Why The Vulnerability Backlog Is About To Get Worse
Recorded Future analysis says AI-driven vulnerability discovery and faster weaponization will grow the triage backlog while shrinking defenders' response windows.
Disclosed vulnerabilities rose from roughly 21,000 in 2021 to nearly 50,000 in 2025, while Recorded Future assessed only 446 as actively exploited in 2025. VulnCheck found nearly 29% of 2025 KEV entries were exploited on or before CVE publication. The authors argue AI-assisted discovery and automated exploit development will multiply credible reports, cut disclosure-to-exploit time toward minutes, and force re-evaluation of medium-severity flaws as exploit-chain components.
- Only ~446 of ~50,000 disclosed 2025 CVEs were assessed as actively exploited in the wild.
- 29% of 2025 KEV vulnerabilities were exploited on or before CVE publication.
- Microsoft's April 2026 Patch Tuesday was its second-largest, with one flaw credited to an Anthropic researcher.
- LLMs reduce exploit development cost, compressing disclosure-to-weaponization windows.
- Vendors
- Recorded FutureMicrosoft
- Products
- Claude
- AI models
- Mythos
From the original article
6 min read at recordedfuture.com
Vulnerabilities are software flaws attackers can use to gain access, run malicious code, escalate privileges, or disrupt operations. However, not every bug becomes a real-world threat: many are hard to reach, difficult to weaponize, or simply not worth an attacker’s time. The total number of disclosed vulnerabilities has increased sharply in recent years, rising from roughly 21,000 in 2021 to nearly 50,000 in 2025.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.