Hackers are increasingly exploiting vulnerabilities at an unprecedented speed, with nearly one in four flaws being abused before or on the same day they are publicly disclosed, according to VulnCheck’s State of Exploitation report for the first half of 2026, published on July 28, 2026.
VulnCheck identified 495 Known Exploited Vulnerabilities (KEVs) in the first half of 2026. Of these, 23.43% showed evidence of exploitation on or before the date of their Common Vulnerabilities and Exposures (CVE) disclosure.
While this figure is slightly lower than 2025’s rate of 28.93%, it still indicates a significant acceleration in the overall pace of exploitation. The median time between CVE publication and active exploitation has decreased from 120 days in 2025 to just 80 days in 2026.
This suggests that threat actors are operationalizing vulnerabilities more quickly, even if pre-disclosure exploitation has marginally declined.
Hackers Exploit Nearly 1 in 4 Vulnerabilities
Early-stage exploitation remains consistent, with approximately 200 CVEs being exploited within 31 days of disclosure, similar to previous years. However, due to a sharp increase in total CVE volume, this number represents a smaller overall proportion.
The report highlights a growing gap between vulnerability disclosure and exploitation rates. The volume of CVEs surged by 45% in the first half of 2026, while the number of KEVs increased by only 10%, reducing the KEV-to-CVE ratio to 1.4%, down from a peak of 2.7% in 2023.
This suggests that while more vulnerabilities are being discovered, partly due to automation and AI-assisted research, not all of them are immediately weaponized. However, exploitation often lags behind disclosure, meaning current figures may evolve.
Content Management Systems (CMS) emerged as the most targeted technology category, accounting for roughly one-third of all KEVs.
Vulnerabilities in WordPress plugins, as well as in platforms like Drupal and Ghost, were heavily exploited, reflecting recent large-scale campaigns flagged by global cybersecurity agencies.
Network edge devices also remained prime targets, with vulnerabilities affecting vendors such as Cisco, Palo Alto, Fortinet, and Juniper. These systems continue to provide attackers with crucial entry points into enterprise environments.
Additionally, security tools, developer platforms, and device management systems were exploited at faster rates due to their privileged access and widespread deployment.
Despite growing concerns, AI-assisted vulnerability discovery has not yet led to a higher rate of exploitation. Of the 1,061 vulnerabilities attributed to AI-driven discovery, only 14 (1.3%) were confirmed to have been exploited, closely matching the overall exploitation rate.
However, AI technologies themselves are becoming targets. Exploited systems include model-building platforms, AI gateways, and workflow automation tools.
In one observed case, attackers leveraged vulnerabilities in LangFlow (CVE-2026-0769 and CVE-2026-5027) to gain access, harvest credentials, deploy cryptominers, and attempt lateral movement.
Anthropic’s Project Glasswing, which reported over 23,000 findings, has thus far resulted in only 126 CVEs, with just one confirmed to have been exploited in the wild, raising questions about the current real-world impact of AI-driven discovery.
These findings emphasize the need for rapid patching and risk-based prioritization. CISA’s Binding Operational Directive 26-04 recommends remediation within as little as three days for vulnerabilities that are known to be exploited, have a high impact, or are publicly exposed.
While AI is expanding the vulnerability landscape, current data suggests that its role is increasing the volume of discoveries rather than amplifying immediate risks. For defenders, this creates a critical window to identify and remediate flaws before adversaries can take action.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
