On October 13, 2026, Microsoft published 1,408 new Common Vulnerabilities and Exposures (CVEs). This number surpasses the total of 1,244 CVEs that Microsoft disclosed throughout the entire year of 2025.
The CVE Program has recorded a total of 79,680 CVEs in 2026 up to the same date, indicating a significant volume of vulnerabilities being documented this year.
Among the newly published CVEs by Microsoft, one has been reported as exploited.
The Cybersecurity and Infrastructure Security Agency (CISA) has also been active, adding 255 CVEs to its Known Exploited Vulnerabilities catalog from January 1 to October 8, 2026.
Malicious packages accounted for most open source zero-days in 2026, with over 20 high-profile attacks.
The State of AI Security study has noted the presence of 43,175 AI-related service instances across 25 industries.