More flaws, found faster
CVE volume in 2026 is running at more than double 2025’s pace. AI is surfacing decades of latent bugs across the stack, from browsers and kernels to libraries and runtimes, and most of them are real.
2.2×
86,531 CVEs were published from January 1 to October 25, 2026, against 38,709 in the same period of 2025 and 48,151 in all of 2025. Monthly publications rose from 4,302 in January to 14,934 in September.
Defendermate analysis of NVD and cvelistV5 data, rejected CVEs excluded, Oct 2026
~66,000
FIRST's mid-year forecast for all of 2026, raised from 59,427 after actuals ran 46% above its model. 2026 passed it in the third quarter.
10,000+
High- and critical-severity vulnerabilities found by Project Glasswing partners in its first month. 90.6% of the open-source findings people checked were real, but only 75 of 530 disclosed high and critical bugs had been patched.
271
Bugs found by one AI model and fixed in a single Firefox release (Firefox 150 in April), against 22 found by an earlier model for Firefox 148. Mozilla notes none were beyond an elite human researcher: what changed is scale and cost.
5–10 a day
Linux kernel security reports, up from two or three a week two years earlier. The kernel team says most are valid and added maintainers to keep up. Across the ecosystem, the surge is vendor-confirmed: GitHub's CNA went from 2,203 CVEs to 12,056 in the same ten months, Microsoft from 1,106 to 4,417 and Chrome from 110 to 3,593.
Willy Tarreau via LWN, March 2026; Defendermate analysis of cvelistV5, Jan 1 to Oct 25, 2025 vs 2026
The pre-CVE window
The time between a flaw becoming knowable (a public fix, an advisory, an AI finding, an attack) and its CVE being published. Scanners and scores keyed to CVEs can't see anything in it.
39 days
Median gap between a public open-source code fix and its CVE in August 2026, up from 5.1 days in January, across 18,594 CVEs. The fastest tenth of public exploits appeared 1.8 days after the fix. Second Security, which measured it, calls this gap The Patchless Window.
Second Security, The Patchless Window, 2026 (vendor data)
219 of 6,157
Vulnerabilities that Claude models disclosed to 591 open-source projects had a CVE record by October 2, 2026. 365 had a GitHub advisory, and 516 were known to be patched.
29%
Of the 884 vulnerabilities first exploited in 2025 were exploited on or before the day their CVE was published, up from 23.6% in 2024.
~10 days
Average lead time between a silently fixed open-source flaw and its first public advisory, across more than 320 confirmed detections, and up to 154 days for axios. 36% got a GitHub advisory but never a CVE.
VulNow, Q2 2026 (vendor data)
67%
Of 511 open-source vulnerabilities one AI feed found in 2024 were never disclosed to any vulnerability database. Where a CVE did come, it came on average 27 days after the patch.
Not scheduled
Since April 2026, NIST enriches only known-exploited, federal-use and critical software CVEs. The backlog published before March 2026 will not be analyzed, so many CVEs never get the product data scanners match on.
Google says large cloud and software providers often fix AI-surfaced flaws without requesting a CVE, so public data significantly undercounts AI-discovered vulnerabilities (GTIG, September 2026).
FortiWeb, 2025 · CVE-2025-64446
- Oct 6Exploitation seen in the wild
- Oct 28Fixed quietly in FortiWeb 8.0.2
- Nov 14Advisory and CVE published
39 days of exploitation with no CVE for a scanner to match.
Zero-days: both windows at once
A zero-day is a flaw exploited before a patch exists. It usually starts before the vendor knows and before any CVE, then runs on until the fix ships, so it covers both windows. The count has held steady; what changed is where zero-days land, who uses them, and that AI now works on both sides.
90
Zero-days exploited in 2025, after 106 in 2021, 63 in 2022, 100 in 2023 and 78 in 2024. Google revises past years as it learns more; the range has held between 60 and 100.
48%
Of 2025's zero-days targeted enterprise technology, up from 37% in 2023 and 44% in 2024. Half of those hit security and networking products, and state espionage groups put just over half of theirs into edge devices and security appliances.
11 a month
Zero-days exploited from January to August 2026, up from 8 a month in 2025, with 22 new ones in August alone. They were 62% of the 141 vulnerabilities Google saw exploited in that period, already more than in all of 2025 (127).
First time
In 2025, commercial spyware vendors were tied to more zero-day exploitation than traditional state espionage groups. Financially motivated groups used 9, up from 5.
50%
Of vulnerabilities found by AI in 2026 allow remote code execution, against 26% of those found otherwise. Google attributes it to AI agents chaining obscure edge-case logic across complex code paths.
Found first
Google's Big Sleep agent found SQLite flaw CVE-2025-6965, which Google says was "known only to threat actors and was at risk of being exploited." Google says it cut the attack off beforehand, the first time it knows of an AI agent foiling exploitation in the wild.
The no-patch window
The time a flaw is public or exploited but there is nothing you can install: the vendor hasn't shipped a fix, the fix hasn't reached the build you run, or the product is end of life. Only mitigation can act in it.
−7 days
Mandiant's estimated mean time to exploit in 2025: exploitation now routinely starts before a patch is released. It was 63 days in 2018 and 2019, 32 days in 2021 and 2022, and 5 days in 2023.
18 months
The deadline CISA gave federal agencies to remove every end-of-support edge device, because those devices will never be patched again.
Oracle E-Business Suite, 2025 · CVE-2025-61882
- Aug 9Exploited as a zero-day
- Sep 29Extortion emails reach executives
- Oct 4Emergency patch released
56 days of exploitation with no patch to apply.
PHP2Shell, 2026 · CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
- Oct 17Exploitation attempt seen by AWS honeypots
- Oct 21Disclosed and patched upstream
- Oct 23Related CVE announced with a mitigation, fix in the next release
Attackers moved four days before disclosure, and the follow-up flaw shipped with a setting to change, not a patch.
The patch-deploy window
Once a patch is public, it is also a map to the flaw. AI reads it faster than most teams can test and roll it out.
1 hour
For Claude Mythos Preview to build a working Firefox exploit from a public fix, about 18 days before the fixed release shipped. On Windows, it built eight full privilege-escalation chains from patches for about $2,000 each.
$2.77
Average cost for a multi-agent research system to reproduce a working exploit from the CVE entry alone. It succeeded for 51% of 841 recent CVEs.
43 days
Median time to patch known-exploited vulnerabilities, up from 32. Only 26% were fully remediated.
3 days
The tightest federal remediation deadline under CISA's new risk-based directive, with a forensic check for compromise, for exposed known-exploited flaws that can be exploited automatically.
4 days
From disclosure to exploitation of BeyondTrust CVE-2026-1731, an AI-discovered flaw. Six separate threat clusters were exploiting it within a week.
27 sec
Fastest observed eCrime breakout from initial access to lateral movement. The average was 29 minutes, down from 48.
Chained flaws
Attackers don't need one critical CVE. In the biggest enterprise chains of 2025, one link was rated Medium, the kind a "patch everything rated 7 or higher" policy parks.
Cisco ASA and FTDSept 2025 · zero-days
SharePoint “ToolShell”July 2025
Ivanti EPMMMay 2025
Oracle E-Business SuiteAug–Oct 2025
Scores are the CNA's CVSS base scores from the CVE records. Sources: Cisco; CISA; CVE-2025-4427, CVE-2025-4428; GTIG and Mandiant
13 of 14
Windows bugs Microsoft rated "exploitation less likely" or "unlikely" that Claude Mythos Preview still turned into working proofs of concept, on the way to eight full privilege-escalation chains.
2 to 4
Vulnerabilities chained by Mythos Preview into Linux root in nearly a dozen cases, and four chained into a browser exploit that escaped both sandboxes. One chain turned a one-byte read into root in under a day, for under $2,000.
12.6%
Of scored entries in CISA's known-exploited catalog are rated below 7.0. A severity cutoff skips flaws attackers already use.
Defendermate analysis of the CISA KEV catalog and CVE records, Oct 2026
$5–7M vs $250K
Top list price for a zero-click iPhone exploit chain, against a single SharePoint, Exchange or SAP code-execution bug. The market prices the chain, not the bug.
CVSS is "designed to classify and rate individual vulnerabilities" (FIRST), so a chain only gets a score if someone works it out. Google notes that multi-zero-day chains are mostly a mobile phenomenon, and that enterprise products often fall to a single flaw (GTIG 2024 review). Either way, the question is the same: which combination of flaws reaches something that matters in your environment.
Beyond CVEs
The same speed-up is hitting every kind of exposure, not just software flaws.
Credentials
- 39%of breaches involve credential abuse somewhere, even though exploitation has overtaken it as the first step (13%).Verizon DBIR 2026
- 73%of ransomware victims had an infostealer infection or credential leak in the year before; for half of them, within 95 days.Verizon DBIR 2026
- 1.7 billioncredentials stolen by infostealers from 7.4 million devices in the first half of 2026.Flashpoint, August 2026
Cloud
- Under 10 minfrom credentials left in a public S3 bucket to full AWS admin, in an intrusion with strong signs of being run by an AI model.Sysdig, February 2026
- ~3 hoursfrom one stolen developer token to full cloud admin, in an operation where AI agents did nearly all of the work.Anthropic threat report, September 2026
- 30 secfor one attacker to compromise 96% of 80 exposed Postgres honeypots, in a 2021 study that still sets the baseline.Unit 42, 2021
Software supply chain
- 454,600+new malicious open-source packages in 2025, up 75%, and 149,329 more in the third quarter of 2026 alone.Sonatype 2026; Sonatype Q3 2026
- 2 billionweekly downloads across 18 npm packages, including chalk and debug, hijacked through one phished maintainer.Aikido, September 2025
- 25,000+GitHub repositories hit by the second wave of the self-spreading Shai-Hulud worm, weeks after the s1ngularity attack turned developers' own AI coding tools into secret stealers.Wiz, November 2025; Wiz, August 2025
People
- 4.5×the click-through rate for AI-automated phishing: 54% against 12% for standard phishing.Microsoft Digital Defense Report 2025
- +502%malicious voice phishing over Microsoft Teams in a year.Microsoft Digital Defense Report 2026
- $3.05 billionin reported business email compromise losses in 2025, and $893 million in the FBI's first count of AI-linked complaints.FBI IC3 2025 report
AI runs the attack
AI used to speed up one step of an attack. In the last year it started running most of them.
- September 2025Anthropic disrupted GTG-1002, a state-sponsored espionage campaign against about 30 organizations in which AI carried out an estimated 80 to 90% of the operation, with people stepping in at four to six decisions.Anthropic, November 2025
- December 2025 to February 2026A single operator used AI coding agents against at least nine Mexican government organizations: 1,088 prompts, 5,317 AI-executed commands and exploits for 20 known CVEs. The agencies dispute the breach.Gambit Security
- February 2026An LLM penetration-testing agent took four of five hosts in a lab Active Directory environment for about $28.50 in model fees.arXiv 2602.17622
- April 2026Claude Mythos Preview wrote a working Linux kernel exploit in about half a day for under $1,000, and became the first model to complete the UK AI Security Institute's 32-step corporate network range end to end.Anthropic; UK AISI
- May 2026Google found the first zero-day exploit it believes was developed with AI, before a planned mass-exploitation campaign, and saw a North Korean group sending thousands of prompts to analyze CVEs and validate exploits.Google Threat Intelligence Group
- September 2026Anthropic reported operations where AI agents did nearly all the work, including "agent swarms" against about 50 organizations that produced more than a dozen possible zero-days in a month.Anthropic threat report
CrowdStrike counted an 89% rise in operations by AI-enabled adversaries in 2025 (2026 Global Threat Report). The CISO briefing "The AI Vulnerability Storm" from CSA, SANS, [un]prompted and OWASP, reviewed by more than 250 CISOs, recommends a standing "VulnOps" function to keep up.
Old signals stop separating
More CVEs and cheaper exploits don't mean more risk in your environment. They mean the usual filters let more noise through.
~4%
Of the CVEs you fix by patching everything rated CVSS 7 or higher were ever exploited. That policy spends 57% of the effort to cover 82% of exploited CVEs.
1.4%
Of new CVEs in the first half of 2026 were added to the known-exploited list. CVE volume rose 45%; known-exploited additions rose 10%. AI-discovered vulnerabilities are exploited at about the same low rate as the rest.
1,758
Entries in CISA's Known Exploited Vulnerabilities catalog, out of more than 300,000 CVEs. 274 were added in 2026 so far, already more than in all of 2025 (245).
0.6%
Of the 45,242 CVEs that link to exploit code are on the known-exploited list. An exploit existing somewhere says little about whether it works on your systems.
Defendermate analysis of cvelistV5 and the CISA KEV catalog, Oct 2026
FIRST reports that actionable risk (known-exploited, or an EPSS score above 10%) stayed flat in 2026 while volume climbed (June 2026). The question that matters is whether a flaw is exploitable on your resources, and no global score answers it.
What this means
Verify, don't score
Check whether the conditions for exploitation hold on your resources, and which combinations of flaws form a path to something that matters, before anyone spends time on a finding.
How Analyze works →Act inside the window
When there's no CVE or no patch yet, mitigation is the only move: close the exposure or contain the blast radius now, and patch when it's safe.
How Plan works →Look past the CVE ID
Track fixes, advisories and components, not only CVE records. One component upgrade often closes dozens of CVEs at once.
The CTEM guide →Run the program on facts
Rebuild each CTEM stage around continuous, verified intelligence rather than analysts racing a growing queue.
How to modernize each stage →Figures are the latest published by each source as of October 26, 2026; we update this page as new data comes out. Counts labeled "Defendermate analysis" are from public NVD, cvelistV5 and CISA data on that date.