Minor Vulnerabilities: The End of Tacit Risk Acceptance in the Age of AI
In most vulnerability management programs, one phrase comes up almost as a reflex: "it's a CVSS 5.2, it's a low risk, we'll accept it." That reasoning was not unreasonable. It rested on an implicit but solid assumption, one baked into the very mechanics of the scoring system: exploiting a minor flaw, or chaining it with others to produce real impact, cost time, scarce skills, and an effort few attackers were willing to invest for an uncertain payoff.
That mechanic is worth pausing on, because it is exactly what AI is destabilizing. The way a vulnerability's criticality is calculated, its CVSS score, directly factors in exploitation difficulty. A flaw deemed complex to exploit, one that requires prior authentication or victim interaction, sees its score mechanically lowered. Yet this is precisely the parameter that artificial intelligence erodes: what used to demand an expert and several days is becoming automatable. When exploitation complexity collapses, the low scores it once justified lose their foundation.
The industrialization of offensive AI thus lowers, simultaneously, the two barriers that protected "low" vulnerabilities: cost and time. The moment has come to reassess a risk acceptance posture that was calibrated for a world that no longer exists.
CVSS in isolation never measured real risk
Before even talking about AI, a fundamental misunderstanding needs defusing. The CVSS score measures intrinsic technical severity, not operational risk. And the two diverge sharply.
Research converges on an uncomfortable finding: fewer than one in five vulnerabilities rated "critical" or "high" by CVSS is actually observed being exploited in the wild, while those high ratings are assigned to nearly 57% of published vulnerabilities. In other words, the system that structures prioritization for most organizations generates massive noise at the top of the scale and, symmetrically, a false sense of security at the bottom.
Because a vulnerability's low score says nothing about its potential role in an attack. CVSS evaluates each flaw in isolation, as if it lived alone in a perfectly segmented system. Attackers, however, do not think in silos.
Chaining turns the minor into the critical
The technique that turns a scattering of trivial flaws into a major compromise has a name, and it is not a fringe concept: CISA itself documents it. In its binding operational directive BOD 22-01, the U.S. agency describes chaining as the use of low-scoring vulnerabilities to gain an initial foothold, then the exploitation of additional flaws to escalate privileges incrementally.
The mechanism is multiplicative, not additive. An information disclosure considered minor becomes valuable reconnaissance. A seemingly harmless open redirect becomes a link in a phishing chain. A faulty access control rated "medium" becomes, combined with a misconfiguration, a complete authentication bypass. Each flaw in isolation remains "acceptable"; their product is not.
Examples abound. The 2024 Okta compromise relied on a chain of service-account misconfigurations and privilege escalation. The 2023 Mailchimp incident combined social engineering with insufficient session management. In each case, taken separately, the weaknesses looked manageable. Assembled, they cost data, money, and trust.
The problem: traditional scanners and siloed security reviews assess vulnerabilities one at a time. They do not see the attack paths their combination produces. The "minor vulnerability debt" left to accumulate is therefore not a harmless stockpile: it is a reservoir of links.
AI collapses the cost and the time of exploitation
This is where the landscape tips. Historically, the limiting factor in an attack was not intent but labor: it took researchers able to analyze a flaw, write a working exploit, and adapt it to a target. Generative AI dismantles that bottleneck.
The figures are unequivocal. Time to exploit, the delay between a vulnerability's disclosure and its first observed exploitation, fell from 745 days in 2020 to just 44 days in 2025, according to a study by threat intelligence vendor Flashpoint, a 94% drop in five years.
At Rapid7, whose 2026 Global Threat Landscape Report draws on telemetry from its investigations, the median time between a flaw's publication and its addition to CISA's Known Exploited Vulnerabilities (KEV) catalogue dropped from 8.5 to 5 days, while confirmed exploitation of vulnerabilities rated 7 to 10 surged 105% in a year, from 71 to 146 cases.
More striking still, because it directly documents the fall in exploitation difficulty: a University of Illinois team (Fang, Bindu, Gupta and Kang) showed as early as 2024 that an agent built on GPT-4 could autonomously exploit 87% of a set of 15 "one-day" vulnerabilities from their CVE description alone, where GPT-3.5, eight open-source models, and the ZAP and Metasploit scanners scored 0%.
The researchers put the average cost of a successful exploit at $8.80, roughly 2.8 times cheaper than the $25 of a human pentester for the same task and, unlike human labor, the agent is massively parallelizable. Notably, when deprived of the flaw's description, the agent's success rate dropped to 7%, confirming that AI today is far better at exploiting a known flaw than at discovering a new one. That is exactly the terrain of already-published, unpatched vulnerabilities.
The key point, emphasized by Rapid7, is that this is not a rise in attacker sophistication but an acceleration: AI industrializes reconnaissance, automates decision-making, and compresses the time between exposure and exploitation. Most successful intrusions still start from known and avoidable conditions: exposed services, poorly protected identities, unpatched edge devices. What has changed is the speed at which those conditions are discovered and turned into weapons.
The direct consequence for "low" flaws: the attacker's cost/benefit calculation, which until now made them barely worth the effort, has just been rewritten. Automating the discovery and chaining of dozens of minor vulnerabilities no longer requires a team of researchers; it requires a script and a trivial budget.
What our monitoring observes in the field
These macro trends are confirmed in the feed we consolidate continuously. Over a recent thirty-day window, our monitoring system captured nearly 23,000 cyber signals (incidents, vulnerability disclosures, data breaches, and alerts); the feed peaks at 1200 to 1800 signals on the busiest days. These are not major events in the sense of nationwide attacks, but the daily background noise of the threat: it is precisely this continuous volume that reveals where the risk actually concentrates.
| Indicator | Value |
|---|---|
| Cyber signals | ~23,000 |
| Daily volume (busy days) | ~1200–1800 / day |
| Vulnerabilities' share of the feed | 53.4% |
| Actively exploited KEV CVEs tracked | 1,612 |
| ... of which weaponized in ransomware | 325 |
Two observations confirm the point of this article. First, vulnerabilities dominate the feed by far: they account for 53.4% of signals, well ahead of data breaches and ransomware. Vulnerability management is not one topic among many; it is the center of gravity of the threat.
Second, severity concentrates away from the top of the scale. Among the vulnerabilities we track that carry a CVSS v3 score, only 17.2% are rated "critical". Nearly 38% are rated "medium" or "low", precisely the grey zone organizations tend to push to the bottom of the pile. That is where the reservoir of exploitable links hides.
Finally, our mirror of the KEV catalogue currently tracks 1,612 vulnerabilities confirmed as actively exploited. Among them, 325 are already weaponized in ransomware campaigns. And the most telling part: among those exploited flaws whose score we know, barely more than a third (34.5%) are rated "critical" — nearly one in ten is even "medium" or "low". These flaws did not wait to be "critical" on paper to become a real attack vector: they became dangerous because an exploit exists and circulates.
What to do: add new indicators to the assessment
Mature security teams already assess their vulnerabilities reasonably well against their environment: they have criticality and impact scales tailored to their information system, which contextualize the raw score. The problem, then, is not a lack of method: it is that traditional indicators, centered on intrinsic severity, no longer capture the new reality: the collapse of exploitation difficulty.
The challenge is to enrich the existing framework with signals of real, dynamic exploitability. Concretely, beyond the CVSS score and internal context, factor in: KEV status (is the flaw being exploited in the wild?), the existence of a public exploit or a circulating proof-of-concept, and the EPSS score, which estimates the probability of short-term exploitation. Our own corpus confirms it: of the ~12,000 CVEs for which we track EPSS, barely 8% carry a high short-term exploitation probability — enough to drastically shrink the pile to tackle first. These indicators shift the decision from "how severe is it in theory?" to "how likely is this flaw to actually be attacked, and how fast?". An exploited "medium" vulnerability, with a public exploit and exposed to the internet, can thus legitimately jump ahead of a "critical" one isolated behind several layers of segmentation.
It also means thinking in attack paths rather than individual flaws: mapping how second-tier weaknesses can chain together, and deploying defense in depth where breaking a single link is enough to break the chain.
Defensive AI: a hope, but one running behind
If AI arms attackers, it also equips defenders. A new generation of agents promises to detect and fix flaws at scale, regardless of their severity. At Google, the Big Sleep agent autonomously discovered real vulnerabilities in Chrome and SQLite, some about to be exploited; its successor CodeMender does not just find flaws, it rewrites vulnerable code to fix them, with 72 patches already submitted to open-source projects. At Anthropic, Claude Security entered public beta for enterprise customers: it scans code repositories and proposes fixes.
But this is where clear thinking matters, because these tools do not close the gap described in this article: they throw it into sharp relief. Anthropic's frontier model Claude Mythos is the most striking illustration. In under two months, Anthropic and the roughly fifty organizations in its Glasswing program identified more than 10,000 critical or high vulnerabilities. And the conclusion Anthropic draws from it is precisely this article's thesis: discovery is no longer the bottleneck, patching is. More than 99% of the flaws Mythos found were not yet patched at the time of the announcement, and several open-source maintainers asked the company to slow its disclosure pace, lacking the capacity to absorb the volume.
In other words, defensive AI accelerates detection far faster than it accelerates remediation. It shifts the problem without solving it: we now know we have thousands of flaws, including "minor" ones, but we do not fix them any faster for it. As one executive quoted by Fortune put it, finding risk faster than you can fix it does not make an organization more secure. That is exactly why prioritization by real exploitability, described above, becomes vital: when the list of known flaws explodes, knowing which to fix first is no longer a convenience, it is the only tenable strategy.
The compounding-interest debt
Accepting low and medium risks was a rational trade-off in a world where exploiting those flaws was expensive. That world has changed. When the cost of exploitation runs to a few dollars and the delay to a few days, the stock of "minor" vulnerabilities an organization leaves alive stops being a dormant risk and becomes a compounding-interest debt.
The question is no longer "is this flaw critical?" but "is it reachable, exploitable, and useful to an attacker who now has the tools to exploit it at marginal cost?". For many flaws currently classified as "acceptable," the honest answer is: yes.
Sources
- Flashpoint, N-Day Vulnerability Trends (time to exploit 745 to 44 days, -94% in 5 years): flashpoint.io
- Rapid7, 2026 Global Threat Landscape Report (median KEV time 8.5 to 5 days; +105% exploitation of CVEs rated 7-10, 71 to 146): rapid7.com
- R. Fang, R. Bindu, A. Gupta, D. Kang (UIUC), LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv:2404.08144 (87% success; $8.80/exploit; 7% without CVE description): arxiv.org
- CISA, Directive BOD 22-01 (definition of chaining): cisa.gov
- arXiv:2506.01220, Vulnerability Management Chaining (CVSS limits: <20% of high/critical exploited, 57% of CVEs rated high)
- Indusface, AppSecure, Chainguard: analyses on chaining of low/medium vulnerabilities (Okta 2024, Mailchimp 2023 cases)
- Anthropic, Project Glasswing / Claude Mythos Preview (more than 10,000 critical/high vulnerabilities; >99% unpatched): anthropic.com/glasswing
- Google DeepMind, CodeMender (72 open-source patches; code rewriting): deepmind.google; Big Sleep (autonomous discovery of Chrome/SQLite flaws)
- Fortune, Security Boulevard, Help Net Security: coverage of the discovery/patching gap (April-May 2026)
- Primary data: LuksMentis data (~23,000 cyber signals over 30 days; KEV catalogue mirror: 1,612 actively exploited CVEs, 325 of them ransomware-linked; 2,637 CVEs with a CVSS v3 score; EPSS tracked across ~12,000 CVEs)