AI-Driven Vulnerability Discovery Triggers Record Patch Volumes and Remediation Gaps

Oracle issued a record quarterly security update with 1,449 patches across its product portfolio, while also shifting to monthly Critical Security Patch Updates for the most severe flaws. The company said the surge is tied largely to AI-assisted internal vulnerability discovery, and the release includes multiple high-risk issues such as CVE-2026-47056 and CVE-2026-60217, both rated CVSS 10.0 and described as remotely exploitable without authentication, alongside serious Oracle Database Server flaws including CVE-2026-61211 and CVE-2026-47040.

Government and industry warnings say organizations should expect a broader patch wave as AI accelerates both vulnerability discovery and attacker exploitation. Research on 1,646 open source CVEs linked to multiple patches found that remediation often spans several commits rather than a single fix, with 641 cases involving incomplete initial patches and 31.7% of multi-patch fixes taking more than a day to complete, leaving residual exposure. Security agencies are urging defenders to prioritize internet-facing and critical systems, isolate or replace unsupported technology, and verify whether follow-up or branch-specific patches are still pending instead of assuming the first published fix fully closes the risk.