CVE volume
| Figure | Scope | Source |
|---|---|---|
| 86,292 CVEs | Published 1 Jan to 23 Oct 2026, 2.2x the 38,569 in the same window of 2025 | CyberHire analysis of the CVE List V5 |
| 36,953 CVEs | Q3 2026 alone, more than any full year before 2024 | CyberHire |
| 14,934 CVEs | September 2026, 3.5x September 2025 | CyberHire |
| 48,185 CVEs | All of 2025, up 20.6% from 39,962 in 2024 | Jerry Gamblin |
| ~59,427 CVEs | FIRST’s median forecast for 2026, made in February 2026 and already exceeded | Infosecurity Magazine |
Different counters give slightly different totals for the same year because they treat rejected and reserved CVEs differently. We quote one counter per period and name it.
AI-discovered vulnerabilities
| Figure | Scope | Source |
|---|---|---|
| 769 CVEs | Credited to an AI system or lab, 1 Jan to 23 Oct 2026, against 34 in the same period of 2025. A floor, since many AI-assisted finds are not labelled | CyberHire |
| 6,157 disclosed, 516 patched | Glasswing vulnerabilities disclosed to open-source maintainers across 591 projects, and how many were fixed, as of 2 Oct 2026 | Software Improvement Group |
| under $50 | Anthropic’s stated compute cost per vulnerability found | Software Improvement Group |
| 54 of 63 | Planted vulnerabilities found by AI systems at the DARPA AI Cyber Challenge final, 8 Aug 2025, plus 18 real zero-days | DARPA |
Exploitation
| Figure | Scope | Source |
|---|---|---|
| 0.23% | Share of 2026 CVEs (Jan to Aug) observed exploited in the wild, about 1 in 431 | Google Threat Intelligence |
| 141 vs 127 | Vulnerabilities disclosed and exploited, Jan to Aug 2026 vs all of 2025 | Google Threat Intelligence |
| 23.4% | Share of known-exploited CVEs hit on or before their publication day, first half of 2026 (about 29% in 2025) | VulnCheck |
| about -7 days | Mandiant’s estimated mean time-to-exploit in 2025, relative to patch availability | M-Trends 2026 announcement |
| 32% | Share of intrusions where an exploit was the initial infection vector, 2025, the top vector for the sixth year | M-Trends 2026 announcement |
The exploited share of CVEs is falling while the exploited count rises slowly. Both are true, and that is the core of the volume-versus-exposure argument.
Remediation
| Figure | Scope | Source |
|---|---|---|
| 43 days | Median time to remediate known-exploited vulnerabilities (up from 32), Verizon DBIR 2026 | watchTowr summary of DBIR 2026 |
| 26% | Share of those vulnerabilities fully remediated (down from 38%), Verizon DBIR 2026 | watchTowr summary of DBIR 2026 |
| 82% | Organisations carrying security debt (flaws open more than a year); 60% carry critical debt | Veracode State of Software Security 2026 |
| 358 days | Fix half-life for open-source (SCA) flaws | Veracode State of Software Security 2026 |
Supply chain
| Figure | Scope | Source |
|---|---|---|
| 25,000+ developers | Secrets exposed in three days by the Shai-Hulud 2.0 npm worm, 21 to 23 Nov 2025 (Wiz figure) | The Register |
| 2,225 package versions | Hit by the “Mini Shai-Hulud” npm wave, August 2026 | Sonatype |
| 1.7 billion credentials | Harvested by infostealers, Jan to Jun 2026, from 7.4M infected devices | Infosecurity Magazine on Flashpoint |
Numbers we don’t quote, and why
These circulate widely. Each is either wrong or loses its meaning once stripped of context.
| Claim you will see | What is actually true |
|---|---|
| “AI found 10,000 zero-days in a month” | Glasswing’s first month logged 23,019 issues. Candidate findings, validated bugs, published CVEs and exploited bugs differ by orders of magnitude; VulnCheck found one Glasswing bug confirmed exploited at its snapshot. |
| “NVD has stopped working” | The NVD still ingests every CVE. Since 15 April 2026 it stopped enriching most of them with NIST scores and product data. |
| “The CVE programme shut down in April 2025” | MITRE’s contract nearly lapsed; CISA extended it by 11 months. |
| “Every bug is exploited a week before the patch” | Mandiant’s -7 days is a mean, pulled down by zero-days. Most CVEs are never exploited at all. |
| “Exploitation is exploding as fast as CVEs” | Exploited counts are rising slowly. The exploited share of CVEs is falling. |
| “An AI is the number one hacker on HackerOne” | XBOW topped the US reputation leaderboard for one quarter (April to June 2025), largely through vulnerability disclosure programmes. |
| “22% of breaches started at edge devices, up from 3%” | That is DBIR 2025, not 2026, and a share of vulnerability-exploitation breaches, not of all breaches. |
| “16 billion new passwords leaked” | Mostly recompiled old data, not new breaches. |
How we use these numbers
We publish a figure only when we can name its source, its date and what it measures. Secondary summaries are labelled as such. If you spot an error, email the address in the footer and we will correct it and note the change. See our editorial policy.