By Austin Zeizel
Publication Date: 2026-10-15 00:00:00
IBM X-Force observed a substantial increase in publicly disclosed Common Vulnerabilities and Exposures (CVEs) across multiple major software vendors throughout 2026. Across Microsoft, Oracle, Google Chrome and Apache, publicly disclosed CVEs rose from approximately 1,493 between January and September 2025 to more than 10,124 during the same period in 2026—an increase of roughly 578%. While disclosure activity naturally fluctuates over time, the magnitude of this increase warrants closer examination.
The timing of the growth is particularly notable. Vulnerability disclosure volumes remained relatively aligned with historical baselines through the first quarter of 2026 before beginning to accelerate in April. By the summer months, disclosure activity had reached levels significantly higher than those observed during the same period in 2025. Oracle, Microsoft, Google Chrome and Apache each experienced substantial increases, suggesting the trend was not limited to a single…
