How to read a vendor's CVE count without fooling yourself

A vendor's raw vulnerability count is one of the most cited and least useful numbers in security. Last month Oracle published more than a thousand of them. That is roughly four times its normal month, and it was not a crisis. It was the calendar. Oracle ships most of its disclosures in four big scheduled bundles a year, and one had just landed. If you read the spike as "Oracle is on fire," the calendar fooled you.

From our vendor vulnerability stats, 2026-07-24. Known-exploited means listed in the CISA Known Exploited Vulnerabilities catalog.

The count is a publishing artifact

Two things move a vendor's number that have nothing to do with how risky its software is this week. The first is release cadence. Oracle batches; Microsoft ships a steady load every second Tuesday; the Linux kernel publishes in irregular waves. A month over month jump is usually a schedule, not a signal. The second is attribution lag. A vulnerability is often counted against a vendor only once the affected product is formally listed, which can trail the disclosure by weeks. So a quiet month can be an artifact of paperwork that has not caught up.

Volume and risk are different axes

Look at the three numbers above. Microsoft has more than five times Fortinet's yearly count, and about four times its number of known-exploited flaws. But Fortinet's exploited share is far higher, because its products sit at the network edge where a working exploit is worth a great deal. Counting all vulnerabilities equally treats a theoretical medium-severity bug the same as an edge device flaw that is being used right now. Those are not the same, and the raw count cannot tell them apart.

What to read instead

Three signals beat the count. Is it on the known-exploited list, which means someone is using it. What is its exploit-probability score, which estimates whether someone will. And does it sit on something exposed, like an edge appliance or an internet-facing service. A short list ranked by those will point a small team at the handful of items that matter, while the vendor's headline number sends them chasing a total they can never drain.

For a lean team

You will never patch a four figure monthly total, and you do not need to. Ignore the vendor leaderboard. Filter to exploited or high-probability items on software you actually run and that is actually reachable, and work that list. The big number is for headlines. The short list is for Tuesday.