Evidence Over Severity: Reading the ENISA Threat Landscape 2026
The EU's cybersecurity agency analysed 8,257 incidents from 2025. Where it could trace how attackers got in, a known vulnerability led, and the network edge kept showing up. What the report means for how you order the fix list.
ENISA, the EU's cybersecurity agency, published its Threat Landscape 2026 in September. It covers 8,257 incidents recorded across the EU in calendar year 2025. DDoS and hacktivism dominate the incident count, and they will get the headlines. The finding that should change how security teams spend the next quarter sits further down: when ENISA could see how attackers got in, they mostly came through a known vulnerability, very often on a device at the edge of the network.
The way in is a known flaw
DDoS made up 51.3% of the incidents ENISA recorded, unauthorised access 39.5%. The second category is the one that ends in ransomware, data theft and espionage. Where ENISA could identify how an unauthorised access began, 60.4% leveraged a vulnerability, N-day and zero-day alike. Misconfiguration and accidental exposure came second at 20.7%.
The most capable attackers point the same way. Among State-nexus intrusions with an identified entry point, vulnerability exploitation accounted for 70%.
How unauthorised access began – EU, 2025
Share of incidents with an identified intrusion vector
"All other vectors" is the remainder after the two categories ENISA names in its text, and includes insider threats. Base: the unauthorised-access incidents in which ENISA could identify the intrusion vector.
Read the 60.4% with care
ENISA could identify an intrusion vector in only 5.2% of the unauthorised-access incidents it recorded, and in 20% of the State-nexus ones.
Most summaries will skip that line. The dataset is built mainly from open sources, and the report is candid that it is a snapshot, not a census. So 60.4% describes the incidents whose entry point became public, not every intrusion in Europe.
It still carries weight, for two reasons. First, a completely different dataset reached the same conclusion: the 2026 Verizon DBIR, built from investigated breaches, found vulnerability exploitation to be the most common way in, for the first time in its 19-year history. Second, the pattern held at the top end: 70% for State-nexus intrusion sets. Two sources, two methods, one direction.
Severity is a long list. Evidence is a short one.
More than 48,000 new CVEs were published in 2025, 22% more than the year before. By CVSS base score, 9% were Critical and 30% High. Sort by severity and 2025 alone hands you roughly 18,700 "urgent" vulnerabilities. Over the same period, CISA's Known Exploited Vulnerabilities catalogue added 245: vulnerabilities with evidence of real-world exploitation.
Two ways to build a fix list – 2025
Size of each list, same scale
A size comparison, not a funnel: the catalogue's additions include CVEs from earlier years, and plenty of exploited flaws never reach it. ~18,700 is our arithmetic (39% of 48,000+); every other figure is ENISA's.
CVSS measures how bad a vulnerability could be under model assumptions. It does not tell you whether anyone is using it. Filtering on "remotely exploitable" barely helps either: 71% of 2025's CVEs list Network as their attack vector. Evidence of exploitation is the filter that actually narrows the list. A team that works the severity list spends most of its capacity on flaws with no sign of being attacked, while the exploited ones wait their turn. And ENISA notes that attackers keep weaponising newly disclosed vulnerabilities faster, so the queue is not a safe place to wait.
The edge is where it starts
The report's case material keeps returning to one class of asset: VPN gateways, firewalls and remote-access appliances, the systems ENISA describes as sitting on the boundary between public networks and enterprise environments. Ransomware crews and State-nexus intrusion sets used them alike.
Edge flaws named in the report
Exploited by ransomware operators and State-nexus intrusion sets, per ENISA
| Product | CVE | Used by |
|---|---|---|
| Fortinet FortiGate | CVE-2024-55591 | Qilin, INC Ransom ransomware |
| SonicWall firewalls | CVE-2024-40766 | Akira ransomware |
| Cisco ASA / FTD | CVE-2023-20269 | Akira ransomware |
| Ivanti Connect Secure | CVE-2025-0282 | UNC5221 China-nexus |
| Cisco Secure Firewall ASA / FTD | CVE-2025-20333 CVE-2025-20362 | Storm-1849 China-nexus |
| Cisco IOS XE | CVE-2023-20198 | Salt Typhoon China-nexus |
| Cisco IOS / IOS XE | CVE-2018-0171 | DragonFly Russia-nexus |
A selection, not an exhaustive list. Salt Typhoon's use of CVE-2023-20198 was reported against Italian ISP infrastructure and TU Delft.
Three things stand out. Motive doesn't change the door. The same appliances appear in criminal and espionage campaigns, and ENISA's outlook expects that convergence to continue: different groups, same vulnerabilities, same pathways in. Age doesn't retire risk. Salt Typhoon's Cisco flaw dates from 2023, DragonFly's from 2018, and the report's State-nexus table reaches back to 2017. The flaw classes are the dangerous ones. The top weaknesses behind 2025's known-exploited additions were OS command injection, path traversal and deserialisation of untrusted data, which ENISA notes can lead to code execution and full control of the affected system.
What this means for exposure management
ENISA's conclusion is to fix the common weaknesses that every kind of attacker reuses. Three implications we take seriously at Cyvance:
- Order by evidence, then by exposure. Exploitation evidence decides whether a vulnerability is urgent. Whether the affected system is reachable and critical decides how urgent. CVSS stays in the picture as context, not as the sort key.
- Give the boundary its own list. Internet-facing appliances deserve a short, continuously refreshed view: what is exposed, what each device runs, and which of its flaws have been exploited. When ENISA, Verizon and CISA's catalogue all point at the same devices, that is the list to shorten first.
- Don't let old evidence age out. A flaw disclosed in 2018 was still being exploited in 2025. Known-exploited items still open in your backlog are not technical debt to pay down slowly. They are the attack surface this report documents.
This is how we built prioritisation. Every CVE gets a TRX tier from the exploitation evidence behind it: ATTACKED, FUNCTIONAL, POC or UNPROVEN. That tier sits next to where the vulnerable software actually runs and whether that system is exposed, so an attacked flaw on an internet-facing host rises to the top, and a critical score with no evidence behind it waits.
Agent-native Continuous Threat Exposure Management: ground truth from your own systems, prioritised by exploitation evidence, with remediation you can verify.
Source: ENISA Threat Landscape 2026 (September 2026), European Union Agency for Cybersecurity. Reporting period 1 January to 31 December 2025, 8,257 incidents. All figures are ENISA's except the derived ~18,700; analysis and visualisations are Cyvance's own. Read the full report at enisa.europa.eu.