Cybersecurity Vulnerability Disclosures Reach Record High as AI Speeds Discovery

The number of publicly disclosed cybersecurity vulnerabilities reached a record high in 2025 and continued increasing rapidly in the first half of 2026, according to data cited by Kyodo News.

A record number of software vulnerabilities has heightened concerns about cybersecurity, reinforcing the need for timely patches and stronger protection against unauthorized access. [Photo: MITRE]

The trend comes as artificial intelligence helps researchers and attackers identify software weaknesses more quickly.

MITRE, a US-based nonprofit organization that operates the Common Vulnerabilities and Exposures (CVE) program, recorded more than 48,000 cases in 2025, approximately 2.4 times the number recorded in 2021, according to the report. More than 35,000 additional cases had been registered by June 2026.

The figures highlight the growing volume of publicly documented software vulnerabilities and the pressure on organizations to identify affected systems and address security weaknesses promptly.

The increase comes as Japanese companies report a series of unauthorized system intrusions and information leaks.

Among the affected services was Times Car, a car-sharing business that disclosed a breach involving information associated with millions of member accounts.

The Japanese government has urged businesses and public institutions to strengthen cybersecurity measures as attacks become more frequent and sophisticated.

When software vulnerabilities are discovered, developers may release patches that correct the underlying weaknesses.

Organizations must identify whether their systems are affected and apply relevant updates promptly to reduce the risk of exploitation.

Delays can leave systems exposed to unauthorized access, data theft or other malicious activity, particularly when attackers begin exploiting a known vulnerability before organizations have installed a fix.

MITRE helps coordinate and publish information about vulnerabilities through the CVE program, providing standardized identifiers that software vendors, security researchers and IT teams can use to discuss and address specific flaws.

The number of published vulnerabilities rose from the tens of thousands annually in the late 2010s to more than 20,000 in 2021, according to the supplied report.

The subsequent increase reflects a growing volume of disclosed flaws, although it does not necessarily mean that every listed vulnerability has been exploited in a cyberattack.

The rapid adoption of AI tools has raised further concerns about the cybersecurity landscape.

AI can help researchers analyze code and identify weaknesses, while malicious actors may also use automation to accelerate reconnaissance and attacks.

However, a rise in disclosed vulnerabilities alone does not establish that AI caused the increase.

The trend also reflects changes in reporting practices, the number of products being assessed and the capacity of researchers and organizations to identify and document flaws.