Cybersecurity teams brace for surge in global CVEs in 2026

https://securitybrief.com.au/story/cybersecurity-teams-brace-for-surge-in-global-cves-in-2026

Publish Date: 2026-02-11 23:25:00

FIRST forecasts that the global vulnerability disclosure system will publish more than 50,000 Common Vulnerabilities and Exposures (CVEs) this year, with a median estimate of about 59,000. If realised, it would be the first time the industry has crossed 50,000 CVEs in a single year.

The Forum of Incident Response and Security Teams (FIRST), a cybersecurity non-profit, estimates the 2026 total will fall within a 90% confidence interval of 30,012 to 117,673. The upper end of that range would mean a materially higher workload for security teams that track disclosures and manage remediation programmes.

Vulnerability disclosures are a core input for security operations. Organisations use CVE entries to guide patch management, risk assessments, scanning, and detection engineering across security information and event management systems, endpoint tools, and intrusion detection products. Higher volumes increase the time and effort needed to triage issues and determine which exposures require action.

Pressure on teams

The forecast also outlines “realistic scenarios” in which 70,000 to 100,000 vulnerabilities could be published this year. That range sits above the median and reflects the possibility of continued growth in publication rates.

FIRST described the expected increase as a shift in operational planning, not simply a year-on-year rise. The difference between preparing for tens of thousands of entries and preparing for a six-figure total affects how teams allocate staff time, build automation, and set internal service levels for remediation.

“The question organizations need to ask right now is: are my people and processes ready to handle this volume, and am I prioritizing the vulnerabilities that actually put my data at risk? Our forecast allows defenders to stop reacting to every new CVE and start making strategic decisions about where to focus limited resources before attackers exploit the gaps,” said Éireann Leverett, FIRST Liaison and lead member…

Source