AI Drives 2026 Vulnerability Forecast to 66K CVEs, But Risk Stays Flat

FIRST's 2026 vulnerability forecast predicts a sharp rise to roughly 66,000 CVEs driven primarily by autonomous AI bug-hunting and expanded curation, yet finds that only about 6.5% of those entries show high exploitability (CISA KEV or EPSS > 10%), so true operational risk remains limited. The report calls out human verification and patching capacity as the real bottleneck, warns of new blind spots from ephemeral AI-generated software, and recommends defenders prioritize exploitability overlays, defensive AI tooling, and dynamic cataloging to manage the increased workload.