2026 Supply Chain Vulnerability Report

Attackers exploited vulnerabilities an average of seven days before public disclosure in 2025.

More than 48,000 CVEs were published in 2025, an 18% increase year-over-year.

2,130 AI-related vulnerabilities were reported in 2025, a more than 200% increase since 2023.

Of the 48,000+ CVEs published in 2025, only 58 represented a genuine, discoverable, and exploitable threat to enterprise supply chains.