CVE Count Hits 100,000 in 2026: UK Patch Priorities

CVE 100,000 in 2026: what actually happened

VulnCheck counted 100,222 CVEs at about 16:00 UTC on 13 November 2026 — more than double 2025's full-year total, according to The Register's interview with Josh Bressers, VulnCheck's director of coordinated vulnerability disclosure.

Bressers put the cause bluntly: "It's kind of wild… There's no denying the fact that vulnerability hunting with AI is driving a majority of what we're seeing." Major CVE Numbering Authorities — VulnCheck, Microsoft, Oracle, GitHub and other enterprise vendors — are, in his words, "just screaming into the atmosphere right now."

The increase could put additional pressure on vulnerability-management staffing and change-control processes.

Why AI is inflating disclosure and shrinking response time

Microsoft alone added 1,094 security flaws to the CVE total in November 2026, following 1,474 vulnerabilities in October — figures that on their own can swamp a change-management calendar built around a steady monthly cadence. See our Microsoft vulnerability statistics for how that compares across the year.

The exploitation side is accelerating in parallel. CrowdStrike found that 88 percent of exploitation linked to public proof-of-concept code happened within 48 hours of release during January to June 2026. CrowdStrike said China-linked groups including Vault Panda and Genesis Panda launched attacks within 24 hours when public PoC code was available. VulnCheck separately tracked the median time from CVE publication to exploitation falling from 120 days in 2025 to 80 days in the first half of 2026 — a trend captured in our CVE exploitation speed data.

Bressers described the Copeland refrigeration controller disclosures as an extreme case. The Register reported that Iranian hackers had abused Copeland refrigeration controllers to spoil food and spark fires in supermarkets across Europe: "We published those CVEs, and literally minutes later, we were seeing hits on our honey pots."

Volume versus danger: why KEV status outranks the CVE count

Only about 1.4 percent of 2026's CVEs — 1,363 bugs — have been added to VulnCheck's Known Exploited Vulnerabilities catalogue. As Bressers noted, that percentage looks stable, but "1 percent of 1,000 is a lot different than 1 percent of 100,000."

This is the single most important distinction for UK buyers to internalise: the 100,000-plus figure measures disclosure activity, not organisational risk. Teams that keep chasing every new CVE number will burn capacity on bugs that are never exploited, while genuinely dangerous ones sit unpatched. Our guide to CVE and KEV frameworks sets out how the two measures differ and when each should drive action.

What this means for UK patch management and compliance

CISA's June 2026 directive moves organisations away from CVSS-only prioritisation toward criteria including exposure, active exploitation and exploit automation — rather than treating every CVSS-rated critical as equally urgent. Bressers summarised the shift as moving from "a security problem" to "a data problem," with heat maps for infrastructure replacing blanket critical-patching lists.

UK organisations should not treat this as a US-only concern. For in-scope software, Cyber Essentials requires qualifying vulnerabilities to be fixed within 14 days where a vulnerability is vendor-rated critical or high risk, scores 7 or above on CVSS v3, or carries no stated severity. Cyber Essentials Plus testing records a failure when a qualifying vulnerability has had a vendor-provided fix available for more than 14 days and remains unresolved — and that sampling extends across end-user devices, servers and infrastructure-as-a-service instances, not just the obvious endpoints.

With disclosure volumes doubling, structured, risk-prioritised processes and automation can help organisations meet the 14-day requirement across a growing backlog, supported by vulnerability management services.

Building the automation case

The practical response combines asset-aware inventory with exposure intelligence: map every CVE to the specific assets and software versions it actually affects, ingest exploitation telemetry as it updates, flag internet-facing systems automatically, and route anything that can't be auto-remediated to a named owner with a documented deadline.

This reduces reliance on manually re-ranking CVSS lists every time a vendor pushes a four-figure patch batch. For organisations operating essential services, the NCSC's Cyber Assessment Framework provides a broader assurance framework alongside Cyber Essentials, covering energy, healthcare, transport, digital infrastructure and government bodies.

Open source strain and the knock-on supply-chain risk

AI-generated disclosure volume is also straining the open source projects that sit underneath most enterprise software stacks. Bressers called this "a security problem super close to my heart," noting that individual maintainers are "drowning in vulnerability reports" while foundations face AI agents scraping and downloading packages millions of times a day.

Two responses illustrate the shift: the Eclipse Foundation launched a paid managed tier for Open VSX in April, guaranteeing a 99.95 percent uptime SLA backed by service credits for enterprise users; and curl's maintainer, Daniel Stenberg, began routing low- and medium-severity reports straight to public GitHub from 26 October rather than handling them privately. Bressers' warning applies directly to UK procurement teams: "The way we currently do things has to change, and it's going to have to change fairly soon."