IBM X-Force logs 578% surge in disclosed CVEs

IBM X-Force's data shows vulnerability disclosure volumes stayed near historical baselines through the first quarter of 2026 before accelerating sharply in April and continuing through the summer. The pattern held across all four vendors tracked—Microsoft, Oracle, Google Chrome and Apache—which IBM says suggests the trend is not limited to a single product category or software ecosystem.

The timing coincides with broader adoption of frontier AI models for vulnerability discovery. Unit 42's August 2026 report on its NOVA platform, which found more than 14,000 previously undiscovered vulnerabilities across nearly 4,000 open-source projects in two months, illustrates the scale AI-assisted research can reach. IBM explicitly notes the data does not establish a direct causal link between AI-assisted research and the disclosure surge, but says the timing and scale raise that possibility.

For defenders, IBM frames the shift as one from discovery to prioritization. Its analysis of 223 AI-attributed vulnerabilities found most were serious and remotely accessible, meaning the operational burden is not just volume but severity. IBM recommends risk-based prioritization, faster patching, continuous visibility into internet-facing assets and compensating controls such as virtual patching where immediate fixes are not feasible.