from 2016, a reminder that attackers still find unpatched systems running decade-old code. For the second month running, none of the new additions were marked as known to be used in ransomware campaigns, a flag CISA often sets later.
Notable October additions
| Date added | Vendor | Product | Flaw |
|---|---|---|---|
| Oct 30 | Ivanti | Connect Secure | Missing authentication for a critical function |
| Oct 29 | Cisco | Secure Firewall ASA and FTD | Unchecked return value leading to a null pointer dereference |
| Oct 28 | Linux | Kernel | Missing variable initialization, local root |
| Oct 28 | Broadcom | VMware ESX | Insufficient logging |
| Oct 27 | Adobe | Commerce and Magento | Unrestricted upload of a dangerous file type |
| Oct 26 | PHP Group | PHP | Memory corruption, plus a second request-state flaw |
| Oct 23 | Arista | VeloCloud Orchestrator | SQL injection |
| Oct 20 | Plex | Media Server | Four flaws including two server-side request forgeries |
| Oct 16 | BeyondTrust | Remote Support | Authentication bypass by spoofing |
| Oct 14 | Palo Alto Networks | PAN-OS | Code injection |
| Oct 13 | Ivanti | Connect Secure | Authentication bypass by spoofing |
| Oct 4 | Citrix | NetScaler | Memory buffer overflow |
History
Over the 22 months the gauge can be computed, it has averaged 54.4. It spent 10 months in Elevated, 7 in High and 5 in Guarded, and has never reached Severe or Low. The peak was 79.1 in May 2025, when critical CVE publications more than doubled their normal pace. The low was 32.4 in November 2025, a quiet month for both catalog additions and cyber stocks.
What to watch
- The catalog pace. Another month above 30 additions would keep this input in High on its own. A fall back toward 20 would say the late-summer surge was a cleanup of old entries under the new directive.
- Edge devices. Ivanti, Cisco, Fortinet and Palo Alto Networks products keep returning to the list. New entries for any of them usually mean fast, broad scanning by attackers.
- The critical CVE count once it settles. If October’s figure rises sharply on a recheck, the low reading on this input was mostly lag, and the gauge would move up.
- Earnings. CrowdStrike, Palo Alto Networks and Zscaler report in November and December. Strong guidance would keep the stock input high.
Bottom line
Cyber threat pressure is Elevated and leaning higher than the headline number shows. The flow of flaws being exploited in the wild is the strongest since 2022, the federal deadline for fixing the worst of them is now three days, and the list is heavy with VPNs, firewalls and remote-access tools that sit directly on the internet. The one soft input, new critical CVEs, may be understated by scoring lag. For security leaders the practical point is that patch speed on internet-facing devices now matters more than patch volume, and a three-day standard is a fair benchmark even outside government. For budget holders and investors, the market has already priced a good part of this into cyber stocks, so the next move depends on whether the exploitation pace holds into the new year.
Method. The Cyber Threat Pressure gauge averages three equal-weight inputs, each scaled from 0 to 100, for each calendar month. Exploited flaws and critical CVEs are scored as 50 times the month’s count divided by its trailing twelve-month average, capped at 100. Cyber stocks are scored as 50 plus 2.5 times the 3-month return gap between the CIBR cybersecurity ETF and the SPY S&P 500 ETF, capped between 0 and 100. Zones: 0 to 24 Low, 25 to 44 Guarded, 45 to 59 Elevated, 60 to 79 High, 80 to 100 Severe. Readings here cover October 2026, with catalog data through October 30. This is a threat and market indicator, not investment advice.