What should you do when CVE volume jumps?
Short version. On 29 October 2026 the CVE Program’s metrics page showed 72,812 published records for 2026 through the third quarter, against 48,244 in all of 2025. The third quarter alone was 36,962, above the 28,961 published in 2023. A published record is a disclosure, and the program now lists 563 numbering authorities. Sort the queue by the hosts you expose to the internet and by evidence an issue is already being used. Then book a test of the host that matters. Observ tests one host for $3,995 and retests the fixes inside 90 days.
a16z’s survey of 100 CISOs, published 28 October 2026, describes the same pressure from the buyer’s side. More weaknesses are being reported. Models are better at finding flaws that have sat in widely used software. Teams have to decide which weaknesses matter to the business and get those fixed. The survey does not publish the CVE Program’s table. The table does not name a finder. A buyer needs both, and then a rule for the queue.
What does the CVE count measure?
The count is how many CVE records numbering authorities published, under the program’s own status rules.
The metrics page is a snapshot taken after each quarter. Earlier quarters in the open year are recalculated when a record is rejected. A pass at year-end sets the annual total. Previous years stay as they were when that year closed. On 29 October 2026, Q4 was still marked TBA, so 72,812 is three quarters.
A published record has an ID, a prose description, and at least one public reference. A reserved ID is a number a numbering authority has set aside. Reserved IDs stood at 105,782 in 2026, against 70,729 in 2025. Adding the reserved column to the published column invents records that are not public yet.
The program lists 563 numbering authorities, 560 partners plus 3 of last resort, in 43 countries. In 2026, 95% of published records came from the partners and 5% from the last-resort authorities, CISA and MITRE. In 2017 that split was even. A wider pipe publishes more records whether or not the stock of bugs grew at the same pace.
| Year | Published records |
|---|---|
| 2023 | 28,961 |
| 2024 | 40,077 |
| 2025 | 48,244 |
| 2026 through Q3 | 72,812 |
| Quarter | Published records |
|---|---|
| Q1 2026 | 15,154 |
| Q2 2026 | 20,696 |
| Q3 2026 | 36,962 |
| Q4 2026 | Open on 29 October 2026 |
Q3 is the figure people will repeat, so it needs the sentence next to it. 36,962 is a little over three times Q3 2025, which was 11,738, and it is more than the program published in all of 2023. The page does not say the jump came from AI, from a backlog clearing, or from more products entering scope. a16z describes particular research in which models helped surface old flaws, including in PHP, which they note powers a large share of websites. That is an account of those cases. It is not a label on this table.
A straight line through Q4 would produce a round number for a budget slide. Q2 was 20,696 and Q3 was 36,962. The year is lumpy. We are not forecasting it.
Which records belong on a patch list?
A record belongs on this week’s list when the software is on a host you run, someone outside can reach it, and you have a reason to move it ahead of the normal update cycle.
Three public signals answer three different questions.
| Signal | The question it answers | What it leaves open |
|---|---|---|
| Published CVE count | How many records numbering authorities released | Whether your host runs the affected software |
| CVSS | How severe the issue is if it is reachable and attacked | The order of a queue that contains thousands of high scores |
| CISA Known Exploited Vulnerabilities | Whether exploitation has been observed and catalogued | Issues that are not yet listed, and issues that are not on your stack |
| A test finding with evidence | What was reachable on this host, in this window, reviewed by a person | The rest of the estate, and any host you left out of scope |
The UK National Cyber Security Centre, in its October 2026 note on preparing for a vulnerability patch wave, tells organisations to update the external attack surface first, then work inward, and to be able to ship updates often and at scale. Where a system is out of support and cannot take the update, the same note says replace it or bring it back into support, especially when it faces the outside. That is a week’s plan. A severity sort of the global feed is not.
a16z quotes a fintech CISO: “With a lot of these AI tools, you’re able to find vulnerabilities faster, but you’re not able to patch faster.” In the same survey, 70% want to retest and verify that a fix worked, and 67% want remediation ordered by validated exploitability. Faster discovery, without those two habits, lengthens the backlog. 36,962 is what that backlog looks like at the scale of the whole program.
The same week, GMO Internet’s CEO wrote that his own testers had already flagged a service, that the fix was too slow, and that open-weight models have made attack tools easy to spread. The quotation, and the government request that followed it, is in the note on AI pentests and booked tests.
The count to take into a budget meeting is the number of internet-facing hosts you have not had tested since they last changed. 72,812 is why that shorter list matters.
Where does a penetration test fit?
A test shows what was reachable on one host you name, inside a window you authorize, and it checks the fixes from that report afterward.
If an issue is already on the Known Exploited Vulnerabilities catalog and you can see the affected software on a public host, patch that host. A test is a poor way to rediscover a fact you already have.
The fee earns its place when the question is narrower than the feed. Which of our hosts can someone actually reach? Which finding has evidence a reviewer will believe? Did the fix close the issue in the report? A global count answers none of those. A customer’s security review tends to ask all three.
Observ sells that scope at a fixed price. One host, $3,995, in US dollars. Testing starts within 10 business days of the signed scope. The report follows within 5 business days of testing. Each finding has a location, the evidence, and the fix, and a person on the team reviews it before the report ships. One retest of the findings you have fixed is included if you request it inside 90 days. The retest checks those fixes. It is one pass over that report. We start with written authorization. We turn down requests for exploit code.
The retest is the item 70% of the CISOs in the a16z survey said they want from the tools they are about to buy. The evidence rule is how we decide what counts as a finding. We are one host, not a map of the company. If the estate is the worry, name the host on the internet first. Teams asking whether an AI product should do this job instead can read the note on AI pentests and booked tests. Teams who shipped an agent, rather than a host, can read how to test that agent.
What would we book first?
Book the public host that has changed since the last test, and patch known-exploited issues on it before the window.
For a client who arrives with a CVE spreadsheet, this is the order:
- Name the hosts that answer on the internet. If the list is long, start with the one customers use.
- Patch anything on that host that is already in the Known Exploited Vulnerabilities catalog, or that matches a vendor advisory for software you can show is installed there.
- Book an authorized test of that host when you need evidence for a customer, an auditor, or your own doubt about what is reachable.
- Request the retest after the fixes from that report are deployed.
- Leave the rest of the global feed on the normal update cycle.
A scanner is still the right instrument for “which published records touch software we run.” We do not sell one. The test is the step after the host is known. The offer, the report, and the retest are on the service page.
Questions
Does a higher CVE count mean our systems are less safe?
A published CVE record means a numbering authority released an ID, a description, and a public reference. Your exposure depends on whether that software is on a host you run, whether an attacker can reach it, and whether the issue is being exploited.
Should we patch every critical CVE?
Patch the issues you can show are present on an internet-facing host, and patch anything in your environment that CISA has listed in the Known Exploited Vulnerabilities catalog. A critical score on software you do not run can wait for the normal update cycle.
When is a penetration test the right buy?
When you need evidence of what is reachable on one host you name, under a written scope, with a person reviewing each finding and a retest of the fixes. Patch a known-exploited issue you have already identified on that host before you book the test.
How much does a one-host test cost?
Observ tests one host for $3,995 in US dollars. The fee includes the report, an attestation letter, a debrief, and one retest of the findings you have fixed, if you request it inside 90 days of the report.
Will these CVE totals change?
The CVE Program recalculates the open year when records change status, and it publishes a quarter after that quarter ends. These figures are from the metrics page as read on 29 October 2026. Q4 2026 was still open. We will update this page when we re-read the table.
Sources
- CVE Program metrics, read 29 October 2026. Published records, reserved IDs, and the CNA split.
- The New Security Agenda, Steph Zhang and Owen Colby, a16z, 28 October 2026. Survey of 100 CISOs at companies with more than 1,000 employees. The 70% retest figure, the 67% exploitability figure, and the fintech CISO quotation are theirs.
- Preparing for a vulnerability patch wave, UK National Cyber Security Centre, October 2026.
- Known Exploited Vulnerabilities Catalog, CISA.
Author
Keith Vaughan founded Cipher Projects in Canberra in 2023. Observ is its pentesting service. The counts above are the CVE Program’s. The survey figures are a16z’s. The price, the scope, and the retest are ours.