CVE Volume Jumps 49%, Vulnerability Validation Takes Priority

A flood of new vulnerability identifiers is forcing security teams to put vulnerability validation at the center of how they decide what to fix first. In the first half of 2026, 35,853 CVEs were published, roughly 49% more than in the year before, according to a contributed security article by Picus Security published on The Hacker News. During that same period, only 495 of those CVEs were catalogued as exploited in the wild, and 116 were already under attack on the day their public identifiers appeared. The figures, presented by Picus Security researcher Sila Ozeren Hacioglu, describe a widening gap between the speed and scale of vulnerability discovery and the far smaller set of flaws that attackers actually use. Anthropic's disclosure data underlines the scale problem: its Mythos-class artificial intelligence (AI) models surfaced 26,153 vulnerability candidates in open-source software, while only 421 of those candidates received upstream patches.

The Common Vulnerability Scoring System, or CVSS, gives each CVE a severity baseline, but it cannot tell an organization what the flaw means in its own environment. The same CVE can appear on hundreds of assets, yet its impact is rarely equal because some instances are unreachable, some sit behind controls that interrupt the techniques an attacker would need, and others reside on business-critical systems where an intrusion would be severe. That is why defenders need evidence from their own systems to determine three things: whether the exposure is actually exploitable, which assets it affects, and whether those assets are reachable and important to the business. A High or Critical CVSS score by itself is not an emergency order. Treating every such rating as urgent is not only impossible when thousands of CVEs arrive each year; it is also the wrong model for prioritization.

Automated penetration testing, commonly called automated pentesting, provides some of the strongest evidence available because it can run real exploits, prove that an exposure is exploitable in a live environment, and chain vulnerabilities, credentials, and misconfigurations into attack paths that show how far an attacker could progress. But its coverage remains limited in practice. Omdia research found that although 95% of organizations rank pentesting as a top or high priority, only 32% of their average attack surface is tested each year. Agentic and automated approaches can expand that coverage, but they do not remove every constraint of live exploitation. For CVE-based exploitation, a working exploit must exist, and the target must be safe to test. Newly disclosed CVEs may have no working exploit yet, while business-critical, restricted, and air-gapped assets often cannot be tested with a live exploit at all. Those exposures still need an exploitability verdict, even when there is nothing an automated pentest can safely run.

Picus argues that the answer is to combine three validation methods and let them feed a single decision process. Exploitability validation determines whether an exposure is actually exploitable in your environment, including CVEs with no working exploit and assets that live exploitation cannot safely reach. Security control validation tests whether your prevention and detection controls actually block, detect, or miss the attack. Agentic pentesting safely runs real exploits and chains exposures to show how far an attacker can progress through your specific environment. These methods answer different questions under different exposure conditions, and Picus says Mythos readiness requires all three capabilities in one platform. That does not mean every exposure must go through all three methods; the goal is to apply each method where it fits best and let the evidence contribute to the same decision process. When the three pieces operate as one program, a finding can trigger the validation step it actually needs, new evidence can change remediation priority, and fixes can be re-validated instead of disappearing into a closed ticket. Gartner's May research note points in the same direction, toward validated attack paths, decision-driven response, and exposure reduction integrated into operational workflows.

For website owners and smaller IT teams, the practical lesson is not to ignore vulnerability alerts but to treat severity as a starting point rather than an emergency order. A high-score CVE in a plugin you do not use, on an asset that is not internet-facing, should not trigger the same response as a flaw in a core component that is actively being exploited. Checking whether a working exploit exists, whether your control stack would block the attack, and whether the affected system is actually reachable are all validation steps that can be done before emergency maintenance. This is especially relevant for managed hosting customers, who often rely on their provider to separate which known flaws apply to their site and which do not.

Picus will demonstrate this working model at its Validation Summit on October 14 and 15. The event opens with Mikko Hyppönen explaining why this shift is different from past ones. Picus CTO Volkan Ertürk will then lay out what security validation needs to look like when attackers are powering their attacks with AI, and why exploitability validation, security control validation, and agentic pentesting work better together than on their own. The Picus team will show a live validation workflow with a newly disclosed vulnerability: it starts with no patch and no working exploit, moves through validation before a proof of concept exists, tests the exploit against live controls once it appears, and then re-validates after the fix. Security leaders from Chanel, Atlassian, and the NFL will discuss how mature security teams are adapting their validation programs, what they have changed, and the successes and failures they have experienced. For teams that do not run a full validation program in house, a security-first IT and consulting partner such as AEU-I can help review security priorities and decide which exposures deserve attention first.