CMS Flaws Dominate 2026 Exploited-Vulnerability List as AI-Found Bugs Lag

Known exploited vulnerabilities, or KEVs, are security flaws confirmed to have been abused in real-world attacks, making them a priority for patching and risk management. Content management systems are especially consequential because they underpin large numbers of public websites and corporate services. Weaknesses in CMS cores, plugins or themes can therefore give attackers a repeatable route into many targets, amplifying the impact of a single vulnerability.

Vulnerability intelligence provider VulnCheck said CMS flaws accounted for roughly one-third of KEVs identified in the first half of 2026. The report also found that only 1.3% of vulnerabilities discovered with AI assistance were later confirmed as exploited, suggesting AI-found bugs are not currently more prone to abuse than conventional discoveries. Anthropic’s security program uncovered tens of thousands of vulnerabilities, but only a very small number were publicly disclosed and verified as exploited.