Sep 30, 2026
Google's threat intelligence group reports CVE disclosures doubled in 2026 and profiles likely AI-discovered vulnerabilities
Google Threat Intelligence Group (GTIG) reports that monthly CVE disclosures rose from 5,045 in January 2026 to 10,477 in July and 10,740 in August, and that exploited vulnerabilities averaged 18 per month from January to August 2026 against 10.5 per month in 2025. GTIG says zero-day exploitation rose only marginally and suggests rapid weaponization of n-days drove most of the growth, and that vulnerabilities it identified as likely AI-discovered skew toward Medium risk ratings and remote code execution. It also counts 2,076 cumulative AI-related CVEs (January 2025 to August 2026) and reports in-the-wild exploitation of a handful, including a flaw in LiteLLM's MCP server preview endpoints.