🔍 Read the full analysis: Why CVEs Are Rising And Patches Are Struggling To Keep Pace on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
ThorstenMeyerAI.com’s analysis of public vulnerability records counted 13,934 CVEs published from Oct. 1–25, 2026, more than three times the total for October 2025. The rise is concentrated among a few major vendors, and the data does not establish how much AI contributed. A separate figure from Anthropic points to the challenge after discovery: the company said 516 of 6,157 reported vulnerabilities were patched to its knowledge.
13,934 new CVE records were published from Oct. 1–25, 2026, according to an analysis by ThorstenMeyerAI.com, as the pace of vulnerability disclosure outstripped the number of fixes publicly reported in one cited program. The figures show a marked rise in published records, but they do not establish that AI caused the increase or that every disclosed flaw is exploitable.
The analysis says the October 1–25 total was 3.2 times the 4,389 records published during all of October 2025. It counted records by publication date using the U.S. National Vulnerability Database API and cross-checked October entries against CVE.org. The article gives a total of 13,766 October records plus 202 later rejected; its headline period total includes those rejected records, a distinction readers should keep in mind when comparing figures.
The monthly daily rate rose from 267 records per day in June to 320 in July, 410 in August and 502 in September, the analysis reports. For October 1–25, it counted 557 per day. The author says the growth rate slowed to about 11% in October, after monthly increases of 20% to 28% earlier in the summer. A projection that October could end near 17,000 records is the author’s estimate, not a final count.
The increase was concentrated among several organizations. Microsoft’s count rose from 180 records in October 2025 to 1,455 in October 2026; Oracle’s rose from 78 to 1,078, and VulnCheck’s from 163 to 2,085. The analysis says Oracle’s records were published mostly on Oct. 20. These figures describe records attributed to organizations, not necessarily the number of unique flaws they independently discovered.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why Patch Delays Matter
A larger disclosure volume increases the workload for software maintainers and organizations that must determine whether their systems are affected, prioritize flaws and deploy fixes. A CVE record identifies a disclosed vulnerability; by itself, it does not show whether attackers are exploiting it, how many products are exposed or whether a patch is available.
The analysis cites Anthropic’s disclosure dashboard, which listed 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge as of Oct. 2. That is a snapshot of one reporting program, not a representative patch rate for all software. Still, it illustrates why discovery counts do not measure how quickly users become safer: fixes depend on maintainers, vendors and customers acting after a report.
The article also cites reporting by Reuters and NorForge that attackers are using low-cost AI agents against older vulnerabilities. That claim points to a possible risk, but the supplied material provides no figures establishing how widespread such use is or linking it to the 2026 CVE increase. For defenders, the practical issue is exposure to known flaws that remain unpatched, rather than the headline count alone.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
What the CVE Counts Measure
A CVE is a public identifier for a disclosed vulnerability. The source explains that CVE Numbering Authorities, often vendors, coordinate publication, commonly after a fix or a disclosure deadline. That process means CVE totals reflect disclosures, not all vulnerabilities that exist and not a direct count of attacks. The analysis says criminals do not file CVEs; a record may document a flaw after a defender or researcher reports it, including one that was already being exploited.
The article’s records offer limited information about who found each vulnerability. Of 13,934 October entries in its count, 6,346, or 46%, named a finder. It says 200 records, or 1.4%, explicitly credited an AI lab, AI security firm or tool. The author cautions that this is a floor because records often omit the finder; it cannot measure AI’s overall contribution.
Anthropic’s dashboard, as reported by the source, listed 29,439 candidate vulnerabilities identified by Claude models. External firms reviewed 6,123 and confirmed 92.7% as real, while 6,157 had been reported to maintainers. The same material says those findings had generated 219 CVE records and 365 GitHub advisories so far. OpenAI’s Patch the Planet program with Trail of Bits reported hundreds of security issues across 19 open-source projects, with each reviewed by people. These are company-reported program figures, not an independent measure of AI’s share of all findings.
“The curve is still climbing fast, but the acceleration has slowed, not run away.”
— Thorsten Meyer, ThorstenMeyerAI.com
What the Public Data Cannot Show
The figures do not settle how much AI contributed to the increase. Most records in the source’s October count do not name a finder, and explicit AI credits may miss work that was assisted by AI but attributed to a person or organization. The supplied material also does not provide a complete comparison of patch rates across vendors or software projects.
Nor does the CVE surge by itself show that exploitation has risen at the same rate. The source says the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog added 245 entries in all of 2025, but the supplied text ends before giving the comparable 2026 figure. That comparison cannot be completed from the material provided. The scale of reported AI-agent use by attackers, and the extent to which such activity involves old versus newly disclosed flaws, also remain unclear.
The October record totals use different treatments of rejected entries: the analysis reports 13,766 records and 202 later rejected, while also presenting 13,934 as the total for Oct. 1–25. Readers should not treat these figures as interchangeable without confirming the counting rules. Final October totals may also differ from the partial-period count.
Final Counts and Fix Status
The next useful checkpoints are the finalized October CVE totals, updated records from NVD and CVE.org, and comparable exploitation data from CISA’s Known Exploited Vulnerabilities catalog. Those would help show whether the disclosure trend continued and whether known exploitation changed alongside it.
Maintainer and vendor updates will also determine how many reported vulnerabilities receive fixes and when those patches reach users. The 516 patched figure is Anthropic’s knowledge as of Oct. 2, not a live or independently audited status count. Further reporting should clarify how the company tracks fixes, whether maintainers have patched additional issues since that date, and how organizations are prioritizing updates.
Key Questions
How many CVE records were reported for October 2026?
The analysis counted 13,934 records from Oct. 1–25, including 202 entries it says were later rejected. It also reports 13,766 October records before those rejected entries, so the counting basis matters.
Does the increase prove AI is finding most vulnerabilities?
No. The analysis says only 200 of its October records explicitly credited an AI lab, AI security firm or tool, while 54% named no finder. Those records cannot show how often AI assisted work without receiving explicit credit.
How many vulnerabilities reported by Anthropic were patched?
Anthropic’s dashboard listed 516 patched out of 6,157 vulnerabilities reported to maintainers, to the company’s knowledge as of Oct. 2, 2026. This is one program’s reported snapshot, not an industry-wide patch rate.
Does a CVE mean a vulnerability is being exploited?
No. A CVE is a disclosure record and does not by itself confirm active exploitation, exposure in a particular system or the availability of a fix. CISA’s Known Exploited Vulnerabilities catalog tracks a narrower set of flaws known to be exploited.
Why might patches lag behind vulnerability reports?
After disclosure, maintainers and vendors need to assess the flaw, develop and test a fix, and distribute it. Organizations then have to identify affected systems and install updates. The source highlights these steps but does not provide a broad, comparable measure of patch delays.
Source: ThorstenMeyerAI.com
