2026H1 Threat Review Report

Threat actors associated with China, Russia, and Iran accounted for 32% of tracked threat actors with notable activity updates during the first half of 2026.

Forty-six percent of additions to CISA’s Known Exploited Vulnerabilities catalog were CVEs that were published prior to 2026.

Published vulnerabilities increased 51% year-over-year to 37,137 during the first half of 2026, with more than half rated high or critical severity.

Ransomware attack claims increased 25% to 4,544 incidents during the first half of 2026, averaging 25 attacks per day.

Active ransomware groups increased 16% to 103 worldwide during the first half of 2026.