The 2026 CVE surge: what 66,000 CVEs a year means for attack surface management

What did FIRST forecast?

On 11 February 2026 FIRST published its 2026 Vulnerability Report, projecting a median of about 59,427 CVEs for the year, with a 90% confidence interval of 30,012 to 117,673. On 15 June 2026 its mid-year forecast raised the projection to about 66,000. FIRST names three structural drivers: AI-assisted vulnerability discovery, a 449% year-over-year rise in GitHub Security Advisory volume, and a 3,119% increase in VulnCheck CNA-of-Last-Resort activity.

The same release says actionable exploitability remains flat: filtered for CISA KEV entries or EPSS scores above 10%, the patching burden has not materially increased. That is the important point for security teams. More CVEs does not mean proportionally more exploitation. It means more noise to sort through before you reach the exposures that matter.

Why does volume hit external attack surface programs hardest?

Internet-facing assets advertise a lot about themselves: server banners, software versions, certificates. Matching those details against CVE lists is easy to automate, so every new CVE flows straight into the queue. Many of the assets involved sit outside regular patch cycles, especially in acquired companies and brand sites.

The filters that cut the list are much smaller than the list itself. CISA's KEV catalog only includes vulnerabilities with reliable evidence of exploitation in the wild and a clear remediation action. FIRST's EPSS publishes a daily probability of exploitation in the next 30 days for each published CVE. Validation on your own assets narrows it further, to what is exploitable now. Our prioritization note sets out an order of work.

How are ASM vendors responding?

The 2026 announcements from vendors in our ranking share a theme: prove exploitability on the customer's own assets faster, rather than publish more findings. In date order:

• 19 March 2026: Rapid7 added runtime validation and data security posture management to Exposure Command, aimed at showing which cloud vulnerabilities are exploitable.
• 31 May 2026: IONIX shipped Live Exposure Defense, which it says correlates each new CVE with a customer's internet-facing assets, confirms exploitability through safe active testing and delivers a mitigation workflow within 12 hours.
• 16 June 2026: CyCognito added Continuous AI Pentesting, running AI-driven offensive testing continuously across the external attack surface.
• 24 July 2026: watchTowr introduced Project Red for autonomous vulnerability reproduction, and says it reproduced one vulnerability in 22 minutes.
• 8 September 2026: Tenable said it is bringing Anthropic's Claude Mythos 5 into Tenable One, starting with Tenable One Adversary View for finding attack paths and remediation options.

These are vendor announcements. We have not tested the capabilities, and we link each one to its source on our news page.

What should an exposure program change?

Three adjustments follow from the numbers. First, stop reporting raw finding counts to leadership: a count that rises with global CVE volume says little about your own risk. Report validated and KEV-listed exposures instead. Second, set a target time from a CVE's publication to a decision on each affected internet-facing asset: exploitable, not exploitable, or mitigated. Third, make sure every asset has a named owner before the next large disclosure, because in a surge the slowest step is often finding the person who can approve the fix.

What should buyers ask now?

• How long from a CVE's publication to a validated answer on my assets? Ask for the typical case, not the best case.
• What share of findings arrive validated, and how are inconclusive results shown?
• What does a test send to production, and who approves it?
• Can the tool apply, or hand off, a compensating control while the patch waits?
• Does it retest after the fix?

Does this change our scores?

Not in this edition. Scores reflect vendor documentation reviewed in September 2026, and capabilities announced after that review will be assessed in the next one. The weights already lean toward this problem: exploitability validation carries 15% and remediation 20%. See how we score.