Chalk up a new record for vulns. The number of Common Vulnerabilities and Exposures (CVEs) found and disclosed so far in 2026 surpassed 100,000 on Friday – more than double 2025’s total – and the reason can be summed up in two letters: AI. “It’s kind of wild,” Josh Bressers, VulnCheck’s director of coordinated vulnerability disclosure, told The Register . “The thing that almost scares the bejesus out of me is while 100K sounds like a lot, in a couple years we’re going to say, remember when it was only 100K?” As of the time of our interview, about 4 pm UTC on Friday, VulnCheck counted 100,222 CVEs, he said. Microsoft alone added 1,094 security flaws to the total count on Tuesday, following 1,474 vulnerabilities the month before. “There’s no denying the fact that vulnerability hunting with AI is driving a majority of what we’re seeing.” All the major CVE Numbering Authorities (CNAs) – these are the organizations authorized by the CVE program to assign unique identifiers to security vulnerabilities – like VulnCheck, Microsoft, Oracle, GitHub, and other large enterprise IT vendors “are just screaming into the atmosphere right now,” Bressers said. “It’s AI.” Meanwhile, the percentage of these bugs that are exploited in the wild remains relatively consistent. About 1. 4 percent (1,363) of the CVEs published this year have been added to VulnCheck’s Known Exploited Vulnerabilities (KEV) catalog. “But obviously, as the number of CVEs grows, [1 percent] of 1,000 is a lot different than [1 percent] of 100,000,” Bressers said. Plus, as other security researchers have documented, the window between the public release of a security patch and attackers developing working exploits – often by reverse engineering the patch while end users are still applying the fix – is rapidly shrinking. This is also thanks to AI . From CVE to KEV
From January to June, 88 percent of the exploitation observed by CrowdStrike using public proof-of-concept (PoC) code occurred within 48 hours of the code’s release. The security firm said China-linked groups such as Vault Panda and Genesis Panda moved even faster, launching attacks within 24 hours of disclosure. Similarly, VulnCheck found the median time from CVE publication to exploitation falling from 120 days in 2025 to 80 days during the first half of 2026. This window has closed even further during the second half of the year, which also seems to coincide with the AI-induced vulnpocalypse . “It’s often just hours,” Bressers said, noting 14 make-me-root vulnerabilities that VulnCheck disclosed on Friday in Copeland refrigeration controllers. Two are under active exploitation. These are the devices that Iranian hackers abused to spoil food and spark fires in supermarkets across Europe . “We published those CVEs, and literally minutes later, we were seeing hits on our honey pots,” Bressers said about the Copeland device vulnerabilities. “We’ve hit a point where with anything that looks interesting, someone is taking that information and seeing what they can do with it. Is it AI driven? Probably. It’d be hard to say it’s not, because we’ve seen it really ramp up recently.”…