By FIRST Forecasting team: Jerry Gamblin and Eireann Leverett
Monday, June 15, 2026
The cumulative drift is currently +46.3% above the original forecast (an excess of 6,420 CVEs), leading to a revised 2026 projection of ~66K CVEs. There were many questions earlier this year when we produced prediction intervals as wide as 100k. Still, an important feature of a forecast is that it encompasses unlikely but realistically possible outcomes. AI-assisted discovery has increased the chances that we see what many people would consider an extreme number of vulnerabilities this year, and we take such things into account when producing the strategic forecast.
As we look toward the second half of 2026, the vulnerability coordination domain is undergoing an unprecedented transformation. With the recent deployments of highly autonomous AI discovery tools, such as Anthropic’s Mythos (a specialized, unreleased agent in the Claude family) and OpenAI’s GPT-5.4-Cyber, the volume of identified software flaws has accelerated massively. However, as we will explore in this mid-year update, a spike in raw discovery volume does not equate to an unmanageable security crisis. In sharp contrast, there is evidence that version cadences are remaining static amongst the rising tide of new CVEs. This is clearly visible in the lower graph, where the interval per product release is slightly increasing. In other words, we think more CVEs are being shipped with each version update, but the version updates remain the same cadence.
We thus advocate for calm growth in your vulnerability exposure management teams and processes, rather than a panic-driven narrative. Prepare to double the work you do if you maintain software, but we actually expect the work you do patching live systems to remain steady, at least through the end of 2026. The growth we see in CVE volumes is often attributed to more eyes, more bug bounties, and more AI-generated results. However, we think this ignores the growth of Open Source projects receiving attention for the first time, as well as the raw growth of software worldwide. As we can see below, this is a significant factor in CVE growth, not mentioned elsewhere.
Historically, the FIRST vulnerability forecast relied on time-series models to predict the organic growth of CVEs. The 2017 structural change in CVE data represented a major shift, and we carefully chose models to either avoid or accept it. That internal history is relevant today because everyone believes we are going through another transformational period. Forecasters have to make important choices about when and where to switch tools.
2026 has introduced an entirely new paradigm: the capability-triggered model.
If we look only at the total volume of vulnerabilities, the forecast appears daunting. However, applying an "exploitability overlay" reveals a much more actionable reality. We refer to this as the "Rain vs. Flood" analogy.
| Metric | Trend (1H 2026) | Driver |
|---|---|---|
| Total reported disclosures (Volume) | Massive Increase | AI Bug Hunting (Mythos/Claude) & Structural CNA Expansion |
| Actionable Exploitability (EPSS >10% / KEV) | Flat / Stable | Structural complexity of reliable exploit development vs. legacy bugs. |
As adversarial capabilities expand, so do defensive mechanisms. The release of specialized defensive AI models, such as OpenAI's GPT-5.4-Cyber for "Trusted Access," provides a counterbalance to the rapid generation of exploits.
This is a crucial time for software maintainers to lean into automated tooling to find and remediate within their remit. That advantage may not last long, and so should be seized. Vulnerabilities are becoming easier to find, so more work can be done on verifying and applying learning constructively in the secure software development lifecycle. We could be eliminating entire classes of CWE rather than continuing the death-by-a-thousand-cuts approach.
Traditional vulnerability forecasting focuses heavily on vendor and product breakdowns. However, 2026 demands that we account for "ephemeral instant software"—code generated and deployed on demand by AI assistants.
To address this, vulnerability programs must evolve toward dynamic cataloging, using AI-BOMs (Bills of Materials) and runtime monitors to detect, inventory, and continuously assess these ephemeral components as they are deployed.
The foundational constraint of the Coordinated Vulnerability Disclosure (CVD) ecosystem is human capacity. The NVD team takes vacations. Security analysts get sick. When we see a drop in published vulnerabilities or a delay in processing, we are often seeing reduced human headcount rather than a safer internet.
We believe that those of you managing assets should advocate for a budget not based on CVE growth, but rather on software growth. This is evident in the graphs below, which show that the number of distinct CPE or software products with vulnerabilities has grown by two orders of magnitude. It is the growth in the asset register's diversity, not the growth of CVEs, that is driving heavy workloads.
On the other hand, if you work for a software company, the growth in CVEs is directly relevant to your workload and release cycles. You simply must learn to ship more patches per security release.
As we navigate the AI Epoch, our defense strategies must pivot away from merely tracking the total volume of flaws. We must rely on exploitability overlays, contextual asset mapping, and defensive AI tools to ensure our human analysts focus only on the water threatening to flood the house.
The full methodology of this forecast, live data reports, and the Python scripts (cve_forecast_halftime.py and exploitability_overlay.py) used to generate these models are available in the companion GitHub repository: https://github.com/jgamblin/FirstForecast
The historical yearly forecast was written with a SARIMAX model, and in the mid-year cycle we switched to examining monthly forecasts with the monthly forecast code above. We discussed both, and made some judgements, and we think the monthly data shows different interesting stories that allows for better strategic decision making.
That yearly model can be found here: https://github.com/FIRSTdotorg/Vuln4Cast
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。