On 22 September 2026, ENISA, the EU's cybersecurity agency, published its annual threat report, ETL 2026. It analyses 8,257 incidents recorded from 1 January to 31 December 2025, drawn mainly from open sources plus anonymised information from EU Member States and ENISA partners. For software suppliers, three findings stand out: exploited vulnerabilities remain the leading way in, attacks on suppliers and package ecosystems keep growing, and the number of new CVEs rose again.
What's affected
The report covers incidents affecting the EU rather than a single product, but several numbers bear directly on how software is built and shipped:
- Vulnerabilities as the way in. Of the unauthorised access incidents where ENISA could identify the intrusion vector, 60.4% involved exploiting a vulnerability, and 20.7% involved misconfiguration or accidental exposure. ENISA could identify a vector for only 5.2% of those incidents, so treat the split as indicative.
- Supply chain targeting. ENISA reports continued supply chain and third-party attacks, including compromised software, repositories and browser extensions. It calls out "the increase in compromises of popular libraries or npm packages, as seen with the Shai-Hulud campaign," and points to its March 2026 technical advisory on the secure use of package managers.
- CVE volume. More than 48,000 new vulnerabilities with CVE identifiers were published in 2025, a 22% increase on the previous year. By CVSS, 9% were Critical, 30% High, 49% Medium and 3% Low, with 9% unscored. 71% listed Network as the attack vector.
- Weakness types. The report's top 25 CWE table puts cross-site scripting (CWE-79) first, SQL injection (CWE-89) second and missing authorisation (CWE-862) fourth.
- NIS2 sectors. Essential and important entities under NIS2 account for 73% of the events ENISA recorded. Member States reported 1,954 events under NIS2 for 2025 and up to 14 July 2026.
The report also notes ENISA's growing role in vulnerability coordination. Besides being a CVE Numbering Authority and running the European Vulnerability Database (EUVD), ENISA became a CVE Root in November 2025, a point of contact within the CVE Program for national and EU authorities and EU CSIRTs.
Does this apply to you?
ETL 2026 is an analysis, not a regulation. It sets no obligations. It is relevant to you if:
- You sell software or services to EU entities in NIS2 sectors. Their supply chain duties under NIS2 are informed by exactly this kind of data, and their questionnaires will reflect it.
- You manufacture products with digital elements for the EU market. Under the Cyber Resilience Act, reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026.
- You consume packages from public registries such as npm, PyPI or Maven Central. ENISA's package manager advisory is written for you.
- You triage vulnerabilities in EU products. Expect more EUVD identifiers alongside CVE IDs in advisories you read.
What to do now
-
By 31 October 2026: read ENISA's package manager advisory and compare it with your build. Its integration recommendations include generating an SBOM, blocking builds with known vulnerable components, enforcing lockfile or hash verification, restricting installs to trusted registries, pinning versions and restricting install scripts where practical.
-
By 15 November 2026: make sure CI installs exactly what the lockfile says, and test whether your builds survive with install scripts disabled.
npm ci --ignore-scripts pip install --require-hashes -r requirements.txt -
By 30 November 2026: for internet-facing services, list every component with a published vulnerability whose attack vector is Network. ENISA says the 71% share of such CVEs underscores the risk of remote exploitation for internet-facing systems.
-
By 31 December 2026: prepare a short answer for NIS2 customers on how you detect a compromised dependency and how fast you notify them.
-
Ongoing: add EUVD as a source alongside CVE and vendor advisories if you ship into the EU.
Why it matters
The headline finding is not new, and that is the point. Exploited vulnerabilities and compromised suppliers were the main ways in during 2025, as they were before, while CVE volume grew by more than a fifth. Teams that try to patch everything by severity score will keep falling behind.
What helps is narrowing the queue to what matters in your product: vulnerabilities that are reachable from the network, in code your application actually calls, and dependencies that could be malicious rather than merely vulnerable. Safeguard's reachability analysis checks whether your code calls the vulnerable function, and the Gold directory at https://gold.safeguard.sh lists malicious packages alongside CVEs and their CISA KEV status.
Try it yourself
Run one project's package.json or requirements.txt through the free scanner at https://gold.safeguard.sh/scan. It runs in the browser, the file never leaves your machine, there is no login, and it takes up to 100 dependencies per scan. Then check whether any dependency has been flagged as malicious or typosquatted.
Click through it at your own pace, or open it full screen.
Quick check
What share of unauthorised access incidents with a known vector involved exploiting a vulnerability?
60.4%, according to ETL 2026. ENISA could identify the vector for 5.2% of unauthorised access incidents.
How many new CVEs were published in 2025, according to ENISA?
More than 48,000, a 22% increase on the previous year.
What new CVE Program role did ENISA take on in November 2025?
It became a CVE Root, acting as a central point of contact within the CVE Program for national and EU authorities, EU CSIRTs network members and cooperative partners under its mandate.
