The Q1 2026 Exploit Surge: AI Discovers the Flaws, APTs Reap the Rewards

Q1 2026 intelligence from Kaspersky documents a record rise in CVE registrations and exploit activity, including critical logic flaws in AI frameworks (Clawdbot, LangChain, OpenCode), a three-CVE Windows attack chain that bypasses Protected View and MSHTML restrictions, continued use of veteran Office and Linux privilege-escalation exploits, and targeted attacks against enterprise products (BeyondTrust, Apache ActiveMQ, Microsoft SharePoint). The report notes active exploitation and tactical shifts—Metasploit topping C2 usage and attackers favoring authentication-bypass flaws—underscoring an increased risk profile and the urgent need for timely patching.