Attackers exploited 215 distinct vulnerabilities in the first half of 2026, up 34% from 161 in the same period last year, and more than a third of them were being exploited within a week of public disclosure. Those are the headline numbers in Recorded Future's H1 2026 malware and vulnerability trends report, compiled by its Insikt Group research team.
The message for patch teams is uncomfortable: the window between a flaw going public and someone abusing it keeps shrinking, while the backlog of old flaws still being exploited is not going away.
A median of 31 days, and often zero
Across the 215 actively exploited CVEs, exploitation was reported or detected an average of 564 days after disclosure, but the median was 31 days. The average is dragged up by old bugs still in use: 53 of the flaws predate 2025 and 17 date from 2020 or earlier. At the fast end, 81 CVEs (38%) were exploited before, on, or within seven days of their NVD disclosure, and for 23 of them the exploitation evidence came before the NVD record did. Public proof-of-concept exploits existed for 66 of the 215.
Microsoft leads, but 67 vendors had just one
Microsoft remained the vendor most often associated with exploited vulnerabilities at 40 CVEs, up 43% from 28 a year earlier. Red Hat followed with 15, Cisco with 13, Vercel with 11 and Fortinet with 9. The Vercel count is entirely Next.js, the framework IntelFusions covered when two critical Next.js server flaws were patched in August. Yet the exploited flaws touched 98 vendors in total, 67 of which appeared only once, which Insikt Group takes as evidence that exploitation is not confined to the big names.
Reachability predicts risk better than a score
Of the 215 CVEs, 176 were network-accessible and 146 could be exploited without prior authentication; 142 of those 146 were both. Eighty-two involved remote code execution, and 60 of those combined network access with no authentication requirement. Insikt Group's advice is to start with those 60 on exposed systems, because they can provide the foothold on their own.
The same toolkit, thirteen different doors
Two campaigns show how attackers reuse a playbook across whatever flaw gets them in. The StrikeShark campaign used the same six-tool stack, including SharkLoader and Cobalt Strike Beacon, across 13 CVEs spanning 2016 to 2025 in Exchange, SharePoint, FortiOS, IOS XE, BIG-IP, GeoServer and Apache Shiro; IntelFusions reported on SharkLoader's diplomatic targeting in June. Storm-1175 linked ten CVEs to Mimikatz, Impacket, PsExec, Rclone and Medusa ransomware. In all, 43 of the exploited CVEs (20%) were tied to known post-exploitation malware, with stealware the most common category at 29 appearances.
AI is adding volume, not yet autonomy
On AI the report is measured. It says June NVD disclosures ran 43% above the previous six-month average following the Claude Mythos Preview release, and that Mozilla credited the model with 271 fixes in Firefox 150 against 22 from earlier testing with Claude Opus 4.6. But it places most observed AI-enabled malware at levels 1 to 3 of Recorded Future's AI Malware Maturity Model, where AI handles discrete jobs such as user interface interpretation or persistence guidance rather than running attacks on its own. On the malware side, AsyncRAT topped Recorded Future Malware Intelligence submissions with 59,507 unique hashes and 43,549 command-and-control configurations, and Android NFC malware families NFCShare and NGate were the standout mobile trend.
Prioritise reachable, unauthenticated code execution
Insikt Group's recommendations are to rank remediation by exposure and impact rather than vendor or score, to validate public exploits rather than assume they work, to apply interim mitigations when a patch cannot ship in time, and to tie exploitation alerts to what follows them, from credential dumping to bulk data transfer. The 34% rise says the queue is growing; the 31-day median says the deadline is not moving in defenders' favour. The full data set, charts and ATT&CK mappings are in the original Recorded Future report.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.