CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

FIRST Predicts Record 50,000+ CVEs in 2026

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

The Forum of Incident Response and Security Teams (FIRST) forecasts a record-breaking 59,427 new CVEs in 2026, with a 90% confidence interval ranging from 30,012 to 117,673. This prediction is based on a new statistical model using historical CVE data and publication trends. FIRST advises organizations to prepare for this surge by assessing their capacity, prioritizing vulnerabilities, and leveraging forecasting tools. The forecast suggests that CVE disclosures will continue to grow beyond 2026, with a median of 51,018 CVEs in 2027 and 53,289 in 2028.

Timeline

  1. 11.02.2026 13:35 1 articles · 14h ago

    FIRST Predicts Record 50,000+ CVEs in 2026

    FIRST's 2026 Vulnerability Forecast predicts a median of approximately 59,427 new CVEs this year, with a 90% confidence interval ranging from 30,012 to 117,673. The forecast uses a new statistical model that achieved a low error rate in 2025. FIRST advises organizations to prepare for this surge by assessing their capacity, prioritizing vulnerabilities, and leveraging forecasting tools.

    Show sources
    Open in new tab

Information Snippets

  • FIRST's 2026 Vulnerability Forecast predicts a median of approximately 59,427 new CVEs this year.

    First reported: 11.02.2026 13:35
    1 source, 1 article
    Show sources

  • The 90% confidence interval for 2026 CVE disclosures ranges from 30,012 to 117,673.

    First reported: 11.02.2026 13:35
    1 source, 1 article
    Show sources

  • FIRST's new statistical model achieved a 7.48% error rate for yearly predictions in 2025.

    First reported: 11.02.2026 13:35
    1 source, 1 article
    Show sources

  • FIRST recommends organizations assess their capacity to handle 50,000+ CVEs and prioritize vulnerabilities based on specific risks.

    First reported: 11.02.2026 13:35
    1 source, 1 article
    Show sources