Risky Tech Ranking: Q2 2026 Updates
Coalition’s Risky Tech Ranking is an evolving list of technology providers whose products were vulnerable to exploitation by threat actors. The ranking uses publicly available data to help businesses make more thoughtful decisions about the technologies they adopt.
The Risky Tech Ranking is updated on a quarterly basis, scoring vendors by multiplying the number of vulnerabilities impacting a vendor’s products by the average Coalition Exploit Scoring System (Coalition ESS) score. See past updates to the Risky Tech Ranking:
Below, we’ll examine noteworthy changes in vendor rankings and contributing vulnerabilities in Q2 2026.
How the Risky Tech Ranking evolved in Q2 2026
Overall, the total number of vendors scored by Coalition in the Risky Tech Ranking increased by 1.4% in Q2 2026, growing from 10,388 to 10,530.
Quarter-over-quarter, the total number of contributing vulnerabilities (CVEs) increased by 17.8%, growing from 49,320 to 58,098. Since Q2 2025, contributing vulnerabilities have increased by 36%.
As a result, the Average Vendor Score in Q2 2026 spiked 11.8%, jumping from 0.186 to 0.208. Since Q2 2025, the Average Vendor Score has increased 110%.
Changes among the top 5 rankings
Cisco (↓2)
Cisco fell out of the top 5, moving from #5 to #7. The change was driven by a decrease in the number of contributing vulnerabilities, dropping from 357 CVEs in Q1 2026 to 311 CVEs in Q2 2026.
Despite an increase in its average Coalition ESS score, Cisco’s Average Vendor Score dipped slightly to 32.7. Cisco was overtaken by Oracle and Adobe in the overall ranking.
Oracle (↑3)
Oracle rose into the top 5 for the first time, climbing from #8 to #5. The jump was driven by a spike in the number of contributing vulnerabilities, which increased from 331 in Q1 2026 to 633 in Q2 2026.
Oracle’s Average Vendor Score increased to 40.62 despite a decrease in its average Coalition ESS score. Oracle overtook Adobe, Cisco, and Tenda in the overall ranking.
Notably, Oracle released a record 1,449 security patches to address 1,434 distinct CVEs spanning 334 Oracle products as part of its July Critical Patch Update.
New entries & exits from the top 10
The Q2 2026 update saw two shifts in the top 10 most risky vendors:
Fortinet (↑1): Joined the top 10, climbing from #11 to #10.
Totolink (↓2): Left the top 10, falling from #9 to #11.
AI vendors in the top 20
Two AI vendors cracked the top 20. After debuting in the Risky Tech Ranking in Q1 2026, OpenClaw’s contributing vulnerabilities spiked from 234 to 539 quarter over quarter. Similarly, n8n saw contributing vulnerabilities increase from 50 in Q1 2026 to 88 in Q2 2026.
Significant movement among the top 30
An handful of other vendors experienced shifts of 20 positions or more within the top 30:
Red Hat (↑25): Rose from #41 to #16.
F5 Networks (↑41): Climbed from #61 to #20.
TP-Link (New): Entered the ranking as a new entry at #30.
Why the Risky Tech Ranking is important
Technology products are frequently released with serious security flaws, putting businesses at risk before they have a chance to defend themselves.
More than 48,00 new CVEs were published in the National Vulnerability Database (NVD) in 2025, a 21% increase over 2024. What’s more, the US Cybersecurity and Infrastructure Security Agency (CISA) added 245 new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in 2025.
At Coalition, we frequently encounter technology products and services that do not adequately safeguard businesses, many of which are used by businesses that may become or wish to become Coalition policyholders. Ensuring that only trustworthy technology handles an organization’s sensitive electronic information is not only vital for Coalition policyholders, but also serves the broader public interest by contributing to a safer digital environment across the entire technology ecosystem.
Read more about why we built the ranking and the full methodology.