Q1 2026 Threat Landscape: Vulnerability Surge and Exploit Evolution

Introduction

The first quarter of 2026 saw threat actors further broaden their exploit kits, integrating new attacks against Microsoft Office, Windows, and Linux systems. This article examines the published vulnerabilities and exploitation trends that defined Q1 2026, drawing on data from CVE.org and telemetry sources. We also highlight the vulnerabilities most frequently leveraged by popular command-and-control (C2) frameworks, offering insights into the evolving tactics of cyber adversaries.

Vulnerability Statistics

Overall CVE Trends

Since January 2022, the total number of registered Common Vulnerabilities and Exposures (CVEs) has climbed steadily. In Q1 2026, that upward trajectory persisted. Researchers attribute this growth in part to the increasing use of AI agents for automated vulnerability discovery, which is expected to continue accelerating the volume of reported issues.

Download the graph of total published vulnerabilities per month from 2022 through 2026

Critical Vulnerability Trends

When we filter for critical vulnerabilities (CVSS score > 8.9), a slight dip appeared compared to previous years. However, the overall trend remains upward. This anomaly can be traced to several factors:

• The tail end of 2025 featured disclosures of severe web framework flaws.
• High‑profile issues like React2Shell emerged in Q1 2026.
• Exploit frameworks for mobile platforms were released, exposing new attack surfaces.
• Remediation of known vulnerabilities often uncovers secondary issues, further boosting the count.

If this hypothesis holds, we expect Q2 2026 to show a notable decline—mirroring the pattern observed in the prior year. The next quarter’s data will provide a clearer test of this theory.

Download the graph of total critical vulnerabilities published per month from 2022 through 2026

Exploitation Activity

Windows and Linux Exploitation

During Q1 2026, threat actors updated their toolkits to include exploits for both newly disclosed and long-standing vulnerabilities. Despite the influx of fresh CVEs, a handful of veteran flaws consistently accounted for the lion’s share of detected exploitation attempts.

Veteran Vulnerabilities Still in Play

1. CVE-2018-0802 – Remote code execution (RCE) in Microsoft Office’s Equation Editor.
2. CVE-2017-11882 – Another Equation Editor RCE flaw, often paired with the above.
3. CVE-2017-0199 – A dangerous vulnerability in Office and WordPad that permits system takeover.
4. CVE-2023-38831 – Arising from improper handling of objects inside archive files.
5. CVE-2025-6218 – Allows relative path specification, leading to arbitrary file extraction and potential command execution.
6. CVE-2025-8088 – A directory traversal bypass during file extraction that leverages NTFS Alternate Data Streams.

Newcomer Exploits in Q1 2026

New exploits emerged targeting Microsoft Office components and Windows OS internals. These were quickly incorporated into commercial exploit kits and open-source attack tools, including those used by C2 frameworks. The precise CVEs are still under analysis, but early indicators point to:

• A previously unknown remote code execution vector in Office’s Graphics component (likely to be assigned CVE-2026-xxxx).
• A privilege escalation bug in the Windows Kernel Streaming Service that has been observed in targeted attacks.

These newcomers complement the veterans, giving attackers a diverse arsenal for breaching endpoints across platforms.

Notable Exploits in Detail

While the full list of active exploits is extensive, a few merit special attention due to their prevalence or novelty.

Equation Editor Legacy Flaws

The persistence of CVE-2017-11882 and CVE-2018-0802 underscores how legacy components remain a favorite entry point. Despite patches, many organizations have not fully updated their Office installations, leaving them vulnerable to these years-old RCE exploits.

React2Shell and Mobile Exploit Frameworks

The React2Shell vulnerability, disclosed in late 2025, saw active exploitation throughout Q1 2026. Simultaneously, the release of dedicated exploit frameworks for mobile platforms—such as Android and iOS—broadened the attack landscape, enabling adversaries to target smartphones and tablets with tailored payloads.

Looking Ahead

Q1 2026 confirms that both legacy and novel vulnerabilities drive the threat landscape. AI-assisted discovery will likely keep CVE counts high, while exploit kits evolve to incorporate the latest weaknesses. Defenders should prioritize patching the veteran flaws that remain widely exploited, while monitoring for emerging technical vectors like React2Shell and mobile framework exploits. The second quarter will be crucial in confirming whether the current spike in critical vulnerabilities is an anomaly or a new norm.