Rapid7’s Q2 2026 threat report says high- and critical-severity CVE disclosures doubled year over year to 8,539, while newly exploited flaws rose only 8% to 40. The firm says AI is helping flood defenders with more findings, faster proof-of-concept code, and earlier exploitation testing, widening the gap between what is disclosed and what teams can actually handle.
The mechanism is triage, not raw patching: an attacker can only use a flaw that is reachable, and Rapid7 says the same severity score can hide very different real-world exposure. That leaves security teams spending time on high-rated issues that are boxed in by defenses while internet-facing or unauthenticated systems stay in play.
For exposure-management programs, the lasting shift is that disclosure volume no longer tracks attacker progress. If your queue is still driven mainly by severity, the bottleneck is deciding what an attacker can reach first, and that gap is likely to grow as AI keeps accelerating both sides of the cycle.