2026 CVE disclosures surpass 100,000 driven by AI vulnerability hunting accelerating exploit timelines
The number of CVEs reported in 2026 has exceeded 100,000, more than double the total in 2025, primarily driven by AI-assisted vulnerability searching. Despite this explosion in volume, the proportion of vulnerabilities exploited in the wild remains around 1.4%. However, the absolute number of exploited CVEs is rising, and attackers are leveraging AI to develop exploits shortly after patches are released, compressing the window between disclosure and exploitation to hours. High-profile examples include make-me-root bugs in Copeland refrigeration controllers exploited minutes after disclosure. This surge in AI-driven vulnerability discovery has overwhelmed open source maintainers with reports, prompting changes in bug reporting and patch prioritization strategies. CISA's updated directive recommends prioritizing patching based on actual exposure and exploitation risk rather than CVSS scores alone. The industry faces a "data problem" requiring new approaches to vulnerability management and disclosure to ensure security in this patchpocalypse.
Linha do tempo
-
2026 CVE disclosures surpass 100,000 driven by AI vulnerability hunting accelerating exploit timelines
ler a análise desta fonte ocultar
The number of CVEs reported in 2026 has exceeded 100,000, more than double the total in 2025, primarily driven by AI-assisted vulnerability searching. Despite this explosion in volume, the proportion of vulnerabilities exploited in the wild remains around 1.4%. However, the absolute number of exploited CVEs is rising, and attackers are leveraging AI to develop exploits shortly after patches are released, compressing the window between disclosure and exploitation to hours. High-profile examples include make-me-root bugs in Copeland refrigeration controllers exploited minutes after disclosure. This surge in AI-driven vulnerability discovery has overwhelmed open source maintainers with reports, prompting changes in bug reporting and patch prioritization strategies. CISA's updated directive recommends prioritizing patching based on actual exposure and exploitation risk rather than CVSS scores alone. The industry faces a "data problem" requiring new approaches to vulnerability management and disclosure to ensure security in this patchpocalypse.