Security Not yet confirmed elsewhere 1 publisher3 min readPublished Aug 26, 2026, 4:28 AM PDT

Kaspersky's CVE surge has two sources, and only one of them lands in the CVE count

Kaspersky's Q2 2026 figures credit AI with both writing the bugs and finding them. The disclosures carrying working exploit code never got a CVE identifier at all.

The Watch · Security desk

How we use AI Send a correction

What happened

Kaspersky's Q2 2026 report puts the number of registered CVEs at an unprecedented level, credited mainly to AI use in both development and bug hunting.
The firm says entire new classes of vulnerability emerged in the quarter, particularly in the Linux networking subsystem.
Published flaws scoring above 9.0 on CVSS jumped sharply in the same period, on Kaspersky's five-year monthly series.
A researcher using the name Nightmare Eclipse published named Windows flaws with technical details before any CVE identifiers had been assigned.

Why it matters

constraint Triage built on CVE identifiers cannot open a ticket for the Windows bugs at all, so the flaws with public exploit code are the ones with no queue position.
cost The reading burden falls on whoever maintains dependency inventories: one AI project alone can add several hundred advisories a quarter to be assessed and mostly dismissed.
precedent If exploit-first publication becomes the norm, vendors lose the disclosure window they have relied on to prepare and stage a fix.
contradiction Because the knowledge base blends three registers and its historical figures get revised, the size of the jump is less firm than the direction of it.

Two different mechanisms are being counted in one number, and they do not have the same consequence for the people who run patch queues. Kaspersky says AI development tools contribute defects because the quality of the code they emit varies widely, and separately that AI-assisted research can read volumes of code nobody had examined before, surfacing whole classes of flaw that went unnoticed for decades ^[20]^[21]. New code with new bugs is a forward problem. Old code with newly visible bugs is a backlog problem, and it arrives already deployed.

Dirty Frag is the example the report offers for the second kind: not one kernel bug but a series, found with AI assistance in the Linux kernel ^[6]. Class findings are the expensive sort, because the fix is rarely a single commit and the severity call has to be made again across variants that look alike.

The volume side has an arithmetic tell the report does not spell out. OpenClaw, described as a popular AI project, ranked twelfth by CVE count with more than 200 registered in the quarter ^[4]. Twelfth place means eleven projects at least matched it ^[16], so a floor of roughly a dozen projects each cleared 200 CVEs in three months. For OpenClaw alone that is better than two published CVEs per day, every day of the quarter ^[17].

The Windows section shows where the gap opens. Three of the five named entries in the list published by Nightmare Eclipse are Windows Defender bugs ^[15]: BlueHammer, a time-of-check to time-of-use race during signature updates that lets an attacker substitute the temporary update directory ^[11]; RedSun, which overwrites or restores files marked as cloud detections with elevated privileges ^[12]; and RougePlanet ^[9]. YellowKey walks past BitLocker through the Windows Recovery Environment ^[13], and GreenPlasma injects system objects via the CTFMON loader ^[14]. All four of the entries described in full shipped with exploit code ^[18], and Kaspersky treats publication ahead of CVE registration and patching as a precedent set this quarter ^[7]. Defender is the mitigating control on those machines, and three of the published bugs are in it.

So the surge and the exposure are drifting apart. The intake queue fills with advisories from projects that generate them in the hundreds, while the disclosures carrying usable exploits arrive with no identifier to sort on and no vendor fix behind them ^[3].

One caveat is Kaspersky's own. The knowledge base merges the CVE database, the Russian BDU register and GitHub Advisory, and the firm notes that its figures for earlier reporting periods may differ from what it published before ^[10]. The direction of travel is credible, and Kaspersky expects the discovery rate to keep climbing ^[20]. The height of the curve is measured against a baseline that moves.

What to watch

Whether the Nightmare Eclipse Windows bugs get CVE identifiers, and how long after the exploit code was published.
Whether Microsoft addresses the three Windows Defender flaws through a scheduled update cycle or out of band.
Whether Kaspersky's next quarterly report separates CVE volume from AI projects, which would show if the surge is broad or concentrated in a dozen repositories.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence48
Adoption44
Hype gap+30
Incentives66
Confidence45

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Kaspersky's Securelist report on exploits and vulnerabilities in Q2 2026 states that the number of registered CVEs reached an unprecedented level.
ReportedSupportedSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source
[2]
Kaspersky says the result was entire new classes of vulnerabilities emerging, particularly in the Linux networking subsystem.
ReportedSupportedSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source
[3]
Kaspersky says security researchers have been publishing exploits for unpatched vulnerabilities more frequently, and that such publications potentially open the door for attackers to target unprotected systems.
ReportedSupportedSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source
[4]
OpenClaw, described as a popular AI project, ranked 12th among projects with the highest number of vulnerabilities discovered and published in Q2 2026, with over 200 CVEs registered during the reporting period.
ReportedSupportedSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source
[5]
Kaspersky's monthly series for 2022 through 2026 shows the number of published critical vulnerabilities (CVSS above 9.0) jumping sharply in Q2 2026.
ReportedSupportedSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source
[6]
AI was used to find a series of Dirty Frag vulnerabilities in the Linux kernel.
ReportedSupportedSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source
[7]
Kaspersky describes Q2 2026 as a new precedent in the publication of Windows vulnerabilities and exploits, with researchers no longer waiting for CVE registration, let alone patches.
ReportedSupportedSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source
[8]
A researcher who goes by Nightmare Eclipse (also known as Chaotic Eclipse) published a list of new named vulnerabilities across various Windows subsystems; at the time the technical details were published, none of them had been assigned a CVE identifier.
ReportedSupportedSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source
[9]
RougePlanet is listed as a further Windows Defender vulnerability in the same publication; the description in the available material is cut off.
ReportedSupportedSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source
[10]
Kaspersky's figures come from its vulnerability knowledge base, which draws on the CVE database, the Russian BDU database and GitHub Advisory (GHSA); as a result, figures for previous reporting periods may differ from those published in earlier reports.
ReportedSupportedSource: Kaspersky (Securelist)View cited source
[11]
BlueHammer is a local privilege escalation vulnerability in Windows Defender: during signature database updates a time-of-check to time-of-use race condition allows an attacker to substitute the directory where temporary update files are written. The researcher published a fully functional exploit.
ReportedSupportedSource: Kaspersky (Securelist)View cited source
[12]
RedSun is a logical vulnerability in Windows Defender with a working exploit: suspicious and malicious files marked as cloud can be overwritten or restored to their original directory with elevated privileges. The exploit combines a large number of popular Windows exploitation techniques.
ReportedSupportedSource: Kaspersky (Securelist)View cited source
[13]
YellowKey lets a user bypass BitLocker full-disk encryption and access system data through the Windows Recovery Environment (WinRE); a fully functional exploit was published.
ReportedSupportedSource: Kaspersky (Securelist)View cited source
[14]
GreenPlasma enables system object injection via the CTF loader for the Collaborative Translation Framework (CTFMON) service in Windows; the original publication included an exploit with limited functionality.
ReportedSupportedSource: Kaspersky (Securelist)View cited source
[15]
Three of the five named Windows entries in the Nightmare Eclipse list (BlueHammer, RedSun, RougePlanet) are Windows Defender vulnerabilities.
DerivedSupported2 sources— create a free account to open them
[16]
OpenClaw's 12th-place ranking implies at least eleven other projects each registered at least as many CVEs as its 200-plus in Q2 2026.
DerivedSupported2 sources— create a free account to open them
[17]
More than 200 CVEs across the 91 days of a second calendar quarter is more than two published CVEs per day for a single project.
DerivedSupported2 sources— create a free account to open them
[18]
All four of the Nightmare Eclipse entries described in full were published with exploit code, three of them working or fully functional and one with limited functionality.
DerivedSupported2 sources— create a free account to open them
[19]
Kaspersky attributes the CVE surge primarily to the widespread adoption of AI, both for application development and for the search for security flaws.
ReportedInsufficientSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source
[20]
Kaspersky says AI development tools contribute to the vulnerability picture because the quality of the code they produce can vary widely, and concludes that the rate at which new vulnerabilities are discovered will inevitably keep growing.
ReportedInsufficientSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source
[21]
Kaspersky says using AI for vulnerability research makes it possible to analyse massive amounts of previously unexamined code, uncover new attack surfaces, and identify entire classes of vulnerabilities that have gone unnoticed for decades.
ReportedInsufficientSource: Kaspersky (Securelist)2 sources— create a free account to open them View cited source

Sources

1 independent publisher whose own reporting we read for this story.

securelist.com
1 article · August 26, 2026
Exploits and vulnerabilities in Q2 2026

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

For builders the report is a double-edged data point on AI in the software pipeline: Kaspersky says AI-written code of variable quality is inflating vulnerability counts while AI-assisted research is stripping whole code bases of their obscurity, and it uses OpenClaw - an AI project with over 200 CVEs in a single quarter, more than two per day - as the illustration that AI tooling is itself a dependency risk. The actionable part is concrete (dependency triage load, new Linux networking and kernel vulnerability classes such as Dirty Frag); the causal part is asserted, not measured, so builders get a direction of travel rather than a defect-rate baseline they can plan against.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence48: 0100
Primary vendor report, quantification off-page and uncorroborated
The cluster contains one source, but it is the originating primary document: Kaspersky's own quarterly, with an explicit methodology note and richly specific technical descriptions of six named Windows vulnerabilities and their exploit code. That specificity is what lifts the score. What holds it down is that the headline quantities - the record CVE count and the critical-CVSS jump - exist only in download-only charts, the AI attribution has no stated method, and no second publisher, vendor advisory, or CVE record in the cluster corroborates any of it.
Adoption44: 0100
Concrete disclosure and telemetry artifacts, AI attribution unquantified
There are real, countable artifacts here rather than intentions: 200-plus CVEs registered against one AI project in a quarter, six named Windows vulnerabilities shipped with exploit code, a Dirty Frag series in the Linux kernel, and a telemetry list of the exploits Kaspersky detects most. What is not measured is the thing the story turns on - how much of the surge is actually AI-driven, and whether the published exploits are being used in the wild, which Kaspersky itself calls isolated cases for now.
Hype gap+30: −100 understated0 aligned+100 overstated
Causal AI framing outruns the published attribution data
The report's substantive disclosures are, if anything, under-sold: six exploit-carrying Windows vulnerabilities with no CVE, four of them inside Windows Defender, are described in one bullet list and then set aside. The overstatement is in the causal and forward-looking layer - AI named as the primary driver of a record CVE count with no attribution method, a mechanism story about decades-old vulnerability classes resting on one example, and the conclusion that discovery rates will 'inevitably' keep growing. Net positive but moderate, because the technical core is verifiable in detail even where the headline is not.
Incentives66: 0100
Commercial security vendor reporting from its own knowledge base and telemetry
Kaspersky is a commercial endpoint-security vendor and every number here originates inside its own products: the vulnerability knowledge base it curates and the telemetry its solutions generate, including a list framed as 'the ones our solutions most frequently detect exploits for'. A narrative of unprecedented, AI-accelerated vulnerability volume plus researchers publishing exploits before patches exist aligns directly with demand for the vendor's detection and patch-management offerings. There is no disclosed sponsorship or product pitch in the text and the methodology caveat is stated openly, so this is structural interest rather than evident distortion.
Confidence45: 0100
Single primary source, strong on detail, unverified on totals
Confidence is limited mainly by cluster structure: one publisher, one document, no corroborating advisory or CVE record, and the two quantitative backbones locked in chart downloads. Confidence is nonetheless above the floor because the source is the primary report rather than a summary of one, its technical descriptions are specific and internally consistent, and its methodology limits are self-disclosed. The article ledger's own counts of the named Windows entries (five entries, three in Defender) diverge from the source body's six entries with four in Defender, which further argues for caution on derived arithmetic.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Linux kernel and networking security Follow
AI-Generated Code Security Follow
Windows endpoint securityFollow
Pre-CVE exploit disclosureFollow
AI-assisted vulnerability research Follow
CVE ecosystem scalingFollow

Entities

Kaspersky Follow
OpenClaw Follow
Nightmare Eclipse Follow
Windows Security / Defender Follow
BitLockerFollow
Windows Recovery EnvironmentFollow
Linux kernel Follow
BlueHammerFollow
RedSunFollow
YellowKeyFollow
GreenPlasmaFollow
RougePlanetFollow
UnDefendFollow
Dirty FragFollow
CVE Program Follow
GitHub Advisory Database Follow
BDU vulnerability databaseFollow
CVSS Follow