The number of publicly catalogued software vulnerabilities is on track to roughly double this year, while federal agencies face a three-day limit for fixing their most dangerous flaws starting in December, Federal News Network reported Friday. Together, the two trends set a new pace that security teams outside government, and the vendors that sell to agencies, will be measured against.

The report drew on remarks by Chris Butera, acting executive assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency (CISA), at the outlet’s Cyber Leaders Exchange 2026.

What Happened

Butera described how artificial intelligence tools that hunt for software flaws are increasing the volume of reported bugs. Each publicly disclosed flaw receives an identifier in the Common Vulnerabilities and Exposures (CVE) program, a catalog that CISA sponsors as the lead government backer. Federal News Network reported that the program catalogued roughly 48,000 CVEs in 2025. Butera said 2026 has already passed that mark, and the outlet reported that the total is projected to reach 90,000 to 100,000 by year end; the article does not attribute that projection to Butera.

RelatedNew curl Release Fixes 24 Flaws, Including a High-Severity Bug Reported With Anthropic’s Claude

“The pace right now is continuing to exceed far what we’ve ever seen before,” Butera said, according to the outlet. The number of CVE Numbering Authorities, the companies and organizations allowed to assign CVE identifiers, has grown from about 20 to more than 500.

CISA’s answer for federal networks is a binding operational directive on vulnerability management issued in June. A binding operational directive is an order that federal civilian agencies must follow. This one asks agencies to fix their highest-risk vulnerabilities first and lets them defer lower-risk ones. Starting in December, agencies will have no more than three days to patch the highest-risk flaws. Agencies were given a six-month runway to prepare, which Federal News Network said they can use to write contract language and identify their internet-facing systems.

“We chose three days to try to make it feasible for our federal agencies as a first step,” he said. He added that CISA hopes agencies will eventually fix publicly exposed critical vulnerabilities in closer to 24 hours.

Why It Matters

For executives, the arithmetic is the problem. A doubling of disclosed flaws in one year means patch teams cannot treat every alert alike, which is why the federal directive moved from flat deadlines to risk-based priorities. Private organizations that still patch on fixed monthly cycles, or that measure success by the share of all bugs closed, may find those metrics no longer reflect real exposure.

The contract angle matters too. Writing contract language is part of agencies’ preparation, which suggests suppliers of software and managed services to the government should expect remediation timelines to appear in agreements. Boards of such suppliers may want to know whether their own teams could meet a three-day, or eventually one-day, window for internet-facing systems.

The Pressure on the CVE Catalog

The surge also strains the catalog itself. On Sept. 23, CISA published a whitepaper, “CVE Program: Establishing a Quality Era Framework,” that proposes moving the program from what it calls a growth era to a quality era. The agency cited the influx of new numbering authorities and AI-enabled discovery as reasons the program has reached an inflection point. The framework covers four areas: governance, participation by the global community, data infrastructure and the reliability of CVE records.

Separately, Butera described Gold Eagle, a clearinghouse led by the Treasury Department and set up in June to coordinate vulnerabilities found by AI. CISA supplies infrastructure, including machine-readable formats that let it accept reports in bulk. “What Gold Eagle really does is allow us to accept vulnerability reports at scale,” he said. The program coordinates with other AI vulnerability clearinghouses so that duplicate reports do not swamp under-resourced open-source maintainers.

What to Watch

  • Whether agencies meet the three-day deadline once it takes effect in December, and whether CISA sets a date for tighter windows.
  • The community feedback CISA requested on its CVE quality framework, and any changes to how records are vetted.
  • Whether the year-end CVE total lands in the projected range, and how much of it comes from AI-assisted discovery.