2026 CVE Count Tops 100,000: How Windows Admins Can Prioritize Exploited Vulnerabilities

Windows admins can feel this in their patch queues. Microsoft added 1,094 security flaws to the total on Tuesday, after adding 1,474 the previous month. Bressers gave The Register a blunt reason for the surge: AI-assisted vulnerability hunting. He said he expects people to look back on 100,000 as a quiet year.

The bigger question for admins is what to do with a list that long. Bressers's answer is to stop treating every CVE on it as equally urgent.

The numbers, and why they don't all agree​

The CVE system gives each publicly disclosed vulnerability a shared label, so vendors, scanners and defenders can all refer to the same flaw. CVE Numbering Authorities (CNAs) assign those labels. Bressers named VulnCheck, Microsoft, Oracle and GitHub among the large CNAs now publishing at record rates. A higher count means more labeled entries. It does not mean every entry is severe, exploitable, or present on your network.

Independent tallies show how quickly the curve bent this year:

• The 2025 baseline. One recount of CVE Tracker data put the total at 48,151: All of 2025 had 48,151. From January to October 2026 there were 89,849, about 2.3 times the same period last year (39,638), and already more than the whole of 2025.
• The monthly climb. In 2026, January had 4,302 and October had 17,049. October 2025 had 4,274, so that is about four times as many.
• The NVD-based view. A statistics dashboard updated the same day as the milestone showed 99 679 so far in 2026 from NVD-published records, a few hundred below VulnCheck's figure.

That gap is not a scandal. Different trackers count from different feeds at different times, so treat 100,222 as VulnCheck's count at one moment on November 13, not a final year-end total.

The surge also came in well above early forecasts. In its 2026 Vulnerability Forecast, the Forum of Incident Response and Security Teams (FIRST) predicts that 59,427 new CVEs will be discovered this year. It also warned that realistic scenarios could reach 70,000 to 100,000, with an upper bound near 118,000. In June, FIRST raised its 2026 forecast to 66,000. The real figure is already far past that.

Section summary: The six-figure milestone is real. The exact number depends on which feed you use, and either way it is roughly double last year.

Is it really all AI?​

Bressers is in no doubt. He told The Register that AI-assisted vulnerability hunting is driving most of what defenders are now seeing. Others have been more cautious about the evidence. One independent analysis of the growth found that vendor CNAs, GitHub, VulnCheck and the Linux kernel CNA drive the increase, which coincides with the arrival of AI-assisted vulnerability discovery. It then added a caveat: the evidence is mostly self-attribution and timing.

Part of the increase also comes from paperwork catching up, not from newly found bugs. Supply-chain security firm Safeguard looked at CVEs tied to GitHub-reviewed advisories and found that 373 (3.6%) arrived 90 days or more after the advisory. VulnCheck, a CVE Numbering Authority, published 311 of the 373, most of them since June. Bugs that were already fixed and already had advisories still add to this year's total once they get a CVE number.

VulnCheck's own first-half 2026 report also complicates the alarm. It counted 1,061 vulnerabilities attributed to AI-assisted discovery, and 14 of them (1.3%) had been confirmed exploited in the wild, about the same rate as everything else. The company concluded that AI-found bugs did not appear more likely to be exploited. Its reading was that AI mainly increases how many bugs get found, which gives defenders a chance to fix them before attackers find them.

So AI is plausibly the main driver, but the data doesn't support "AI did all of it." The increase also includes catch-up assignments and changes in how individual CNAs publish.

Exploitation: same percentage, much bigger number​

Here is the part that matters most to defenders. According to The Register, about 1.4 percent (1,363) of the CVEs published this year have been added to VulnCheck's Known Exploited Vulnerabilities catalog, a share that has remained relatively consistent. Bressers's point is that 1% of 1,000 and 1% of 100,000 are very different workloads.

Note that this is VulnCheck's KEV catalog, not CISA's, and VulnCheck's list is broader. Its first-half report also warns that exploitation often comes months or years after disclosure, so the newest CVEs have not had time to show their final exploitation rate.

The time to exploitation is shrinking:

• VulnCheck: The median time from CVE publication to entry in its KEV catalog fell from 120 days in 2025 to 80 days in the first half of 2026. Bressers told The Register the window has narrowed further since then.
• CrowdStrike: Its 2026 Threat Hunting Report says 88% of the exploitation it observed in the first half of 2026 involving public proof-of-concept code happened within 48 hours of that code's release. It says the China-nexus groups Vault Panda and Genesis Panda attacked within 24 hours. This covers CrowdStrike's own observations of bugs with public exploit code, not all CVEs.
• There is a counterpoint in VulnCheck's own data. About 200 CVEs reached its KEV catalog within 31 days of publication in the first half of 2026, compared with 196 in 2024 and 194 in 2025. Early exploitation stayed roughly flat while CVE volume soared.

Case study: refrigeration controllers probed within two hours​

Bressers pointed to VulnCheck's November 13 disclosure of 14 root-level vulnerabilities in Copeland/Dixell XWEB EVO refrigeration supervisors. CERT-FR had named this controller family among those compromised in the October attack on French supermarket refrigeration, which France attributed to an Iranian state unit. VulnCheck's write-up gives the timeline:

1. The NVD record for CVE-2026-124014, an unauthenticated configuration-file write, went public with no exploit or proof-of-concept.
2. One hour and 40 minutes later, VulnCheck's canary sensors recorded exploitation attempts: 87 hits in the first hour, from a single host.
3. A second source began probing CVE-2026-124010, an unauthenticated root command execution flaw, early the next morning.

VulnCheck described both sources as opportunistic scanners reacting to a fresh advisory. It did not tie them to the October sabotage campaign. Bressers said AI was "probably" behind the speed but stopped short of proving it. Copeland declared the product family end-of-support in March 2026, so VulnCheck's advice is to keep these devices off the public internet, put them behind a VPN, and plan to replace them.

What this means for Windows admins right now​

The November Patch Tuesday batch shows the scale, according to The Register's November 10 coverage:

Trend Micro Zero Day Initiative's Dustin Childs also counted 30 CVEs in the release with "wormable" characteristics. His advice to The Register was to patch Exchange and domain controllers first and to fence off exposed network services such as DNS and DHCP.

Note the Outlook flaw: it has the lowest score in the table and is the only one under active attack. Ranking purely by CVSS would have put it last.

Triage in a "patchpocalypse": a working checklist​

Bressers told The Register that the industry now has a data problem more than a security problem. In June, CISA issued Binding Operational Directive 26-04, which replaced flat patch deadlines with risk-based prioritization. The deciding factors include whether an asset is internet-exposed, whether the flaw is being actively exploited, and whether exploitation can be automated. VulnCheck says the directive calls for remediation in as little as three days when those factors line up.

BOD 26-04 binds US federal civilian agencies, not private companies. Its logic still works for any IT shop. Here is a practical way to apply it (my synthesis, not an official workflow):

1. Inventory first. Map CVEs to the products and versions you actually run. A CVE in software you don't own isn't on your list.
2. Flag exposure. Anything reachable from the internet goes to the top: Exchange, VPN gateways, edge devices, and stray OT or IoT controllers.
3. Check exploitation evidence. Match against CISA KEV, and consider VulnCheck's broader KEV catalog. Being listed should outrank a high CVSS score.
4. Weigh automation and pre-authentication. Zero-click, unauthenticated and wormable flaws such as the LDAP and Search bugs above need to be fixed in days.
5. Use CVSS to break ties, not to set the order. It still helps, but as the Outlook example shows, it is not a ranking.
6. Verify. Confirm that updates actually installed on domain controllers and Exchange servers. Don't assume a deployment ring finished cleanly.

Success looks like a short, defensible list of urgent fixes, not a dashboard showing 100,000 open items.

Open-source maintainers under strain​

Bressers also described individual developers buried in vulnerability reports and foundations overloaded by AI agents downloading packages. Projects are handling it in different ways:

• Eclipse Foundation (Open VSX): On April 21, it launched the Open VSX Managed Registry for commercial users, with a 99.95% uptime SLA and service credits. Open VSX is the extension registry used by tools built on the VS Code extension API, including Cursor, Windsurf, VSCodium, Google's Antigravity and AWS's Kiro. The Foundation says individual developers and open-source projects still use it for free.
• curl: Maintainer Daniel Stenberg announced on the curl-library mailing list that, starting October 26, low- and medium-severity vulnerabilities would be handled publicly on GitHub, leaving private handling for higher-severity issues. He said 13 pending advisories would become public pull requests. The Register reports that curl had already closed its bug bounty program earlier in the year because of AI-generated submissions.

Neither approach fixes the whole problem, and Bressers admitted nobody wants to move first.

The bottom line​

• About 100,000 CVEs is a real milestone, though the exact figure depends on the feed you use.
• AI is the most likely main driver, but late CVE assignments and changes in CNA publishing behavior also add to the total.
• The share of CVEs that get exploited is holding at roughly 1.4%. Because the total is so much larger, that still means far more exploited bugs, and they are being exploited sooner.
• For Windows shops, November's Patch Tuesday makes the point: one exploited Outlook bug with a medium score, plus zero-click flaws in Exchange indexing and LDAP. Patch based on exposure and exploitation evidence, not CVSS score or CVE count alone.