"It's kind of wild," Josh Bressers, VulnCheck’s director of coordinated vulnerability disclosure, told The Register.
100,222 CVEs and the AI-driven surge
VulnCheck counted 100,222 Common Vulnerabilities and Exposures (CVEs) disclosed so far in 2026, a number that passed the 100,000 mark in early November and more than doubled 2025's total, the company told The Register. Bressers attributes the surge largely to artificial intelligence: "There's no denying the fact that vulnerability hunting with AI is driving a majority of what we're seeing." He warned that 100,000 may soon feel modest: "The thing that almost scares the bejesus out of me is while 100K sounds like a lot, in a couple years we're going to say, remember when it was only 100K?"
Microsoft and the CNAs adding to the tally
All major CVE Numbering Authorities (CNAs) — including VulnCheck, Microsoft, Oracle, GitHub, and other large enterprise IT vendors — have substantially increased disclosures. Microsoft alone added 1,094 security flaws to the count on a single Tuesday, after publishing 1,474 vulnerabilities the month before, per VulnCheck's tally. Bressers said the large CNAs "are just screaming into the atmosphere right now" and again pointed to AI as the main driver.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogFrom CVE to KEV: exploitation windows are shrinking
Despite the enormous increase in CVEs, the share of flaws observed exploited in the wild remains relatively small but consequential. About 1.4 percent — 1,363 CVEs published this year — have been added to VulnCheck’s Known Exploited Vulnerabilities (KEV) catalog.
But as Bressers emphasized, one percent of 100,000 is a far larger absolute number than one percent of 1,000. Multiple firms report attackers are converting disclosures into attacks faster than before. From January to June, the security firm CrowdStrike said 88 percent of exploitation it observed using public proof-of-concept (PoC) code occurred within 48 hours of the code's release. CrowdStrike also reported that China-linked groups such as Vault Panda and Genesis Panda sometimes launched attacks within 24 hours of disclosure.
VulnCheck found the median time from CVE publication to exploitation fell from 120 days in 2025 to 80 days during the first half of 2026, and Bressers says the window closed further in the latter half of the year. He described incidents where newly published Copeland refrigeration-controller vulnerabilities produced attack traffic "literally minutes later," and noted two of those disclosed issues were under active exploitation. Those controllers were previously abused, according to the source, by Iranian hackers to spoil food and spark fires in supermarkets across Europe.
CISA's directive and the shift away from CVSS-only patching
In June, the US Cybersecurity and Infrastructure Security Agency (CISA) issued a cybersecurity directive that replaces flat-deadline vulnerability management policies. The directive moves organizations away from prioritizing patches based solely on CVSS severity scores and toward a risk-based approach that weights whether an asset is internet-exposed, under active exploitation, and whether an attacker can automate the exploit.
Bressers framed that change as practical: "It's telling people to figure out the vulnerabilities that actually affect you, and then put those at the top of the list, instead of just saying we're going to fix all the criticals." He added that broader thinking — heat maps for infrastructure and targeted prioritization — is necessary because "we don't have a security problem anymore... we have a data problem now." He pointed to the CISA Binding Operational Directive (BOD) as helpful in focusing effort.
How open source maintainers, enterprises, and security teams are responding
- Open source maintainers: Maintainership is straining under AI-driven report volume. Daniel Stenberg, curl's maintainer, changed bug-handling rules on October 26 so low- and medium-severity reports go straight into the public GitHub repository while only high- and critical-flaws get private handling. Stenberg also ended curl's bug bounty program earlier this year because of an "avalanche of vulnerability reports."
- Registry operators and enterprise customers: The Eclipse Foundation launched a managed tier for Open VSX in April that guarantees a 99.95 percent uptime SLA backed by service credits. Customers listed include AWS, IBM, Google, Cursor, and Windsurf; the paid option is framed as a way for commercial users to fund ongoing maintenance and platform security.
- Security teams and procurement leaders: Bressers urged a move away from obsessing over every vulnerability and toward mapping which flaws "actually affect you." The new CISA BOD and risk-focused patching criteria are offered as practical tools in prioritization.
The record-breaking CVE count in 2026, and the compressed interval between disclosure and exploitation, together force a recalibration: more automation in discovery has not made defenders' jobs simpler, it has multiplied the raw volume of threats and shifted the problem toward triage, prioritization, and resourcing. As Bressers put it, the method of handling vulnerability reports and registries "has to change, and it's going to have to change fairly soon." The concrete next steps — whether broader adoption of CISA-style prioritization, paid managed services for critical registries, or different disclosure rules for open source projects — remain to be seen, but the urgency the numbers convey is unmistakable.
