Risky Tech Ranking: Q2 2026 Updates
Coalition’s Risky Tech Ranking is an evolving list of technology providers whose products were vulnerable to exploitation by threat actors. The ranking uses publicly available data to help businesses make more thoughtful decisions about the technologies they adopt.
The Risky Tech Ranking is updated on a quarterly basis, scoring vendors by multiplying the number of vulnerabilities impacting a vendor’s products by the average Coalition Exploit Scoring System (Coalition ESS) score. See past updates to the Risky Tech Ranking:
Below, we’ll examine noteworthy changes in vendor rankings and contributing vulnerabilities in Q2 2026.
How the Risky Tech Ranking evolved in Q2 2026
Overall, the total number of vendors scored by Coalition in the Risky Tech Ranking increased by 1.4% in Q2 2026, growing from 10,388 to 10,530.
Quarter-over-quarter, the total number of contributing vulnerabilities (CVEs) increased by 17.8%, growing from 49,320 to 58,098. Since Q2 2025, contributing vulnerabilities have increased by 36%.
As a result, the Average Vendor Score in Q2 2026 spiked 11.8%, jumping from 0.186 to 0.208. Since Q2 2025, the Average Vendor Score has increased 110%.
Changes among the top 5 rankings
Cisco (↓2)
Cisco fell out of the top 5, moving from #5 to #7. The change was driven by a decrease in the number of contributing vulnerabilities, dropping from 357 CVEs in Q1 2026 to 311 CVEs in Q2 2026.
Despite an increase in its average Coalition ESS score, Cisco’s Average Vendor Score dipped slightly to 32.7. Cisco was overtaken by Oracle and Adobe in the overall ranking.
Oracle (↑3)
Oracle rose into the top 5 for the first time, climbing from #8 to #5. The jump was driven by a spike in the number of contributing vulnerabilities, which increased from 331 in Q1 2026 to 633 in Q2 2026.
Oracle’s Average Vendor Score increased to 40.62 despite a decrease in its average Coalition ESS score. Oracle overtook Adobe, Cisco, and Tenda in the overall ranking.
Notably, Oracle released a record 1,449 security patches to address 1,434 distinct CVEs spanning 334 Oracle products as part of its July Critical Patch Update.
New entries & exits from the top 10
The Q2 2026 update saw two shifts in the top 10 most risky vendors:
Fortinet (↑1): Joined the top 10, climbing from #11 to #10.
Totolink (↓2): Left the top 10, falling from #9 to #11.
AI vendors in the top 20
Two AI vendors cracked the top 20. After debuting in the Risky Tech Ranking in Q1 2026, OpenClaw’s contributing vulnerabilities spiked from 234 to 539 quarter over quarter. Similarly, n8n saw contributing vulnerabilities increase from 50 in Q1 2026 to 88 in Q2 2026.
Significant movement among the top 30
An handful of other vendors experienced shifts of 20 positions or more within the top 30:
Red Hat (↑25): Rose from #41 to #16.
F5 Networks (↑41): Climbed from #61 to #20.
TP-Link (New): Entered the ranking as a new entry at #30.
Why the Risky Tech Ranking is important
Technology products are frequently released with serious security flaws, putting businesses at risk before they have a chance to defend themselves.
More than 48,00 new CVEs were published in the National Vulnerability Database (NVD) in 2025, a 21% increase over 2024. What’s more, the US Cybersecurity and Infrastructure Security Agency (CISA) added 245 new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in 2025.
At Coalition, we frequently encounter technology products and services that do not adequately safeguard businesses, many of which are used by businesses that may become or wish to become Coalition policyholders. Ensuring that only trustworthy technology handles an organization’s sensitive electronic information is not only vital for Coalition policyholders, but also serves the broader public interest by contributing to a safer digital environment across the entire technology ecosystem.
Read more about why we built the ranking and the full methodology.
The Risky Tech Ranking is based on publicly available data and is intended for general, informational purposes only, and not as legal, professional, or consulting advice; use of the Risky Tech Ranking is solely at your own risk. The Risky Tech Ranking is a list of unaffiliated third-party technology providers ranked by a methodology based on Coalition’s Exploit Scoring System (Coalition ESS), which is powered by generative AI, machine learning, and an underlying algorithm that provides assessment of all publicly disclosed vulnerabilities and evaluates a technology vendor's risk based on the exploitability of reported vulnerabilities over a set time period. Coalition disclaims all warranties, express or implied. Risky Tech Ranking results may vary or fluctuate based on factors outside of Coalition's control. See Coalition’s Terms of Use and Privacy Policy for additional information.
This blog post is designed to provide general information on the topic presented and is not intended to construe or render legal or other professional services of any kind. If legal or other professional advice is required, the services of a professional should be sought. The views and opinions expressed as part of this blog post do not necessarily state or reflect those of Coalition. Neither Coalition nor any of its employees make any warranty of any kind, express or implied, or assume any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, product or process disclosed. The blog post may include links to other third-party websites. These links are provided as a convenience only. Coalition does not endorse, have control over nor assumes responsibility or liability for the content, privacy policy or practices of any such third-party websites.
Copyright © 2026. All rights reserved. Coalition and the Coalition logo are trademarks of Coalition, Inc. All other products and company names are the intellectual property of their respective brand owners.
Related blog posts
Blog
How Login Security Helps Businesses Combat Identity-Based Threats
Business email compromise is the leading driver of cyber claims. Login Security monitors suspicious login activity and kicks out attackers.
Blog
WP2Shell Vulnerabilities Exploited in the Wild
Coalition notified policyholders of critical “WP2Shell’ remote code execution vulnerabilities affecting Wordpress Core.
Blog
What’s Old Is New Again: Attackers Target Resurgent Vulnerabilities
Take a look under the hood of Coalition’s Zero-Day Alerts to learn which vendors appear the most, how we balance new risks with the old, and more.
