Processunity Data Shows Over Half of the Average Organization's Third Parties Ran Technology Affected by Nine Newly Exploited Vulnerabilities in a Single Week
ProcessUnity today released new findings from its CVE Monitoring capability uncovering that, on average, 53% of an average company’s third parties potentially ran technology affected by at least one of last week's new KEVs.
Concord, MA, November 05, 2026 --(PR.com)-- ProcessUnity CVE Monitoring found potential exposure for every company analyzed, with the average organization's potential exposure (including PHP) spanning more than 400 vendors.
ProcessUnity, the Third-Party Risk Management (TPRM) company, today released new findings from its CVE Monitoring capability showing how far a single week of newly listed vulnerabilities reaches into the average organization's third-party ecosystem. Between Monday, October 26 and Friday, October 30, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added nine vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. ProcessUnity matched the affected products to technology used by third parties across its active Exchange customer portfolios and found that, on average, 53% of a company’s third parties potentially ran technology affected by at least one of the week's KEVs, excluding the two PHP vulnerabilities (also known as PHP2Shell). When including PHP, which runs on a large share of corporate websites, that figure rose to 76%.
"A KEV listing starts the clock for every organization at once, including every vendor you depend on," said Dan Tobin, VP of Analytics at ProcessUnity. "ProcessUnity customers utilizing our CVE Monitoring capabilities saw which of their third parties were potentially exposed to these vulnerabilities the same week CISA published them. That's the difference between reaching out to vendors before a remediation deadline and learning about exposure after it passes."
The nine vulnerabilities span PHP, the Linux kernel (known as Fragnesia), Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD), GitLab, Broadcom VMware ESX, Adobe Commerce and Magento, Ivanti Connect Secure, and the Google Brotli (also referred to as Node2Shell, HTTP2Shell, or Broccoli2Shell) compression library built into Node.js, .NET, and Envoy. Eight of the nine carry High or Critical severity ratings under the Common Vulnerability Scoring System (CVSS) 3.1, and six came with CISA remediation deadlines of three days.
Key findings from the week include:
- 53% of an average organization’s third parties potentially ran technology affected by at least one of the nine KEVs, excluding PHP (76% including PHP).
- The average organization had more than 400 third parties potentially exposed to at least one of the week's vulnerabilities.
- Every organization analyzed had at least one potentially exposed third party, and for each vulnerability with affected products listed, 95% or more of companies did.
- The Linux kernel flaw (CVE-2026-46300) reached 49% of the average company’s third parties, and the GitLab remote code execution flaw (CVE-2026-97229), rated a maximum 10.0 Critical, reached 27%.
For most organizations, patching their own environment is only half of the response to a new KEV. The other half sits with third parties, whose technology stacks are rarely visible to the teams responsible for managing their risk, and are typically reviewed on an annual assessment cycle. ProcessUnity CVE Monitoring closes that gap by connecting each newly published KEV to the specific vendors in a company’s vendor portfolio. A nightly refresh identifies new and updated entries in the KEV catalog, and the ProcessUnity Global Risk Exchange matches the products named in each vulnerability against the technologies each third party is known to use. Teams then narrow that list by the effectiveness of each vendor's related controls and receive a CVE Exposure Report with the prioritized vendors, recommended questions to ask, and next steps.
About the Analysis
Figures are aggregated and anonymized across active ProcessUnity Global Risk Exchange customer portfolios as of November 1, 2026. Each customer is weighted equally regardless of portfolio size. Technology exposure indicates that an affected product was detected at a third party and does not confirm that a vulnerable version is deployed. The analysis covers all KEVs added from Monday, October 26 through Friday, October 30, 2026.
To learn how ProcessUnity CVE Monitoring helps Third-Party Risk Management teams respond to newly exploited vulnerabilities, visit our website at processunity.com.
About ProcessUnity
ProcessUnity is The Third-Party Risk Management (TPRM) company. Our software platforms and data services protect customers from cybersecurity threats, breaches, and outages that originate from their ever-growing ecosystem of business partners. By combining the world's largest third-party risk data exchange, the leading TPRM workflow platform, and powerful artificial intelligence, ProcessUnity extends third-party risk, procurement, and cybersecurity teams so they can cover their entire vendor portfolio. With ProcessUnity, organizations of all sizes reduce assessment work while improving quality, securing intellectual property and customer data so business operations continue uninterrupted.
ProcessUnity, the Third-Party Risk Management (TPRM) company, today released new findings from its CVE Monitoring capability showing how far a single week of newly listed vulnerabilities reaches into the average organization's third-party ecosystem. Between Monday, October 26 and Friday, October 30, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added nine vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. ProcessUnity matched the affected products to technology used by third parties across its active Exchange customer portfolios and found that, on average, 53% of a company’s third parties potentially ran technology affected by at least one of the week's KEVs, excluding the two PHP vulnerabilities (also known as PHP2Shell). When including PHP, which runs on a large share of corporate websites, that figure rose to 76%.
"A KEV listing starts the clock for every organization at once, including every vendor you depend on," said Dan Tobin, VP of Analytics at ProcessUnity. "ProcessUnity customers utilizing our CVE Monitoring capabilities saw which of their third parties were potentially exposed to these vulnerabilities the same week CISA published them. That's the difference between reaching out to vendors before a remediation deadline and learning about exposure after it passes."
The nine vulnerabilities span PHP, the Linux kernel (known as Fragnesia), Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD), GitLab, Broadcom VMware ESX, Adobe Commerce and Magento, Ivanti Connect Secure, and the Google Brotli (also referred to as Node2Shell, HTTP2Shell, or Broccoli2Shell) compression library built into Node.js, .NET, and Envoy. Eight of the nine carry High or Critical severity ratings under the Common Vulnerability Scoring System (CVSS) 3.1, and six came with CISA remediation deadlines of three days.
Key findings from the week include:
- 53% of an average organization’s third parties potentially ran technology affected by at least one of the nine KEVs, excluding PHP (76% including PHP).
- The average organization had more than 400 third parties potentially exposed to at least one of the week's vulnerabilities.
- Every organization analyzed had at least one potentially exposed third party, and for each vulnerability with affected products listed, 95% or more of companies did.
- The Linux kernel flaw (CVE-2026-46300) reached 49% of the average company’s third parties, and the GitLab remote code execution flaw (CVE-2026-97229), rated a maximum 10.0 Critical, reached 27%.
For most organizations, patching their own environment is only half of the response to a new KEV. The other half sits with third parties, whose technology stacks are rarely visible to the teams responsible for managing their risk, and are typically reviewed on an annual assessment cycle. ProcessUnity CVE Monitoring closes that gap by connecting each newly published KEV to the specific vendors in a company’s vendor portfolio. A nightly refresh identifies new and updated entries in the KEV catalog, and the ProcessUnity Global Risk Exchange matches the products named in each vulnerability against the technologies each third party is known to use. Teams then narrow that list by the effectiveness of each vendor's related controls and receive a CVE Exposure Report with the prioritized vendors, recommended questions to ask, and next steps.
About the Analysis
Figures are aggregated and anonymized across active ProcessUnity Global Risk Exchange customer portfolios as of November 1, 2026. Each customer is weighted equally regardless of portfolio size. Technology exposure indicates that an affected product was detected at a third party and does not confirm that a vulnerable version is deployed. The analysis covers all KEVs added from Monday, October 26 through Friday, October 30, 2026.
To learn how ProcessUnity CVE Monitoring helps Third-Party Risk Management teams respond to newly exploited vulnerabilities, visit our website at processunity.com.
About ProcessUnity
ProcessUnity is The Third-Party Risk Management (TPRM) company. Our software platforms and data services protect customers from cybersecurity threats, breaches, and outages that originate from their ever-growing ecosystem of business partners. By combining the world's largest third-party risk data exchange, the leading TPRM workflow platform, and powerful artificial intelligence, ProcessUnity extends third-party risk, procurement, and cybersecurity teams so they can cover their entire vendor portfolio. With ProcessUnity, organizations of all sizes reduce assessment work while improving quality, securing intellectual property and customer data so business operations continue uninterrupted.
Contact
ProcessUnity
Kaitlyn Frank
(978) 451-7655
https://www.processunity.com/
Kaitlyn Frank
(978) 451-7655
https://www.processunity.com/
Contact
Categories