Why More CVEs Don’t Necessarily Mean More Exploitable Risk
Summary
A security-leader briefing argues that rising CVE counts do not equal rising exploitable risk, and recommends prioritizing known exploitation and exploitability signals over raw disclosure volume.
Key points
- The article cites a projection of about 66,000 CVE disclosures in 2026, up from 48,185 in 2025.
- It says the share of critical vulnerabilities fell from about 13% in 2024 to 7% in 2025, while actively exploited flaws remain under 1%.
- It attributes rising disclosure counts to AI-assisted discovery, changes in vulnerability reporting, and growth in the number of tracked products.
- The article says NVD analyzed about 28% of newly disclosed CVEs in 2025, contributing to a vulnerability-triage bottleneck.
- It argues that time to exploitation is more important than disclosure volume, noting exploitation can begin before a vendor patch is public.
- Its recommendations include prioritizing CISA KEV entries and EPSS scores, using virtual patching or containment when patches are unavailable, and improving triage automation and metadata.
Article Details
- Topic
- Separating vulnerability disclosure volume from exploitable risk and prioritizing vulnerability remediation in 2026
People
Vendors
Products
GitHub Security AdvisoryThis includes a roughly 449% year-over-year jump in GitHub Security Advisory volume and a large backlog of previously unassigned vulnerabilities finally being cataloged.GPT 5.5Models such as Anthropic’s Mythos and OpenAI GPT 5.5 are highly effective at surfacing latent stability bugs.Linux kernelHowever, volume is not risk: the Linux kernel alone now accounts for more than 5,800 CVEs because its CVE Naming Authority (CNA) assigns an identifier to nearly every bugfix, even where no security impact isMythosModels such as Anthropic’s Mythos and OpenAI GPT 5.5 are highly effective at surfacing latent stability bugs.TrendAI™ Zero Day Initiative™ (ZDI)The TrendAI™ Zero Day Initiative™ (ZDI) exists to close this gap on the front end.