Report by VulnCheck
VulnCheck State of Exploitation 1H-2026
Key Findings
Roughly 200 CVEs reached KEV within 31 days of publication in the first half of 2026.
In the first half of 2026, Content Management Systems (CMS) accounted for one-third of all KEVs added.
Across Anthropic and Berkeley datasets, 1,061 vulnerabilities were attributed to AI-assisted discovery.
Of 1,061 vulnerabilities attributed to AI-assisted discovery, 14 (1.3%) were confirmed as exploited in the wild.
The KEV-to-CVE ratio peaked at 2.7% in the second half of 2023 and fell to 1.4% in the first half of 2026.
The first half of 2026 saw a 10% increase in KEVs compared to the prior six months while CVE volume grew 45% over the same comparison period.
The median time from CVE publication to KEV fell from 120 days in 2025 to 80 days in the first half of 2026.
In 2025, 28.93% of Known Exploited Vulnerabilities (KEVs) showed evidence of exploitation on or before the day the CVE is published. In contrast, in the first half of 2026, 23.43% of Known Exploited Vulnerabilities (KEVs) showed evidence of exploitation on or before the day the CVE is published.