The article says VulnCheck’s 2026 exploit intelligence report found that the volume of vulnerabilities is not the main problem—the real danger comes from the small number that are exploited quickly and operationalized before defenders can react. Out of more than 48,000 new CVEs disclosed in 2025, only about 1% were seen exploited in the wild, but those few drove a disproportionate share of real-world damage. VulnCheck also identified 50 routinely targeted vulnerabilities that carried elevated risk by the end of the year, while proof-of-concept exploit publication rose 16.5%. The report’s core point is that defenders are buried in vulnerability “noise,” while attackers stay focused on the narrow set of flaws that actually lead to access, ransomware, or large-scale compromise.

For ransomware specifically, the article says the trend is getting more aggressive: 56.4% of ransomware-linked CVEs disclosed in 2025 were first identified through active zero-day exploitation, up from 33% in 2024. VulnCheck tracked 39 newly disclosed CVEs tied to ransomware activity across at least 17 families, and said many of these involved technologies like hypervisors and file-transfer systems that can directly enable encryption or data theft. Industrial Cyber frames this as especially concerning for OT and industrial environments because ransomware groups are moving faster, often exploiting internet-facing systems before patch cycles catch up, while some attack chains remain private and unavailable to defenders for testing. The article’s practical takeaway is that organizations should prioritize exposure management around the small set of high-risk, actively exploited flaws—especially edge systems and high-impact platforms—rather than trying to treat every CVE as equally urgent.

‍

Source: https://industrialcyber.co/ransomware/vulncheck-finds-ransomware-operators-increasingly-relying-on-zero-days-raising-risk-in-ot-environments/