CVEs have spiked 10x since March Says Tuukka Tiainen Of Recast Software
Recast tracks CVE disclosures for third-party applications through its Setup Store catalog. Since March 2026, the number of unique CVEs registered each month has climbed from roughly 150-200 to more than 60,000 in June alone. This trend lines up with major software vendors (Chromium, Firefox among them) adopting AI-assisted vulnerability testing.
Tuukka Tiainen serves as Senior Security Engineer at Recast Software, bringing over a decade of experience in IT and information security. His expertise spans technical security as well as governance, risk, and compliance. Passionate about threat and vulnerability management, Tuukka also brings deep knowledge of Microsoft’s security solutions.
This trend is driven by the industry with the assumption that with the expended usage of the AI tools, vendors can test more and catch more vulnerabilities in their software.
I can only talk about what I’ve seen during the time I have reviewed the monthly statistics (since May 2024). It is visibly clear that something has changed in the number of unique vulnerabilities patched by vendors this year. You can see those spikes starting to grow in March this year.
Browsers: Chromium and Firefox have dominated the vulnerabilities number wise for the last three months. Both Mozilla and Google are participating in Project Glasswing, giving them access to Anthropic’s frontier AI model. Firefox is evidence that harnessing Claude Mythos in their pipelines has greatly increased the number of security bugs found. See the blog written by their Tech Lead and Principal Engineer.
Microsoft and Google haven’t disclosed similar information about the findings to public but at least Microsoft has admitted publicly that they use Mythos. There’s a pretty strong assumption that the reason is the same for them resulting in more patched vulnerabilities in the last few months. I think that the Project Glasswing is just the first wave. Once the model and other frontier models get into the hands of more software vendors it will result in even more vulnerabilities to be patched.
What are the operational or security implications? What should organizations be doing differently as a result?
By following the same narrative, organizations using the 3rd party software should have more vulnerabilities to deal with. I would even claim that the number of exploits will grow because AI has become so much better in autonomously discovering weaknesses and chaining multiple lower-severity issues into exploits. In the worst-case scenario there will be more of everything: vulnerabilities, software versions (patches), out-of-band patches, exploits and zero-day vulnerabilities.
Another big aspect of this is the patch gap possibly becoming the most important vulnerability management metric. The “patch gap” is the time between a security patch becoming available and it being installed on your systems. The industry has traditionally focused on zero-days, but the patch gap may become an equally important security challenge. If AI can help attackers quickly reverse engineer patches and understand the vulnerabilities they fix, the window between a patch being released and an exploit becoming available could shrink dramatically. In that world, the greatest risk is not necessarily the vulnerability no one knows about, but the one everyone knows about and hasn’t patched yet. If this is the case, patch management vendors need to help to minimize the time between a software vendor releasing a patch, making it available for the customers and customers actually applying the patch on their systems.
If organizations need to patch more and faster, it might become a heavy burden for IT and security. I think this is one of the reasons why, for example, CISA is driving its new initiative for patching. Check out Patch Smarter, Not Harder. I also wrote a blogover a year ago how to patch smarter based on other factors than just the good old CVSS.
According to CISA, only the most critical vulnerabilities should be patched within three days. It is up to organizations to come up with their own processes, but it will be even more important to be able to prioritize in the future. Organizations should also play with the idea that they must be able to effectively patch a vulnerability within three days. How does that change the existing practices and models?
A brief explanation of where the data came from, how it was collected, what timeframe it covers, and approximately how many applications/CVEs were analyzed.
The vendors report CVEs when a new version is published. Sometimes this information is added later (a few days). We (Recast) scan those resources and as soon as the CVE data is available, it is added to the Setup Store. We are collecting the data about the applications stored in the catalog. The trend started to take a clear shape from March 2026 on.
Are all these applications in Setup Store? Just third-party apps? Enterprise apps? Does the data include severity (Critical/High/etc.)?
This is related only to the applications stored in the Setup Store, so the scale in the market is larger. Those are 3rd party applications that were eligible to be added to the catalog. The data does not include the severity.
What is the biggest or most surprising trend?
It’s not that it’s surprising but rather expected. It is confirmation of the global security changes written in the data and that AI tools are used extensively and vendors are focusing on improving.
Here’s some raw data in graph form for your viewing pleasure:
This entry was posted on August 19, 2026 at 9:15 am and is filed under Commentary with tags Recast. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
CVEs have spiked 10x since March Says Tuukka Tiainen Of Recast Software
Recast tracks CVE disclosures for third-party applications through its Setup Store catalog. Since March 2026, the number of unique CVEs registered each month has climbed from roughly 150-200 to more than 60,000 in June alone. This trend lines up with major software vendors (Chromium, Firefox among them) adopting AI-assisted vulnerability testing.
Tuukka Tiainen serves as Senior Security Engineer at Recast Software, bringing over a decade of experience in IT and information security. His expertise spans technical security as well as governance, risk, and compliance. Passionate about threat and vulnerability management, Tuukka also brings deep knowledge of Microsoft’s security solutions.
His Bio is here and here is his LinkedIn profile: .
What’s driving the trend?
This trend is driven by the industry with the assumption that with the expended usage of the AI tools, vendors can test more and catch more vulnerabilities in their software.
I can only talk about what I’ve seen during the time I have reviewed the monthly statistics (since May 2024). It is visibly clear that something has changed in the number of unique vulnerabilities patched by vendors this year. You can see those spikes starting to grow in March this year.
Browsers: Chromium and Firefox have dominated the vulnerabilities number wise for the last three months. Both Mozilla and Google are participating in Project Glasswing, giving them access to Anthropic’s frontier AI model. Firefox is evidence that harnessing Claude Mythos in their pipelines has greatly increased the number of security bugs found. See the blog written by their Tech Lead and Principal Engineer.
Microsoft and Google haven’t disclosed similar information about the findings to public but at least Microsoft has admitted publicly that they use Mythos. There’s a pretty strong assumption that the reason is the same for them resulting in more patched vulnerabilities in the last few months. I think that the Project Glasswing is just the first wave. Once the model and other frontier models get into the hands of more software vendors it will result in even more vulnerabilities to be patched.
What are the operational or security implications? What should organizations be doing differently as a result?
By following the same narrative, organizations using the 3rd party software should have more vulnerabilities to deal with. I would even claim that the number of exploits will grow because AI has become so much better in autonomously discovering weaknesses and chaining multiple lower-severity issues into exploits. In the worst-case scenario there will be more of everything: vulnerabilities, software versions (patches), out-of-band patches, exploits and zero-day vulnerabilities.
Another big aspect of this is the patch gap possibly becoming the most important vulnerability management metric. The “patch gap” is the time between a security patch becoming available and it being installed on your systems. The industry has traditionally focused on zero-days, but the patch gap may become an equally important security challenge. If AI can help attackers quickly reverse engineer patches and understand the vulnerabilities they fix, the window between a patch being released and an exploit becoming available could shrink dramatically. In that world, the greatest risk is not necessarily the vulnerability no one knows about, but the one everyone knows about and hasn’t patched yet. If this is the case, patch management vendors need to help to minimize the time between a software vendor releasing a patch, making it available for the customers and customers actually applying the patch on their systems.
If organizations need to patch more and faster, it might become a heavy burden for IT and security. I think this is one of the reasons why, for example, CISA is driving its new initiative for patching. Check out Patch Smarter, Not Harder. I also wrote a blog over a year ago how to patch smarter based on other factors than just the good old CVSS.
According to CISA, only the most critical vulnerabilities should be patched within three days. It is up to organizations to come up with their own processes, but it will be even more important to be able to prioritize in the future. Organizations should also play with the idea that they must be able to effectively patch a vulnerability within three days. How does that change the existing practices and models?
A brief explanation of where the data came from, how it was collected, what timeframe it covers, and approximately how many applications/CVEs were analyzed.
The vendors report CVEs when a new version is published. Sometimes this information is added later (a few days). We (Recast) scan those resources and as soon as the CVE data is available, it is added to the Setup Store. We are collecting the data about the applications stored in the catalog. The trend started to take a clear shape from March 2026 on.
Are all these applications in Setup Store? Just third-party apps? Enterprise apps? Does the data include severity (Critical/High/etc.)?
This is related only to the applications stored in the Setup Store, so the scale in the market is larger. Those are 3rd party applications that were eligible to be added to the catalog. The data does not include the severity.
What is the biggest or most surprising trend?
It’s not that it’s surprising but rather expected. It is confirmation of the global security changes written in the data and that AI tools are used extensively and vendors are focusing on improving.
Here’s some raw data in graph form for your viewing pleasure:
Share this:
Like this:
Related
This entry was posted on August 19, 2026 at 9:15 am and is filed under Commentary with tags Recast. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.