As the number of disclosed vulnerabilities keeps growing, maintenance staff can no longer keep up with either "applying everything right away" or "applying everything together once a month." They need a basis for deciding which patches to apply today and which to defer to the next scheduled update.
On September 30, 2026, Google Threat Intelligence Group (GTIG) published a report analyzing vulnerabilities disclosed from January 2025 through August 2026 and their actual exploitation. It shows that while the number of disclosures roughly doubled in a little over six months, the share confirmed as exploited was tiny, and that edge devices have become the main entry point for intrusions.
In this article, we review the figures in the report and then lay out an approach to setting patch priorities in day-to-day maintenance. All figures come from GTIG's report, and the risk ratings are GTIG's own ratings, not CVSS.
Disclosures doubled, exploitation about 0.23%
The main figures in the report are as follows.
- Number of disclosures: Rose from 5,045 in January 2026 to 10,477 in July and 10,740 in August
- Number exploited: Vulnerabilities confirmed as exploited went from a monthly average of 10.5 in 2025 to a monthly average of 18 in January to August 2026. The total of 141 for January to August exceeded the full-year 2025 figure (127)
- Exploitation rate: Of the vulnerabilities disclosed in 2026, 0.23% (about 1 in 431) were confirmed as exploited
- Zero-days: From a monthly average of 8 in 2025 to a monthly average of 11 in 2026. August saw 22. Of the exploited vulnerabilities, 62% were zero-days
The report also urges caution in reading the growth in numbers itself. For example, there were about 5,000 vulnerabilities with "Linux Kernel" in their descriptions in January to August 2026 alone, but 0 zero-days confirmed as exploited. In other words, in some areas the numbers are inflated by how identifiers are assigned.
If you look only at the number of disclosures and "rush everything," the items that truly need urgent attention get buried. The report also calls for moving away from applying patches uniformly without prioritization toward triage based on threat intelligence.
Edge devices as the entry point for intrusions
According to the report, of the vulnerabilities exploited in January to August 2026, 14% involved edge devices and security appliances ("Edge and Security Appliances" in the report's classification), and 11% involved directory and collaboration platforms ("Enterprise Directory & Collaboration hubs" in the same classification). More than 65% of the vulnerabilities exploited in edge devices were rated High or above by GTIG, and the report explains that management interfaces reachable without authentication are being targeted.
The growth in zero-days is small, and the report sees the main source of the rise in exploitation as the quick weaponization of already disclosed vulnerabilities (n-days). One example with a short gap between disclosure and exploitation is CVE-2026-1731, a vulnerability in BeyondTrust Privileged Remote Access and Remote Support. The report cites it as an example of a vulnerability found by an AI agent that was actually exploited: within 4 days of disclosure one threat actor group was exploiting it, and within 7 days five more groups were. Our response to a separate vulnerability in the same company's products disclosed in October is covered in BeyondTrust Remote Support zero-day: what to check after patching.
Vulnerabilities found by AI, and vulnerabilities in AI infrastructure
The report also covers two AI-related changes.
The first is the nature of vulnerabilities found with AI assistance. Among those GTIG could determine were found by AI, half (50%) could lead to remote code execution, far above the share across all vulnerabilities (26%). The report also notes that AI-driven discoveries may be undercounted in public data.
The second is vulnerabilities in the infrastructure that runs AI itself. GTIG tracked 2,076 AI-related vulnerabilities from January 2025 through August 2026, of which more than 1,500 were disclosed in January to August 2026. Half were in components for building agents and workflows, such as Dify, Langflow, and LangChain, which grew 347% in 2026. Model-serving infrastructure such as vLLM, Ollama, and LiteLLM had 212 in 2026, and about a quarter of them (24%) stemmed from unauthenticated APIs or vulnerabilities that let attackers make the server send requests to other destinations (SSRF).
Although zero-day exploitation of AI infrastructure has not yet been confirmed, post-disclosure exploitation has begun, and the report cites examples in LiteLLM (CVE-2026-42271) and Langflow (CVE-2026-5027, CVE-2025-3248). If you have placed AI workflows or gateways built for internal use somewhere reachable from the outside, they need to be treated the same as edge devices. The design and caveats of a gateway that centralizes model API keys in one place are laid out in Should you put a gateway in front of your internal AI?.
How to set priorities in day-to-day maintenance
From here on is the editorial team's proposal. Based on the figures in the report, we have divided a way of setting priorities for maintaining small business systems and websites into three tiers, as in the diagram above.
- Externally reachable systems: Devices such as VPNs, firewalls, and remote support tools, management interfaces, and externally exposed AI workflows and gateways. Apply patches for vulnerabilities confirmed as exploited without waiting for the scheduled update. The report sees edge devices as the main entry point for intrusions
- Important internal systems: Internal servers, business systems, and directories. Rely on scheduled updates as the baseline, but move patching forward for anything with confirmed exploitation
- Everything else: Most components on endpoints and systems not reachable from the outside. Apply patches together in scheduled updates
To assign tiers, you first need a list of "externally reachable systems." If you do not know which devices and services are reachable from the internet and where their management interfaces are exposed, you cannot decide what belongs in tier 1. As a source of information on confirmed exploitation, one option is to use a public list such as the Known Exploited Vulnerabilities (KEV) catalog published by the US CISA. Mandiant, which like GTIG is part of Google, also lists using KEV as information on actual exploitation for prioritizing findings in its guidance on protecting development infrastructure.
If you build this order into maintenance contracts or operating procedures, you need to decide in advance "within how many hours tier 1 patches are applied" and "who decides and who applies them." The points to review in maintenance contracts are laid out in Monthly patching no longer holds up: 4 things to rewrite in maintenance contracts.
The report also recommends that software and service providers run AI-based code scanning in-house before shipping, to fix issues before they become vulnerabilities. For companies that build systems or websites and provide them to others, and for companies that outsource development, this is material to build into acceptance criteria.
Scope of verification
On October 28, 2026, we reviewed GTIG's report "Vulnerability Discovery and Exploitation Trends in the AI Era" (September 30, 2026) published on the Google Cloud Blog, and, for its reference to KEV, Mandiant's guidance "Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure" (September 24, 2026) (desk research). On October 29, 2026, we rechecked the report's figures against the original and also reviewed CISA's public KEV data (JSON, October 28 version). All figures are as stated in GTIG's report; the editorial team has not reviewed the underlying data. The report's risk ratings are GTIG's own and differ from CVSS severity. The three-tier division is the editorial team's proposal based on the report's figures, not a procedure presented in the report.
To review your system or website maintenance setup or patch operations, please contact us through development, AI, and automation consulting.
