Combatting the ‘Vulnpocalypse’ With Zero-Day Alerts

Warnings of the “vulnpocalypse” are crowding conference presentations, headlines, and conversations among security professionals. Are the end times near?

AI is enabling attackers to find and exploit more vulnerabilities than before. We’ve felt it as the number of Zero-Day Alerts (ZDAs) sent each quarter has trended upward — with a distinct surge in 2026. The volume may be unprecedented, but the solution is straightforward: Know where to focus.

That’s exactly what our ZDAs help policyholders accomplish. Despite the growing number of vulnerabilities, the majority of policyholders still don’t receive a single notification. The vulnerability surge is manageable as long as security teams spend less time focused on hundreds of supposed “critical” risks that are unlikely to be exploited, and instead spend more time remediating actual threats.

ZDA Snapshot

- Coalition sent 49 ZDAs between May 1, 2026, and August 1, 2026

- 94% of policyholders didn’t receive a single ZDA

- 59% of notified policyholders have fewer than 25 employees

Below, we’ll explore how we’re helping policyholders navigate record-breaking vulnerability volume and which businesses are most likely to receive ZDAs.

Helping policyholders navigate record-breaking Patch Tuesdays

The pressure is on both vendors and security teams to find issues before attackers can abuse them. In July, Windows shared that it would apply AI across security analysis to find vulnerabilities earlier and at greater scale.

This likely contributed to the record-breaking Patch Tuesday in June with 206 vulnerabilities. In July, the number nearly tripled to 569. Prior to the adoption of multi-model AI for vulnerability discovery, Microsoft typically shipped around 100 fixes each month.

As soon as the vulnerabilities are disclosed, the clock starts ticking for organizations to act. Earlier this year, Anthropic disclosed that Mythos could create working exploits for newly discovered vulnerabilities in hours, as opposed to weeks. For security teams, this translates to an unprecedented volume of alerts every month to parse through and less time to do it.

Straightforward prioritization with ZDAs

Of all the vulnerabilities addressed in Microsoft’s July Patch Tuesday, roughly 60 were rated critical. More than 500 were rated important. Coalition continues to narrow the focus to which flaws we believe are most critical from an external exposure standpoint. In July, we sent two ZDAs on the same day as Patch Tuesday:

- SharePoint

- CVE-2026-56164 was added to CISA KEV on the same day as publishing and exploited as a true zero-day. With a Common Vulnerability Scoring System (CVSS) score of 5.4, it’s not particularly alarming on its own. But our analysis found that the nature of the vulnerability could make it an entry-point for other, more severe vulnerabilities. Subsequently, NVD enrichment gave it a 9.8 critical rating.

- CVE-2026-58644 was added to CISA KEV two days later. It’s a remote code execution (RCE) vulnerability that requires Site Owner privileges, which CVE-2026-56164 grants.

- CVE-2026-50522 is a standalone RCE that permits an unauthorized attacker to execute code over a network.

- Windows Message Queueing

- CVE-2026-50447 is a heap-based buffer overflow in Windows Message Queuing that allows unauthorized attackers to execute code over a network.

The expectation is not that policyholders will neglect the rest of the Patch Tuesday release, but that those at high-risk due to the above vulnerabilities will know where to start to dramatically reduce their exposure. Coalition continues to monitor and alert policyholders to the most critical risk following Patch Tuesday releases.

When evaluating what made the cut (among the 569 vulnerabilities), we found that many of the flaws weren’t noteworthy on their own or didn’t carry a particularly high CVSS score. The forest mattered more than the trees. Take, for example, CVE-2026-56164, a vulnerability that is low-risk on its own but an avenue for RCE when chained with CVE-2026-58644.

Chaining vulnerabilities was once labor intensive for attackers, but AI agents allow for an entirely automated workflow.

We saw the similar impact of chained vulnerabilities with WP2Shell (more on that below). Chaining vulnerabilities was once labor intensive for attackers, but AI agents allow for an entirely automated workflow. As Microsoft accounts for entire attack chains, it’s likely that the total volume of fixes will continue to swell.

59% of policyholders that received a ZDA have fewer than 25 employees

Employee count

Of all policyholders that received a ZDA, 59% had fewer than 25 employees.

For well-intentioned SMBs, a Patch Tuesday with nearly 600 vulnerabilities could present a month-long challenge.

Small and midsize businesses (SMBs) are typically the most strapped for resources and time, which often means they lack vulnerability management processes. For well-intentioned SMBs, a Patch Tuesday with nearly 600 vulnerabilities could present a month-long challenge.

Coalition sends ZDAs with clear steps for remediation to make patching as straightforward as possible. ZDAs are meant to supplement, not replace, a policyholder’s own patching and vulnerability management practices. While we can’t control how AI is shaping the volume of threats, we can make risk mitigation accessible for even the smallest businesses.

ZDAs per policyholder

The majority of policyholders (94%) did not receive a single ZDA from us. Of those that did, 91% received just one.

While the “vulnpocalypse” introduces an overwhelming number of vulnerabilities, the majority have no confirmed exploitation. Between 2018 and 2025, the share of newly published CVEs with confirmed exploitation remained below 2.2%, even as annual CVE volume grew 2.5 times.

Businesses that try to patch everything at once risk being overwhelmed. When we send ZDAs, we consider business impact and the legitimate risk of exploitation. The intention is to cut through the noise and guide businesses to focus on the same small percentage of risks that adversaries do.

ZDAs by industry

We observed a reasonably balanced dispersion of ZDAs sent across sectors. This is to be expected, as no industry is immune from the risk of aggregation events or vulnerable software.

Staying ahead of threats in the AI era

Autonomous discovery tools have fundamentally changed how security teams respond to critical threats. Moving fast isn't enough; defenders must evaluate vulnerabilities holistically based on potential financial loss. While traditional CVSS scores offer a baseline, they don't directly translate to real-world business impact.

Coalition delivers timely, prioritized ZDAs straight to policyholders’ inboxes when data indicates a vulnerability threatens their bottom line. Along with step-by-step remediation guidance, policyholders can access third-party risk management and attack surface monitoring through Coalition Control®, our cyber risk management platform.

EASILY SPOT & STOP CYBER THREATS IN ONE PLACE

Coalition Control

Take control of your cyber risk >