Hay and Needles
Vulnerability disclosures have more than tripled this year. The exploited ones have not kept pace, and they are easier to spot than the size of the pile suggests.
In January 4,335 new vulnerabilities received a CVE identifier. In September the figure was 14,961. Between January 1st and October 19th the count reached 83,167, already 73% more than in the whole of 2025. Of those, attackers have so far been seen exploiting 696, or about one in 119. Plot both on the same scale and the needles barely leave the floor:
The ratio is getting worse. Of the CVEs published in January, 20 in every 1,000 have since been exploited. For June the figure is nine, and for September it is under four. Some of that decline is an accounting artifact, because a CVE published last month has had less time to attract attackers than one published in January. Still, for September to match January's rate, its 55 exploited CVEs would need to become 300. All year the monthly crop of needles has hovered between 55 and 97, while the monthly pile of hay more than tripled.
Counting the other way round gives a similar answer. In the 13 weeks to October 19th, 41,706 CVEs were published and 576 vulnerabilities of any age were exploited for the first time, about one for every 72. Old hay still hides needles. Of the 109 vulnerabilities first exploited in the past week, 61 were published before 2026.
None of this is comforting for a team that tries to patch the whole pile. Our long-running research on remediation found that organizations close about 15% of their open vulnerabilities each month, and that the rate barely changes with the size of the company. Nobody's capacity has tripled since January.
The good news is that needles do not look like hay. Cross-site scripting is the biggest pile of 2026, with 7,355 CVEs, and only 21 of them have been exploited. Operating-system command injection accounts for 2,016 CVEs and 68 needles, an exploitation rate about 12 times higher (see chart 3). Missing authorization, the second-biggest pile at 4,472 CVEs, has produced no more than 11. The type of weakness is one clue among hundreds, and a model can weigh all of them at once.
Lists help less than they used to. CISA's catalog of known exploited vulnerabilities includes 188 of this year's 696 needles, about 27%. The haystack will keep growing, whether the cause is machine-assisted bug hunting or simply more software. Searching it by hand was always a losing game. The useful question is which straws are most likely to be needles, and the data answer it better with every month that passes.
