This year’s bug count just passed 100K
The number of disclosed software vulnerabilities in 2026 has surpassed 100,000, more than double last year's total.
The number of disclosed Common Vulnerabilities and Exposures (CVEs) in 2026 has exceeded 100,000, more than double the previous year's total. This surge is largely attributed to the use of Artificial Intelligence in vulnerability hunting by major CVE Numbering Authorities. While the percentage of exploited CVEs remains low, the shrinking window between patch release and exploit development, also accelerated by AI, poses a significant challenge.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe number of disclosed CVEs in 2026 has surpassed 100,000 — more than double the prior year — driven largely by AI-assisted vulnerability discovery by major CVE Numbering Authorities. While the raw exploit rate remains low, the danger lies in the shrinking window between patch release and weaponization, as adversaries also leverage AI to accelerate exploit development. Organizations that rely on manual triage and periodic patching cycles are increasingly exposed because they cannot keep pace with the sheer volume and velocity of new vulnerabilities. This surge fundamentally changes the risk calculus: even a small percentage of exploited CVEs across 100,000 disclosures represents a massive and growing attack surface. Effective vulnerability management must now be risk-driven, automated, and continuous rather than calendar-driven.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Vault Panda
- malware — Genesis Panda