– Dr. Mark Kuhr, Co-founder & CTO, Synack<\/cite><\/div>\n<\/blockquote>\nThe risk structure is shifting<\/h2>\n The total number of vulnerabilities identified remained largely stable year-over-year. What changed was their composition. High-severity findings increased by 10 percent. The most pronounced rise came from remote code execution, which surged by 39 percent. Brute-force attacks climbed 17.4 percent, while content injection grew by 8 percent.<\/p>\n
The report interprets this pattern as a shift toward identity-based attacks. It aligns with the observation that attackers are leveraging AI to probe access controls at scale. For security teams, the sheer volume of findings matters less. What counts is which gaps create real attack paths-and which should be closed first.<\/p>\n\n\n
Vulnerabilities by Type, 2024 and 2025<\/p>\n
<\/span>2024<\/span><\/span>2025<\/span><\/div>\n\n
\n
Cross-Site Scripting<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n
3,247<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n
3,020<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
Authorization\/Permissions<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n
2,858<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n
2,652<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
SQL Injection<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n
1,202<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n
902<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
Info Disclosure<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n
957<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n
896<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
Authentication Management<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n
744<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n
688<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
Server App Misconfiguration<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n
662<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n
576<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
Functional Business Logic<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n
595<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n
562<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
Content Injection<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n
476<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n
▲<\/span> 514<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n
Brute Force<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n
190<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n
▲<\/span> 223<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n
Remote Code Execution<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n
115<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n
▲<\/span> 160<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n
CSRF<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n
258<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n
139<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>
Data: Synack State of Vulnerabilities Report 2026 · Presentation: SecurityToday<\/figcaption><\/figure>\n\n
47 percent<\/p>\n
Reduction in remediation time with continuous testing<\/p>\n
Organizations running continuous tests resolved high-severity gaps 42 days<\/strong> faster than in 2024, and critical gaps 38 days<\/strong> faster. At the same time, 37 percent<\/strong> of all findings were either critical or high-severity.<\/p>\n<\/div>\n\n
What is MTTR?<\/strong> Mean Time To Remediate measures the average time from vulnerability discovery to resolution. The shorter this window, the smaller the window of opportunity for exploitation. The report highlights this metric as a key lever against accelerating attack speeds.<\/p>\n<\/div>\nWhere the critical findings are concentrated<\/h2>\n The share of critical and high-severity vulnerabilities in 2025 reached 37 percent. Manufacturing led with 43.1 percent, followed by the technology sector at 40.0 percent.<\/p>\n\n\n
Share of Critical and High Severity Vulnerabilities by Industry 2025<\/p>\n
\n
\n
Manufacturing<\/div>\n
\n
<\/div>\n<\/div>\n
43.1%<\/div>\n<\/div>\n
\n
Technology<\/div>\n
\n
<\/div>\n<\/div>\n
40.0%<\/div>\n<\/div>\n
\n
Government<\/div>\n
\n
<\/div>\n<\/div>\n
39.4%<\/div>\n<\/div>\n
\n
Retail<\/div>\n
\n
<\/div>\n<\/div>\n
32.4%<\/div>\n<\/div>\n
\n
Financial Services<\/div>\n
\n
<\/div>\n<\/div>\n
31.4%<\/div>\n<\/div>\n
\n
Overall Average<\/div>\n
\n
<\/div>\n<\/div>\n
37.3%<\/div>\n<\/div>\n<\/div>\n<\/div>
Data: Synack State of Vulnerabilities Report 2026 · Presentation: SecurityToday<\/figcaption><\/figure>\nAmong findings mapped to the OWASP Top 10:2025, two classes dominated. Injection flaws accounted for 40.6 percent, while broken access controls made up 32.8 percent. Together, they represented the bulk of OWASP-mapped findings.<\/p>\n
AI environments become targets in their own right<\/h2>\n AI and LLM systems also drew more scrutiny from assessors. Security assessments in this area on the evaluated platform jumped 120 percent. The report reads this as a signal that AI infrastructures are increasingly treated as standalone attack surfaces-not merely as tools used by attackers.<\/p>\n
What security teams should prioritize now<\/h2>\n Clear priorities for vulnerability management emerge from the data.<\/p>\n
\n
1<\/span><\/p>\nTackle critical issues first<\/strong>Consistently remediate critical and high-severity findings before addressing anything else.<\/div>\n<\/div>\n2<\/span><\/p>\nWatch attack paths<\/strong>Monitor remote code execution, brute force, content injection, injections, and flawed access controls with targeted vigilance.<\/div>\n<\/div>\n3<\/span><\/p>\nAudit AI systems<\/strong>Integrate AI and LLM environments directly into your security review process.<\/div>\n<\/div>\n4<\/span><\/p>\nTest continuously<\/strong>Shift from periodic audits to ongoing testing. This measurably reduces remediation time.<\/div>\n<\/div>\n<\/div>\nThe key takeaway remains: the number of vulnerabilities found doesn\u2019t determine risk-it\u2019s how quickly the critical ones are neutralized.<\/p>\n
Frequently Asked Questions<\/h2>\n Every question is locked. A tap unlocks the answer.<\/p>\n\nWhat is the State of Vulnerabilities Report 2026?<\/strong><\/summary>\nThe report analyzes more than 11,000 vulnerabilities discovered in 2025 across live customer environments. It is published by Synack, a provider of AI-driven penetration testing. The findings are categorized by severity, type, and industry.<\/p>\n<\/details>\n\nWhy are CVE counts rising even as fixes get faster?<\/strong><\/summary>\nBoth trends are happening simultaneously. In 2025, over 48,000 CVEs were published industry-wide-20 percent more than the previous year. At the same time, continuous testing is cutting remediation times. More known gaps don\u2019t automatically translate into greater risk as long as critical flaws are closed quickly.<\/p>\n<\/details>\n\nWhat does MTTR stand for and why is the decline important?<\/strong><\/summary>\nMTTR stands for Mean Time To Remediate, the average time to resolution. Across all categories, the report shows a 47 percent drop. The shorter this window, the smaller the opportunity for attackers to exploit a known gap.<\/p>\n<\/details>\n\nWhich industries are most affected?<\/strong><\/summary>\nThe manufacturing sector recorded the highest share of critical and high-severity findings at 43.1 percent, followed by the technology sector at 40.0 percent. Across all industries, the average share was 37 percent.<\/p>\n<\/details>\n\nWhy do AI environments appear in the report?<\/strong><\/summary>\nSecurity assessments of AI and LLM systems surged by 120 percent. This signals that these systems are not only used as attack tools but are themselves becoming attack surfaces that require dedicated testing.<\/p>\n<\/details>\n
<\/p>\n
Editor’s Picks<\/h3>\n Editor’s Pick<\/span>Adaptive MFA: NIS2 Pressure as a Zero-Trust<\/span><\/span><\/a>Editor’s Pick<\/span>From When the Reporting Deadline Clock Really Starts Ticking<\/span><\/span><\/a>Editor’s Pick<\/span>DORA in Operation: What the Regulator Wants to See<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
![\"Dr.](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/mark-kuhr-portrait-st18106-hero.jpg\")
– Dr. Mark Kuhr, Co-founder & CTO, Synack<\/cite><\/div>\n<\/blockquote>\n![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/05\/adaptive-mfa-nis2-bsi-zero-trust-mittelstand-fido2-2026-hero-250x167.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/nis2-dora-dsgvo-meldefristen-vergleich-startpunkt-incident-cover-hero-1-250x143.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/06\/dora-finanzinstitute-resilienz-nachweis-tlpt-cover-hero-250x141.jpg\")
<\/span>