The United States National Vulnerability Database recorded 45,207 flaws between January and 28 July, putting this year within touching distance of the 48,185 published across the whole of 2025 — with five months still to run.
This is not because software is getting worse. It is because our machines are getting better at finding flaws that were already there.
The disclosure surge is real and vendor-visible
The clearest evidence for the surge comes from individual vendors, not the database total.
| Vendor | July 2026 advisory volume | Prior comparable | Multiple |
|---|---|---|---|
| Oracle | 1,449 vulnerabilities patched | 309 | 4.7× |
| Microsoft | 642 security defects disclosed | ~128 | 5.0× |
| Google Chrome | 433 vulnerabilities documented | 11 | 39.4× |
Advisory volumes as reported. The multiples are RECATOOLS arithmetic. These are counts of flaws found and fixed, not of incidents — a larger advisory is a sign of more thorough searching as much as of a worse product.
Oracle, Microsoft and Google have each invested in machine-learning models that scan code automatically, and those models surface defects that manual review misses. The result is the same across the board: more CVEs, faster.
The exploitation side has not kept pace
Reporting on the surge notes that the government's own Known Exploited Vulnerabilities catalogue shows no corresponding rise in exploited issues. We checked that against our own server-side snapshot of the catalogue, and the picture is close to that but not identical.
| Measure | 2025 | 2026 to 27 July | Change |
|---|---|---|---|
| Entries added to the KEV catalogue, 1 Jan – 27 Jul | 149 | 171 | +14.8% |
| Disclosures recorded by the NVD | 48,185 (full year) | 45,207 (to 28 Jul) | Near parity already |
| Share of disclosures reaching the KEV catalogue | 0.508% (full year) | 0.378% (to date) | −25.6% |
| Put another way | 1 in 197 | 1 in 264 | Less likely |
KEV counts are RECATOOLS analysis of our own snapshot of the CISA feed, version 2026.07.27, comparing the same calendar window in each year. NVD totals are as reported. The 2025 share uses a full year against a partial one, so it flatters 2025 slightly; the like-for-like KEV comparison in the first row does not have that problem.
Our count shows confirmed exploitation entries up 14.8 per cent year on year for the same window — a rise, not a flat line. Set against disclosures running at nearly double last year's pace, though, the conclusion the reporting draws survives: the two curves have separated.
The arithmetic is straightforward. Roughly one disclosed flaw in 264 has been confirmed as exploited this year, against one in 197 across last year. Any given CVE crossing your desk is now about a quarter less likely to be one that anybody has actually used.
Where we differ from the reporting, and why it matters
We would not describe the exploited count as unchanged, because our snapshot shows it rising by roughly a seventh. That distinction matters. Describing the count as flat invites the conclusion that AI-found flaws are not being weaponised at all, which the data does not support.
The figures point to a narrower, more useful conclusion: exploitation is growing slowly while disclosure is growing quickly, so the ratio is falling. That is a statement about proportions, not about safety.
It is slower to arrive and faster when it does
The other half of the picture cuts the opposite way. Alexander Leslie of Recorded Future puts the average time to exploitation at 24 hours in 2026, down from 72 hours in 2025.
So the odds that a given flaw is ever exploited have fallen, while the time available to react once it is has fallen by two thirds. We have watched that compression twice in the past fortnight: a SharePoint flaw exploited within hours of proof-of-concept code appearing, and a Rails advisory whose technical details were published four weeks early.
Why the flaws were there to find
A rising disclosure count does not measure new defects. For the most part, these vulnerabilities were already present in shipped code. What changed is the cost of locating them.
A model that reads a codebase does not get bored, does not skip the unglamorous modules and does not stop at the end of a sprint. Applied across a large product it surfaces a backlog that accumulated over years, which is why the first year of serious automated scanning produces a spike rather than a steady climb — and why a 39-fold jump in one browser's advisory count says more about the scanning than about the browser.
This implies the surge should be temporary, at least in part. A backlog can only be discovered once. Whether the rate settles back toward the old baseline or establishes a permanently higher one is the question the next two years answer, and nobody knows yet which it will be.
What this changes about triage
A team patching by severity score is now sorting a pile growing at nearly double the previous rate, but the proportion of urgent items in that pile is smaller.
That is an argument for exploitation-led prioritisation rather than volume-led. The KEV catalogue exists precisely to name the small subset that is confirmed to be in use, and 171 entries in seven months is a list a small team can actually work. Our KEV deadline calculator — our own first-party tool — converts those entries' remediation windows into the working days a team really has.
The caveats
- The KEV catalogue is not a measure of all exploitation. It records what CISA has confirmed and chosen to list, so it reflects visibility and prioritisation, not ground truth.
- Our snapshot ends on 27 July 2026. Entries added since are not counted, and the 2026 figures are partial by construction.
- Comparing a full 2025 against a partial 2026 understates the current year in the share row; the like-for-like row is the sounder comparison.
- A rising disclosure count is not a rising defect count. These flaws largely already existed; better scanning found them.
- Enrichment lags. NIST has said its processing has struggled to keep pace with submission growth, so database records are not uniformly complete.
Key takeaways
- 45,207 disclosures by 28 July — 93.8 per cent of all of 2025, with five months to go.
- Single-vendor advisory volumes are up 4.7× to 39×, driven by automated code scanning.
- Our count of the KEV catalogue shows +14.8% year on year for the same window — a rise, not a flat line.
- The share of disclosures reaching KEV fell about a quarter, from 1 in 197 to 1 in 264.
- Time to exploitation dropped from 72 hours to 24.
View author profile → · Editorial policy
