Software vulnerability reporting has risen sharply, but the available figures do not establish that AI caused the increase or that more flaws were created. The National Institute of Standards and Technology (NIST) says CVE submissions rose 263% between 2020 and 2025. That is a documented increase in submissions—not proof of an AI-driven surge in newly discovered or newly created vulnerabilities.
What the reported increase actually measures
A CVE is an identifier and public record for a disclosed cybersecurity vulnerability. The CVE Program’s mission is to “identify, define, and catalog publicly disclosed cybersecurity vulnerabilities.” Records are published by participating CVE Numbering Authorities. A CVE submission, a published CVE record, an NVD-enriched record and a newly discovered flaw are related but distinct things.
As an Amazon Associate I earn from qualifying purchases.
NIST’s April 15, 2026 announcement says CVE submissions increased 263% between 2020 and 2025. It also says submissions in the first three months of 2026 were nearly one-third higher than in the same period of 2025. Those figures show a substantial increase in reporting workload; they do not identify how the vulnerabilities were found or establish when the flaws originated. NIST’s announcement attributes the operational change it describes to this submission growth.
Why the headline’s CVE total needs qualification
A September 21, 2026 article in The Tech Edvocate states that 66,401 CVEs were registered “in the past year” and links the increase to AI vulnerability-discovery tools. The official figures available for comparison do not confirm that number as an annual total or establish the proposed cause.
#1 Best Overall
The CVE Program’s live metrics page displayed 70,729 published records for 2025 and 54,694 for 2026 in its snapshot accessed October 4, 2026. These are published-record counts, not submission counts; the 2026 number is year to date, not a full-year total. The page notes that totals can be recalculated as record statuses change. Because the measures and time windows differ, these numbers should not be treated as a direct confirmation or contradiction of the article’s “past year” figure. The CVE Program metrics page describes its record measures.
Does AI create vulnerabilities or help find them?
AI-assisted tools can be part of vulnerability discovery, but the rising submission figures cited by NIST do not say whether a submission came from AI, manual review, automated testing or another route. The reviewed official material does not demonstrate that AI caused the reported growth, nor does it quantify whether attackers or defenders gain an advantage from AI-assisted discovery.
There is also a separate question: when should a weakness involving AI itself receive a CVE? CVE Program guidance says a vulnerability in a particular implementation may qualify when there is a secure way to use the affected functionality. Some risks that are inherent to models more broadly may be better addressed through other initiatives. A concern involving AI is therefore not automatically a CVE, and an increase in CVE records is not, by itself, a measure of AI risk. The CVE Program’s AI-related vulnerability guidance explains this distinction.
What NIST’s NVD change means for security teams
Since April 15, 2026, NIST has prioritized NVD enrichment for CVEs in CISA’s Known Exploited Vulnerabilities catalog, software used by the federal government, and critical software. NIST says all submitted CVEs will still be added to the National Vulnerability Database (NVD), but lower-priority records may not receive enrichment immediately. That means a record’s presence in NVD and the timing or depth of its enrichment are not the same thing.
For organizations, the practical implication is to assess vulnerabilities by exposure and risk rather than treating every new record as equally urgent—or assuming that a record without immediate enrichment is harmless.
Build a workable prioritization process
- Identify affected assets. Match vulnerability records to the software and versions actually deployed, including internet-facing systems and critical business services.
- Check exploitation and context. Give known exploitation and the importance of the affected system weight in triage; do not rely on record volume alone.
- Plan remediation and track exceptions. Assign owners and deadlines, apply mitigations where a fix is not immediately available, and document accepted risk.
- Use multiple signals. NVD enrichment can help, but security teams should also consult relevant vendor advisories and their own asset and exposure data.
What can—and cannot—be concluded
The supported conclusion is that CVE submissions have grown substantially and NIST has adjusted NVD enrichment to prioritize higher-risk records. The figures do not show that AI created more software flaws, caused the increase in reporting, or produced a quantified shift in the contest between attackers and defenders. AI-assisted discovery is a relevant possibility, but the reported growth alone cannot prove it.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
