.jpg)
In January 2026, about 5,000 new vulnerabilities were disclosed. By August, the monthly figure had passed 10,700. Those numbers come from Google Threat Intelligence Group, which tracked 20 months of disclosure data and found the monthly CVE count doubled inside a single year.
FIRST, which publishes the industry’s annual vulnerability forecast, had to revise its 2026 projection halfway through the year. It now expects around 66,000 CVEs. The previous record, set in 2025, was roughly 48,000.
If you work in vulnerability management, none of this is news to your ticket queue. Here is what is driving the CVE surge, how much of it actually matters, and what your team can do about it.
Why CVE numbers jumped in 2026
AI vulnerability discovery is the biggest new factor. Models such as Anthropic’s Mythos and OpenAI’s GPT-5.4-Cyber can read code and find flaws much faster than human researchers. Vendors are pointing them at their own products. Palo Alto Networks said AI models helped it find 75 vulnerabilities in its products, more than seven times its usual monthly count. Microsoft’s June Patch Tuesday fixed 206 CVEs, its largest release on record.
AI-written code adds to the pile. Developers are shipping more AI-generated code, and bugs ship with it. One analysis found AI-authored pull requests contained 2.74 times as many security issues as human-written ones.
Some of the growth is bookkeeping. GitHub’s advisory volume rose 449% after a backfill campaign. The Linux kernel, which assigns its own CVEs, produced about 5,000 of them between January and August, with no zero-day exploitation observed. Part of the jump simply reflects more thorough counting.
More CVEs does not mean twice the risk
Headlines tend to skip this part. FIRST reports that the share of vulnerabilities needing urgent patches has stayed roughly flat. VulnCheck’s review of AI-assisted discoveries found about one actively exploited vulnerability for every 431 disclosed.
Your systems are not suddenly twice as exposed. What has doubled is the pile your team has to sort through, and the sorting just got harder.
The NVD backlog moved triage onto your team
For years, security teams relied on the National Vulnerability Database to add severity scores and affected-product data to each CVE. In April 2026, NIST said the NVD would stop enriching every record and focus on known exploited vulnerabilities and software used by the U.S. federal government. Everything else waits.
A scanner can tell you that 400 new CVEs touch your environment this month. It cannot tell you which three an attacker will use first. Making that call takes analysts who understand how exploitation works, can read an advisory critically, and can patch under time pressure without breaking production.
How security teams can keep up
-
Prioritize by exploitability, not CVSS alone. Start with CISA’s Known Exploited Vulnerabilities catalog and EPSS scores, then factor in what is reachable from the internet. A critical score on an isolated internal host matters less than a medium on your VPN gateway.
-
Put your AI stack in the asset inventory. AI software is one of the fastest-growing CVE categories. Barracuda counted more than 1,200 AI-related CVEs in the first five months of 2026, already more than all of 2025. Model servers, chat interfaces and MCP servers belong on the patch list.
-
Train on real exploitation, not slides. An analyst who has exploited a path traversal bug in a lab will triage the next advisory about one faster and with more confidence. Capture the flag competitions and cyber ranges give your team that experience on realistic vulnerabilities, in an environment where mistakes cost nothing.
-
Run drills against the clock. A tabletop exercise will not show you how your team handles a critical CVE that drops at 5 p.m. on a Friday. A timed cyber drill will.
-
Hire for hands-on skill. When volume doubles, each analyst carries more weight. Practical applicant assessments show whether a candidate can find and fix a vulnerability, which a résumé cannot.
Where Simulations Labs fits
Simulations Labs is a platform for building and running cybersecurity simulations, from CTF competitions to full cyber ranges and drills. With Simulations Copilot, you can build labs around the vulnerability classes your team deals with most, using our challenge library or your own scenarios. You can deploy in the cloud or on-premises, and built-in analytics show how each participant is progressing.
Security teams use it to upskill staff, screen candidates and run internal competitions. Universities use it to give students hands-on practice before they enter the field.
Get your team ready for the next 66,000
AI will keep finding vulnerabilities faster than last year, and probably faster than this one. The teams that cope will be the ones that can pick out the handful that matter and act on them quickly. That is a skill, and skills improve with practice.
Build your first lab for free. No credit card required. Get started for free, watch the product demo, or compare plans to find the right fit for your team.
