Oracle’s July security update fixed 1,449 vulnerabilities. A year earlier, the same quarterly update addressed 309. Microsoft disclosed 642 vulnerabilities in July, nearly five times the total for the same month last year. Google’s Chrome team patched 433 flaws in a single recent update, 401 of them found by its own researchers.
The numbers, compiled from company security bulletins and the U.S. National Vulnerability Database, describe a shift that security executives say has been building for two years and arrived in force this year. Artificial-intelligence tools are making it easier for security teams to find flaws in their own software and in the software they buy, and the result is a flood of disclosures that is remaking how the industry measures risk.
The NVD has recorded more than 45,000 software vulnerabilities so far in 2026, according to data released July 28. That figure is close to the full-year total for 2025, and at the current pace the final count for 2026 could reach roughly twice last year’s number. The database, run by the U.S. Commerce Department’s National Institute of Standards and Technology, has been the reference point for vulnerability tracking since the 1990s, and its acceleration is being watched by chief information security officers across the Fortune 500 as a proxy for the overall state of software risk.
Security firms point to the same cause: AI-assisted code analysis has collapsed the time required to hunt for defects. What once took a team of specialists weeks now takes an automated tool hours. The tools are not just scanning for known patterns. Modern systems generate candidate code paths, simulate attacks against them and flag suspicious behavior in ways that earlier static analyzers could not. “The discovery rate has reached levels we previously considered unattainable,” said one executive at a major security vendor, echoing comments made by several firms this month.
The disclosure surge is a double-edged development for the software industry. On one side, more findings mean more fixes, and the companies doing the fixing are often the same ones writing the code. Microsoft’s July total, for example, includes a large share of issues found through its own internal AI-assisted review programs, and Chrome’s 401 internally discovered flaws suggest Google’s tooling is finding problems before outsiders do. On the other side, the sheer volume is straining patch-management teams at enterprises that must now triage hundreds of advisories per month rather than dozens.
Oracle’s jump from 309 to 1,449 vulnerabilities in a year illustrates the magnitude. The company’s products span databases, middleware and enterprise applications, making its patch cadence a regular event for corporate IT departments. Security analysts said the increase reflects both broader AI-driven discovery and Oracle’s expanding product surface, and they cautioned that raw counts do not equal exploitability. Most disclosed vulnerabilities are never actively exploited, and severity ratings matter more than totals.
Still, the trend has consequences for procurement. Enterprises are beginning to ask vendors how many vulnerabilities their own AI tools found in the previous quarter, treating the number as a signal of internal security investment. Regulators are also paying attention. The European Union’s Cyber Resilience Act, which takes full effect next year, will require manufacturers to track and disclose vulnerabilities in connected products on an ongoing basis, a regime that assumes exactly the kind of continuous monitoring AI tools now provide.
The market has responded. Shares of companies selling AI-powered code review and security scanning tools have outperformed the broader software sector this year, and venture funding for the category has accelerated, according to industry trackers. Incumbent vendors are racing to bundle AI discovery features into their existing platforms, and the major cloud providers have begun offering automated vulnerability triage as a standard service.
Not everyone is convinced the flood of disclosures represents progress. Some security researchers argue that automated tools generate false positives at scale, and that the real bottleneck has moved from discovery to remediation. A vulnerability that is disclosed but never patched is risk that has merely been catalogued, they point out. The backlog problem is real: enterprises are already reporting that their average time-to-patch has lengthened even as their patch volumes have grown.
The debate matters because the numbers keep climbing. At the current rate, the NVD will pass 100,000 vulnerabilities for the first time in a single year, a threshold that would have seemed implausible when the database was created. For security teams, the AI era has changed the arithmetic of their jobs: finding the flaw is no longer the hard part. Deciding which ones to fix, and convincing executives to fund the fixes, is where the work now begins.
The rise in disclosures is also reshaping the security workforce. Companies are hiring fewer manual penetration testers and more analysts who can direct AI tools, and universities report that security courses now teach prompt-driven code analysis alongside traditional methods. The skills shortage that defined the industry for a decade is giving way to a different problem: retraining the workers who ran the old tools.
