🔍 Read the full analysis: Why CVE Counts Are Climbing: A Look At AI And The Patch Gap on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A report dated October 26 counted 13,934 CVE records published from October 1 through 25, 2026, and 88,772 so far this year. The figures show a sharp increase, but they do not establish how much AI caused it; the report says only 1.4% of October records explicitly credit an AI lab or AI security firm. The larger concern is the time between reporting vulnerabilities and shipping fixes: Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
A report published October 26 counted 13,934 CVE records published from October 1 through 25, 2026, more than three times the 4,389 records published in all of October 2025. The figures document a surge in vulnerability disclosures, but do not show that AI caused most of it; the report’s clearest warning is that patching is lagging behind discovery.
The analysis, based on the U.S. National Vulnerability Database (NVD) and CVE.org records, counted 88,772 CVEs in 2026 through October 25—78% more than the total for all of 2025, according to the report. It found that daily publication rates rose from 267 in June to 502 in September. October’s reported daily rate through the 25th was 557, although the analysis says the rate of monthly growth slowed to about 11% in October after higher increases in the preceding months.
The increase is concentrated among a small number of organizations, rather than evenly distributed across software projects. The report counted 1,455 Microsoft records in October, compared with 180 in October 2025, and 1,078 for Oracle, compared with 78 a year earlier. It also counted increases for GitHub and VulnCheck. The author says October’s total includes records later rejected, and separately reports 13,766 records published in October plus 202 rejected. The precise counting scope matters when comparing totals.
The records offer limited evidence about who initially found the bugs. Of October’s 13,934 records, 6,346 named a finder, while 200—1.4%—explicitly credited an AI lab or AI security firm, the report says. That figure is not a complete measure of AI involvement: most records do not name a finder, and the report cautions that CVE data cannot establish how much AI contributed to discovery.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Fix Queue Is the Key Risk
A higher count of published vulnerabilities does not by itself mean attackers have more newly usable exploits. CVE records document disclosures, not whether a flaw is being exploited or whether users have installed a fix. The practical risk depends in part on how quickly maintainers release patches and organizations deploy them.
The report cites Anthropic’s disclosure dashboard, which said it had reported 6,157 vulnerabilities to maintainers and that 516 were patched to its knowledge. That is a limited snapshot from one company, not a measure of every vulnerability or patch effort. Still, it illustrates why discovery figures alone cannot show whether software is becoming safer: a reported bug may remain open while affected products continue to be used.
For security teams, rising disclosure volume can add pressure to triage and prioritize fixes. The report also says the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog—an indicator of vulnerabilities known to have been exploited—has not grown at the same pace as the CVE count. That comparison does not prove exploitation is unchanged, but it cautions against treating every new CVE as an active attack.
Products Worth Considering
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
As an affiliate, we earn on qualifying purchases.
What the CVE Records Show
A CVE is a public identifier for a disclosed vulnerability. The report explains that records are generally published through authorized numbering organizations, often after coordinated disclosure involving a vendor or maintainer. That means CVE totals reflect the disclosure and record-keeping process, not a direct count of bugs found by attackers or AI systems.
For its analysis, the author queried the NVD’s CVE API for publication dates and cross-checked October entries against CVE.org, with data retrieved October 26, 2026. The report says 98% of October records had a 2026 identifier and gives a median 15 days between reserving an identifier and publication. It argues that the figures do not look like a simple release of old records, though the data and counting choices should be kept in view.
The report also describes AI-related security work, including Anthropic’s dashboard and OpenAI’s Patch the Planet program with Trail of Bits. Anthropic reported thousands of candidate findings, but says external firms reviewed 6,123 and confirmed 92.7% as real. OpenAI’s program reported hundreds of security issues across 19 open-source projects, reviewed by people. These are company-reported results; they do not establish what share of the overall CVE increase came from AI.
“The real question is how fast fixes ship.”
— Thorsten Meyer, author of the October 26 report
The available records do not establish what proportion of the 2026 increase was caused by AI-assisted discovery. Because 54% of October entries name no finder, the 1.4% that explicitly credit AI labs or security firms is not a reliable estimate of AI’s total contribution. It is a count of explicit attributions in the records examined.
The report’s figures also do not establish how many vulnerabilities remain exploitable, how quickly every affected product will be patched, or how many have been exploited in attacks. Its patch figure comes from Anthropic’s own knowledge of reports it made to maintainers, while its October totals reflect a defined date range and record-counting method. A projection that October could end near 17,000 records is the author’s estimate, not a final count.
More Records and Patch Data Ahead
The October total will be clearer after the month ends and additional records are published or revised. The author’s estimate of roughly 17,000 records assumes the reported pace continues; it should not be treated as a confirmed result. Future comparisons will also depend on consistent dates, treatment of rejected records and the sources used.
For a clearer view of risk, readers will need more than CVE totals: updated information on confirmed exploitation, patch availability and deployment, as well as better disclosure of who found vulnerabilities and whether AI tools were involved. The immediate next step for affected software users is to follow vendor and maintainer advisories and apply available security updates according to their organization’s risk priorities.
Key Questions
How many CVEs were published in October 2026?
The report counted 13,934 records from October 1–25. It also says 13,766 October records were published, with 202 later rejected, reflecting a distinction in its counting and status figures. The full-month total was not yet known on October 26.
Does the rise prove that AI is finding most vulnerabilities?
No. The report says only 200 October records, or 1.4%, explicitly credit an AI lab or AI security firm. Since 54% of records name no finder, that number cannot measure AI’s full contribution.
Why is the patch gap important?
A disclosed vulnerability can remain a risk if maintainers have not released a fix or users have not installed one. Anthropic reported that 516 of 6,157 vulnerabilities it had reported to maintainers were patched to its knowledge; this is a company-specific figure, not a measure of all software.
Does a new CVE mean attackers are exploiting the flaw?
No. A CVE identifies a disclosed vulnerability; it does not by itself confirm active exploitation. The report compares CVE growth with CISA’s Known Exploited Vulnerabilities catalog but says the catalog’s growth did not match the CVE curve.
Source: ThorstenMeyerAI.com
