We Analyzed 1,307 Vulnerabilities in 60 Days: Two-Thirds Were RCE, and AI Tools Are the New Attack Surface

Most vulnerability reports count CVEs. We wanted to know something more useful: of the advisories actually landing right now, how are attackers meant to use them, and which of your security controls do they break? So we pulled 60 days of real advisories through CATAAM’s threat pipeline — every one scored, classified, and mapped to the SOC 2 and ISO 27001 controls it undermines. Here is what 1,307 advisories look like when you read them that way.

Key findings

• 67% of analyzed advisories (873 of 1,307) were remote code execution — by far the dominant class.
• 78% (1,023) carried "High" threat-actor leverage — i.e., directly and immediately weaponizable.
• A new category emerged: 72 advisories in AI infrastructure — MCP servers, Langflow, Open WebUI/Ollama, Claude Code, and agentic frameworks.
• 66 were already actively exploited (present in CISA’s KEV catalog); of those scored, 53% were High or Critical (78 critical ≥ 9.0, 385 high).
• Mapped to SOC 2, one control dominates: CC6.6 (protecting the system boundary) was implicated in 697 of 1,307 advisories — the modern threat is a boundary problem.

The methodology is at the bottom; the numbers below are from the live pipeline, not a survey.

1. Remote code execution isn’t a category — it’s the baseline

Two out of every three advisories we analyzed were remote code execution. Auth bypass, XSS, path traversal, SSRF, and deserialization together didn’t come close. This matters because RCE collapses the distance between "a bug exists" and "an attacker owns the host" — there’s no lateral chain to build, no privilege to escalate. The advisory is the exploit.

2. The new attack surface: AI infrastructure

The single most notable shift is the arrival of AI tooling as its own vulnerability category. In 60 days we logged 72 advisories in AI infrastructure — and the recurring theme is exactly the one that makes these tools useful: they execute code and reach other systems, but were built for a trusted, local developer and then quietly exposed to the network.

• Model Context Protocol (MCP) servers — OpenClaw, appium-mcp, Uni-CLI, Agentic-Flow, SearXNG MCP, gemini-mcp-tool — with OS command injection, SSRF, and header-forwarding flaws.
• AI app builders and UIs — Langflow (multiple: unauthenticated RCE, file-upload DoS, origin-validation), Open WebUI (targeting arbitrary Ollama backends).
• Agentic / assistant tooling — including data-exfiltration paths in AI coding assistants.

This is the same pattern we documented in the Langflow RCE (CVE-2026-9198) and exposed MCP servers: a code-running service, on the internet, with authentication effectively off. AI infrastructure is being deployed far faster than it is being secured — and traditional scanners, which fingerprint known products and versions, largely can’t see it.

3. Threat-actor leverage is overwhelmingly high

For each advisory the pipeline rates how directly a threat actor can leverage it. 78% came back "High" — meaning weaponizable now, without a chain of preconditions. Only 5% were "Low." Combined with the RCE dominance, the takeaway is that the modern advisory stream is not noise to triage slowly; a majority of it is immediately dangerous.

4. The GRC lens: this is a CC6.6 problem

Here’s the view no other vulnerability report gives you. Because every advisory is mapped to the control it breaks, we can see which part of your compliance program the threat landscape is actually pointed at. It isn’t evenly spread. One SOC 2 control shows up far more than any other.

CC6.6 — boundary protection — is implicated in more than half of everything we analyzed. In plain terms: the threats landing today are overwhelmingly about what you expose and whether it can be reached, not about internal misconfiguration. That is an attack surface management problem before it is a patching problem, and it’s why a clean SOC 2 report and an exposed, code-running service can coexist right up until the breach.

5. Already exploited: the 66 in CISA KEV

66 of the advisories were already in CISA’s Known Exploited Vulnerabilities catalog — being used in the wild, not just theoretically dangerous. The standouts in this window are the ones we broke down individually: the Cisco Secure Firewall VPN flaw, the Langflow RCE, and the Oracle E-Business Suite zero-day. The common thread: internet-facing, unauthenticated, and weaponized within hours to days of disclosure.

Most-affected products in the dataset skewed toward self-hosted and AI/automation tooling — Open WebUI (36 advisories), OpenClaw (32), n8n (26), Gitea (18), Ghost (16), Craft CMS (15), Netty (14), Electron (12). These are the systems teams stand up quickly and forget to put behind a boundary.

What this means for defenders

• Treat "new advisory" as "probably RCE, probably weaponizable now." The triage default has inverted — assume high leverage until proven otherwise.
• Inventory your AI tooling as attack surface. MCP servers, Langflow, Open WebUI and agentic frameworks are code-execution services; if they’re reachable, they’re a target that classic scanners miss.
• Make CC6.6 your first-order control. The data says the boundary — what you expose to the internet — is where the threats are aimed. Continuous external discovery beats periodic patch review.

This is exactly what CATAAM is built to do: continuously discover what you expose (including AI infrastructure), confirm what’s exploitable, and map each finding to the SOC 2 control it breaks so it becomes a tracked obligation, not a surprise. If you’re choosing a platform to do this, compare the best compliance automation software. Start with a free external attack-surface scan, or see how continuous control monitoring keeps the boundary honest between audits.

Methodology

Data covers 1,307 vulnerability advisories ingested between June 13 and August 12, 2026 from two sources: GitHub Security Advisories (1,240) and CISA’s Known Exploited Vulnerabilities catalog (66). Each advisory was analyzed by CATAAM’s threat pipeline, which classifies the vulnerability, rates threat-actor leverage, and maps it to the SOC 2 / ISO 27001 controls it undermines. Vulnerability-class counts are derived from advisory titles and technical summaries (each advisory counted once, in its primary class). CVSS distribution reflects the 866 advisories that carried a CVSS score. "AI infrastructure" is the subset whose product or description matches AI-tooling terms (MCP, Langflow, Ollama/Open WebUI, LLM/agentic frameworks, and similar). Figures are point-in-time and will shift as the catalogs grow.

Want to cite this? Use: “CATAAM threat pipeline analysis of 1,307 advisories, June–August 2026.” We’re happy to share methodology detail — reach us via the site.

Frequently asked questions

How many vulnerabilities did CATAAM analyze, and over what period?

1,307 vulnerability advisories between June 13 and August 12, 2026, drawn from GitHub Security Advisories (1,240) and CISA’s Known Exploited Vulnerabilities catalog (66), each analyzed and mapped to the SOC 2 / ISO 27001 controls it affects.

What share of vulnerabilities were remote code execution?

67% — 873 of the 1,307 advisories analyzed were remote code execution, making it by far the dominant class, ahead of authentication bypass (6%) and XSS (3%).

Is AI infrastructure really a growing attack surface?

Yes. In this 60-day window CATAAM logged 72 advisories in AI infrastructure — MCP servers, Langflow, Open WebUI/Ollama, Claude Code, and agentic frameworks — typically code-execution services that were built for a trusted local developer and then exposed to the network, which classic version-based scanners largely can’t detect.

Which SOC 2 control is most affected by today’s vulnerabilities?

CC6.6 — protection against threats from outside the system boundary — was implicated in 697 of 1,307 advisories, more than half. The current threat landscape is overwhelmingly a boundary/attack-surface problem, which is why external discovery matters more than periodic patch review.