Warnings of the “vulnpocalypse” are crowding conference presentations, headlines, and conversations among security professionals. Are the end times near?

AI is enabling attackers to find and exploit more vulnerabilities than before. We’ve felt it as the number of Zero-Day Alerts (ZDAs) that Coalition sends each quarter has trended upward — with a distinct surge in 2026. The volume may be unprecedented, but the solution is straightforward: Know where to focus.

That’s exactly what our ZDAs help policyholders accomplish. Despite the growing number of vulnerabilities, the majority of policyholders still don’t receive a single ZDA. The vulnerability surge is manageable as long as security teams spend less time focused on hundreds of supposed “critical” risks that are unlikely to be exploited, and instead spend more time remediating  actual threats.

ZDA Snapshot

• Coalition sent 48 different ZDAs between May 1, 2026, and August 1, 2026

• 94% of policyholders didn’t receive a single ZDA

• 16.7% of ZDAs featured boundary devices, a leading driver of ransomware attacks 

• 59% of notified policyholders have fewer than 25 employees

Below, we’ll explore how we’re helping policyholders navigate record-breaking vulnerability volume, the impacts of risk aggregation, and which businesses are most likely to receive ZDAs.

Helping policyholders navigate record-breaking Patch Tuesdays

The pressure is on both vendors and security teams to find issues before attackers can abuse them. In July, Windows shared that it would apply AI across security analysis to find vulnerabilities earlier and at greater scale.

This likely contributed to the record-breaking Patch Tuesday in June with 206 vulnerabilities. In July, the number nearly tripled to 569. Prior to the adoption of multi-model AI for vulnerability discovery, Microsoft typically shipped around 100 fixes each month. 

As soon as the vulnerabilities are disclosed, the clock starts ticking for organizations to act. Earlier this year, Anthropic disclosed that Mythos could create working exploits for newly discovered vulnerabilities in hours, as opposed to weeks. For security teams, this translates to an unprecedented volume of alerts every month to parse through and less time to do it. 

Straightforward prioritization with ZDAs 

Of all the vulnerabilities addressed in Microsoft’s July Patch Tuesday, roughly 60 were rated critical. More than 500 were rated important. Coalition continues to narrow the focus to which flaws we believe are most critical from an external exposure standpoint. In July, we sent two ZDAs on the same day as Patch Tuesday: 

• SharePoint

  • CVE-2026-56164 was added to CISA KEV on the same day as publishing and exploited as a true zero-day. With a Common Vulnerability Scoring System (CVSS) score of 5.4, it’s not particularly alarming on its own. But our analysis found that the nature of the vulnerability could make it an entry-point for other, more severe vulnerabilities. Subsequently, NVD enrichment gave it a 9.8 critical rating. 

  • CVE-2026-58644 was added to CISA KEV two days later. It’s a remote code execution (RCE) vulnerability that requires Site Owner privileges, which CVE-2026-56164 grants. 

  • CVE-2026-50522 is a standalone RCE that permits an unauthorized attacker to execute code over a network. 

• Windows Message Queueing

  • CVE-2026-50447 is a heap-based buffer overflow in Windows Message Queuing that allows unauthorized attackers to execute code over a network.

The expectation is not that policyholders will neglect the rest of the Patch Tuesday release, but that those at high-risk due to the above vulnerabilities will know where to start to dramatically reduce their exposure. Coalition continues to monitor and alert policyholders to the most critical risk following Patch Tuesday releases.

When evaluating the list of vulnerabilities included in Patch Tuesday, we found many of the flaws didn’t carry critical CVSS scores independently, but could be paired with others to permit unauthorized access. Consider the SharePoint vulnerabilities we alerted on: CVE-2026-56164 is low-risk on its own but an avenue for RCE when chained with CVE-2026-58644. 

We saw the similar impact of chained vulnerabilities with WP2Shell this quarter. Security researcher Adam Kues pointed a frontier model at WordPress code for 10 hours to discover the full RCE chain and claimed that “no security researcher could have found and completed this exploit chain in 10 hours without AI.”

Chaining vulnerabilities was once labor intensive for attackers, but AI agents allow for an entirely automated workflow. As Microsoft accounts for entire attack chains, it’s likely that the total volume of fixes will continue to swell.

17% of ZDAs featured boundary devices, a leading driver of ransomware attacks

Our threat intelligence shows that risk is heavily concentrated in specific technology stacks that offer attackers the most high-level access with the least amount of friction. For this reason, many of the same technologies appear in our ZDAs quarter over quarter.

The ease of exploitation and the threat posed by each technology class can vary widely. For example, WordPress plugins have historically led in sheer percentage of ZDAs sent each quarter because they are a part of a massive third-party ecosystem that isn’t regularly audited by WordPress and are easy to exploit. Similarly, content management systems (CMS) software can be near ubiquitous across the web, making it a popular target because a single vulnerability can introduce millions of potential victims at once.

But both Wordpress plugins and CMS software have a low risk of ransomware as they rarely offer direct access to the corporate network or sensitive data. The same can not be said for boundary devices, which accounted for 16.7% of all 48 ZDAs. Boundary devices, such as SSL VPNs, are a lucrative target for attackers because they sit directly on the internet and a single unpatched flaw can grant attackers full entry into an entire corporate network. 

In an ideal world, all businesses would transition to a safer alternative, like Zero Trust Network Access (ZTNA). Businesses running legacy SSL VPNs are 3 to 4 times more likely to experience a claim. 

When debating what necessitates a ZDA, vulnerabilities within boundary devices frequently meet all necessary criteria. Some that we alerted on:

• SonicWall SMA1000 CVE-2026-15409 & CVE-2026-15410: Chained zero-days, starting with CVE-2026-15409 to gain unauthenticated access to reach CVE-2026-15410, which can be exploited to execute commands on the appliance for full compromise of the affected device. 

• CVE-2026-0300: A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges.

• FortiBleed: Not a zero-day, but a global credential-compromise campaign that targeted internet-facing Fortinet FortiGate firewalls. Coalition notified all policyholders associated with the leak to rotate credentials.

59% of policyholders that received a ZDA have fewer than 25 employees

Employee count

Of all policyholders that received a ZDA, 59% had fewer than 25 employees. 

For well-intentioned SMBs, a Patch Tuesday with nearly 600 vulnerabilities could present a month-long challenge.

Small and midsize businesses (SMBs) are typically the most strapped for resources and time, which often means they lack vulnerability management processes. For well-intentioned SMBs, a Patch Tuesday with nearly 600 vulnerabilities could present a month-long challenge.

Coalition sends ZDAs with clear steps for remediation to make patching as straightforward as possible. ZDAs are meant to supplement, not replace, a policyholder’s own patching and vulnerability management practices. While we can’t control how AI is shaping the volume of threats, we can make risk mitigation accessible for even the smallest businesses.

ZDAs per policyholder

The majority of policyholders (94%) did not receive a single ZDA from us. Of those that did, 91% received just one. Throughout the policy period, policyholders receive additional security notifications that are not measured here. ZDAs are intentionally designed to cut through noise and guide businesses to focus on the same small percentage of risks that adversaries do. 

While the “vulnpocalypse” introduces an overwhelming number of vulnerabilities, the majority have no confirmed exploitation. Between 2018 and 2025, the share of newly published CVEs with confirmed exploitation remained below 2.2%, even as annual CVE volume grew 2.5 times. 

Businesses that try to patch everything at once risk being overwhelmed. When we send ZDAs, we consider business impact and the legitimate risk of exploitation.

ZDAs by industry

We observed a reasonably balanced dispersion of ZDAs sent across sectors. This is to be expected, as no industry is immune from the risk of aggregation events or vulnerable software.

Staying ahead of threats in the AI era

Autonomous discovery tools have fundamentally changed how security teams respond to critical threats. Moving fast isn't enough; defenders must evaluate vulnerabilities holistically based on potential financial loss. While traditional CVSS scores offer a baseline, they don't directly translate to real-world business impact.

Coalition delivers timely, prioritized ZDAs straight to policyholders’ inboxes when data indicates a vulnerability threatens their bottom line. Along with step-by-step remediation guidance, policyholders can access third-party risk management and attack surface monitoring through Coalition Control®, our cyber risk management platform.

EASILY SPOT & STOP CYBER THREATS IN ONE PLACE

Coalition Control

Take control of your cyber risk >

This blog post is designed to provide general information on the topic presented and is not intended to construe or render legal or other professional services of any kind. If legal or other professional advice is required, the services of a professional should be sought. Nothing in this blog post modifies or forms part of any insurance policy, and coverage is subject to the terms, conditions, and exclusions of the applicable policy. Neither Coalition nor any of its employees make any warranty of any kind, express or implied, or assume any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, product or process disclosed. Vulnerability information changes rapidly; this post reflects information available as of its publication date. Zero-Day Alerts and related monitoring are not guaranteed to identify every vulnerability or threat and do not replace a policyholder’s own security and patch management practices. Any action you take based upon the information contained herein is strictly at your own risk. Coalition and its affiliates will not be liable for any losses and damages in connection with your use or reliance upon the information. This blog post may include links to other third-party websites. These links are provided as a convenience only. Coalition does not endorse, have control over nor assume responsibility or liability for the content, privacy policy or practices of any such third-party websites. 

Copyright © 2026. All rights reserved. Coalition, Coalition Control and the Coalition logo are trademarks of Coalition, Inc. All other products and company names are the intellectual property of their respective brand owners.