More CVEs, the same exploitable share: what FIRST's 2026 forecasts mean for exposure teams

What did FIRST forecast?

In its 2026 Vulnerability Report, released on 11 February 2026, FIRST projected a median of about 59,427 CVEs for the year, with a 90% confidence interval of 30,012 to 117,673. On 15 June 2026 its mid-year forecast raised the projection to approximately 66,000.

Why did the forecast rise?

FIRST names the drivers: AI-assisted vulnerability discovery, a 449% year-over-year surge in GitHub Security Advisory volume, and a 3,119% increase in VulnCheck CNA-of-Last-Resort activity. These are FIRST's figures from its release.

What did not rise?

FIRST's mid-year release also says: "Actionable exploitability remains flat: when filtered for real-world risk (CISA KEV entries or EPSS scores above 10%) the patching burden has not materially increased." That is the sentence exposure teams should pin up.

What are KEV and EPSS?

The CISA Known Exploited Vulnerabilities catalog lists vulnerabilities with a CVE ID, reliable evidence of active exploitation and a clear remediation action. FIRST's Exploit Prediction Scoring System estimates the probability that a published CVE will be exploited in the next 30 days, as a value from 0 to 1, published daily. CVSS, also from FIRST, scores severity, which is a different question.

What does this mean for tool choice?

• Discovery still matters, because an exploitable vulnerability on an asset you do not know about will not be ranked at all.
• Ranking matters more, because the total list grows while the part that matters does not. Tools that use KEV and EPSS, such as Censys on the pages we read, help here.
• Proof matters most for stretched teams. Validation turns a ranked list into a confirmed one. See exposure validation.

What should you do this quarter?

1. Check that your current tools use KEV and EPSS, not only CVSS, to rank external findings.
2. Measure how many of your open external findings are in KEV or above an EPSS threshold you choose.
3. If that number is small and the backlog is large, your gap is proof and prioritisation, not discovery. The exposure finder will weigh this from your answers.