Web Application Attack Statistics 2026: Vulnerabilities, Attacks & Breaches

Executive Benchmark: Web Application Attack Statistics for 2026

Methodology: What Counts as a Web Application Attack?

“Web application attack” is used for four different measurements. Each answers a different question, comes from a different kind of source, and can be wrong in a different way.

Source confidence. OWASP’s rankings combine incidence rate (the share of tested applications with at least one instance of a weakness), coverage, exploit and impact scores from CVE data, and total occurrences; two of the ten categories were added by community survey. MITRE’s CWE Top 25 scores weaknesses by how often they appear in NVD records and their average CVSS severity. CISA’s catalog lists vulnerabilities with reliable evidence of exploitation, which is a floor, not a census. Verizon’s DBIR is a contributed corpus: its regional chapter says visibility depends on disclosure laws and where contributors work. Vendor telemetry (Akamai, Cloudflare, Edgescan) describes that vendor’s customers and tests.

Web Application Vulnerability Statistics: OWASP Top 10:2025

The OWASP Top 10:2025 draws on data from more than 2.8 million applications reported by contributors including Bugcrowd, Contrast Security, Semgrep, Sonar, Veracode and Wallarm. OWASP extracted about 220,000 CVEs from OWASP Dependency Check data, mapped about 175,000 of them to CWEs, and used them for exploit and impact scores.

Broken access control leads with 1,839,701 occurrences

A01:2025 Broken Access Control keeps first place with 1,839,701 occurrences, 32,654 mapped CVEs and 40 mapped CWEs. Its average incidence rate is 3.74% and its maximum is 20.15%. OWASP folds server-side request forgery (CWE-918) into this category; for how that attack works, see ScanTitan’s guide to server-side request forgery.

Injection maps to the most CVEs, 62,445

A05:2025 Injection has 62,445 mapped CVEs, the most of any category, across 37 CWEs. OWASP puts cross-site scripting at more than 30,000 of them and SQL injection at more than 14,000. Injection has 1,404,249 occurrences, third by that measure, with an average incidence of 3.08%.

Security misconfiguration has the highest maximum incidence, 27.70%

A02:2025 Security Misconfiguration reaches a maximum incidence of 27.70%, the highest of the ten, though its average is 3.00%. It has 719,084 occurrences and 1,375 mapped CVEs.

Software supply chain failures have the fewest occurrences

A03:2025 Software Supply Chain Failures has 215,248 occurrences, the fewest, and only 11 mapped CVEs. OWASP ranks it third because it was top-ranked in the community survey, with exactly 50% of respondents placing it first, and because of its exploit and impact scores. Note that OWASP’s page gives the average incidence as 5.72% in its score table and 5.19% in its background text, so this report quotes neither. For the package, build-pipeline and dependency numbers behind this category, see ScanTitan’s software supply chain attack statistics.

Full OWASP Top 10:2025 data

Source: OWASP Top 10:2025 category pages, read 15 October 2026. A03’s average incidence is omitted because OWASP’s page gives two different values.

Why the three OWASP rankings differ

Sorted by occurrences, cryptographic failures is second. Sorted by CVEs, injection is first by a wide margin and cryptographic failures drops to seventh. Sorted by average incidence, security logging and alerting failures (3.91%) leads the categories whose average is unambiguous. OWASP’s own ranking blends incidence, coverage, exploit and impact and total occurrences, so no single column reproduces it.

CWE Top 25: Cross-Site Scripting and SQL Injection Still Lead

MITRE’s 2025 CWE Top 25 analyzed 39,080 CVE records published from 1 June 2024 to 1 June 2025. Its score multiplies how often a weakness is mapped to a CVE in the NVD by the average CVSS severity of those CVEs. The page reports a KEV count for each weakness alongside the score.

Source: MITRE 2025 CWE Top 25 and methodology. Memory-safety weaknesses, such as out-of-bounds write at rank 5, are omitted because they are mostly not web application issues.

Three details matter for interpretation. Cross-site scripting leads the list on volume, but only 7 of its CVEs in this window were in the KEV catalog, so volume and exploitation point at different weaknesses. Cross-site request forgery is third with no KEV entries in the window. And authorization bypass through a user-controlled key, the weakness behind insecure direct object reference flaws, rose six places to 24th.

Exploited in the Wild: CISA KEV Entries by Web Weakness

CISA’s Known Exploited Vulnerabilities catalog listed 1,745 entries in version 2026.10.14, released 14 October 2026. 261 were added in 2026 so far, more than the 245 added in all of 2025. Of the 1,745 entries, 361 (20.7%) are marked as used in ransomware campaigns, a figure that covers all weaknesses, not only web ones. ScanTitan counted the catalog’s CWE tags directly from CISA’s data feed.

Counting rules: catalog version 2026.10.14; 1,570 of the 1,745 entries list at least one CWE; an entry can carry several CWEs, so the rows overlap and must not be summed; the list of 18 CWEs is ScanTitan’s selection of web-relevant weaknesses. Entries with at least one of those CWEs number 633, or 36% of the catalog.

By year, the web-tagged share of additions rose from 42.0% (103 of 245) in 2025 to 48.7% (127 of 261) in 2026. OS command injection is the most frequent of the 18 web-relevant weaknesses counted here; for how it works, see ScanTitan’s guide to OS command injection. For the wider KEV and CVE picture, see ScanTitan’s vulnerability statistics.

Web Application Attack Statistics by Year

No single source tracks web application attacks across years, so this section shows three separate series. They share a calendar, not a unit.

Exploited vulnerabilities added to CISA’s catalog, by calendar year

Basic Web Application Attacks as a share of confirmed breaches, by DBIR edition

Akamai web attack counts (vendor-only)

The DBIR share fell from 18% to 10% in the same edition in which exploitation of vulnerabilities, as an action, doubled to 32% of all breaches from 18%. Verizon’s own reading is that the pattern is trending down in favor of the more complicated System Intrusion pattern, which suggests either that defenders are raising the bar or that attackers use their initial access for more complex objectives.

Confirmed Breaches: What the DBIR Shows About Web Application Attacks

Verizon’s 2026 DBIR covers more than 31,000 incidents and more than 22,000 confirmed breaches in 145 countries; the pattern figures use a dataset of 22,624 breaches. Its Basic Web Application Attacks pattern, described as the “door left open” end of the attack spectrum, covers 3,217 incidents, 2,281 with confirmed data disclosure.

Basic Web Application Attacks are 10% of breaches, down from 18%

Across the three most recent editions, the pattern’s share of breaches was 9%, 18% and 10%, while System Intrusion rose from 36% to 53% to 61%.

Source: Verizon 2026 DBIR Executive Summary. The 2025 column sums to 107%, so patterns are not mutually exclusive.

Stolen credentials 56%, exploited vulnerabilities 53%

Inside the pattern, the top actions in the 2,193 analyzed breaches were:

Threat actors were external in 100% of these breaches. Motives were financial in 74%, espionage in 23% and ideology in 3%. Credentials were compromised in 52% of the breaches, internal data in 48%, other data in 33% and secrets in 15%. A breach can involve several actions, so the shares overlap.

Five measures of “exploitation,” five denominators

Exploitation appears in at least five figures from three publishers. They are not interchangeable:

Sources: Verizon 2026 DBIR; IBM X-Force 2026 release; Google Cloud, M-Trends 2026. IBM separately reports a 44% increase in attacks that began with exploitation of public-facing applications; that is a growth rate, not a share.

Initial access: exploitation 31%, credential abuse 13%

Exploitation of vulnerabilities is now the most common initial access vector in the DBIR, rising to 31% while credential abuse, the previous leader, fell to 13%. The use of stolen credentials as an action held steady at 36% of all breaches, which is why credentials still matter inside breaches even as exploitation leads on entry.

Web Application Attack Statistics by Industry and Company Size

Exploitation of vulnerabilities as an initial access vector varies widely by industry.

Source: Verizon 2026 DBIR Executive Summary. Each share is within that industry’s breach dataset.

Basic Web Application Attacks sit among the three leading patterns, together with System Intrusion and Social Engineering, for retail (95% of breaches), manufacturing (91%) and small and medium-sized businesses (100%). In public administration the pattern dropped out of the top group this year, and in healthcare and education it is not in the top three.

Web Application Attack Statistics by Region

Verizon splits its 2026 dataset into four regions. Regional shares reflect who contributes data, not only where attacks occur.

Source: Verizon 2026 DBIR, Table 5. In APAC, Basic Web Application Attacks doubled from the previous report to 22% of breaches. In EMEA the top three patterns are System Intrusion, Social Engineering and Miscellaneous Errors, so the pattern is outside the leading group there.

Akamai’s vendor-only telemetry shows the same regional unevenness in attack volume: in Asia-Pacific and Japan, web attacks rose 73% from 29 billion in 2023 to 51 billion in 2024, and in EMEA 37% of 116 billion web attacks targeted APIs. These are counts of attack attempts against Akamai’s customers.

Attack Traffic Statistics (Vendor-Only)

Edge vendors see requests, not breaches. These figures describe their own customer traffic, include blocked and automated requests, and are not a census of the internet.

Akamai, State of Apps and API Security 2025 (2024 data). Akamai reported 311 billion web attacks in 2024, up 33% year over year. Web attacks rose 65% between Q1 2023 and Q4 2024, from 14 billion to more than 29 billion, and Layer 7 DDoS attacks grew 94%, from just over 500 billion to more than 1.1 trillion monthly. Commerce was the most attacked industry, with more than 230 billion web attacks, nearly triple the count for high technology. Akamai also documented 150 billion API attacks from January 2023 through December 2024.

Cloudflare Radar 2025 Year in Review (1 January to 2 December 2025). 6.2% of global traffic on Cloudflare’s network was mitigated, a quarter of a point lower than 2024, and 3.3% was mitigated as a DDoS attack or by managed rules. Cloudflare notes that “mitigated” includes traffic customers chose to block for non-security reasons, so 6.2% is not an attack rate.

Web Application vs API Attacks

APIs are the fastest-growing part of the attack telemetry. Akamai’s 2026 report says the average number of API attacks per enterprise per day was 258 in 2025, up 113% from 121 in 2024, and that about 61% of API attacks in 2025 involved unauthorized workflows and abnormal activity, up from 30% in 2024. Akamai describes APIs as the dominant attack surface for modern enterprises; that is the vendor’s conclusion from its customers’ traffic.

The two periods do not line up: the 150 billion API figure covers 24 months, while the 311 billion web figure covers 2024 alone, so do not subtract one from the other. For the API-specific risk list, see ScanTitan’s guide to the OWASP API Security Top 10.

Time to Exploit vs Time to Patch

Sources: Mandiant; Verizon; IBM; Edgescan.

A negative mean time to exploit means exploitation typically begins before a patch is released. Mandiant calls it an estimate, based on its own 2025 investigations. The population behind each row differs, so each figure is meaningful only against its own baseline. Prioritizing by exploitation evidence rather than raw severity is the practical consequence; ScanTitan’s CVE priority checker is built for that kind of triage.

IBM adds a cost angle: in its 2026 report, breaches that began by exploiting a public-facing application averaged $4.68 million, the lowest of the eight initial attack vectors it charts and below the $4.99 million global average. IBM’s study covers 602 breached organizations, with breaches between March 2025 and February 2026.

Notable Incident: MOVEit Transfer SQL Injection

CISA’s advisory AA23-158A, published 7 June 2023 and updated 16 June 2023, describes the MOVEit Transfer compromise as exploitation of a previously unknown SQL injection vulnerability, tracked as CVE-2023-34362. Per open-source information cited by CISA, the CL0P ransomware group, also known as TA505, began exploiting it on 27 May 2023. The group dropped a web shell first seen as human2.aspx, named to look like the legitimate human.aspx file in MOVEit Transfer, and CISA calls the malware LEMURLOOT.

CISA’s advisory gives no victim count for the MOVEit campaign, and this report does not quote one. Larger totals for affected organizations and individuals circulate elsewhere, but they do not come from CISA and this report does not quote them. A victim count is a different unit from the vulnerability and the attack, and should always name its source.

Web Application Attack Statistics Commonly Misquoted

What the Numbers Mean for a Lean Team

For a small team, the data points to four priorities. First, authorization: broken access control tops OWASP, missing authorization rose five places in the CWE Top 25 to fourth, and these flaws appear only when someone tests who can do what. Second, credentials: stolen credentials were used in 56% of Basic Web Application Attacks breaches, so strong authentication and rapid credential revocation matter as much as patching. Third, exploitation evidence: only 26% of CISA KEV vulnerabilities were fully remediated, and exploitation often begins before a patch, so internet-facing software should be patched by whether it is being exploited, not by label. Fourth, visibility: you cannot fix web flaws you have not found.

ScanTitan’s website vulnerability scanner checks internet-facing sites for known weaknesses. It does not replace authenticated testing of access control, code review, or patch management, and none of the figures in this report depend on any ScanTitan product.

How We Compiled and Verified These Statistics

Every figure was checked against the named source on 15 October 2026. OWASP figures come from each category page. The CWE Top 25 table was read from MITRE. The KEV counts were computed by ScanTitan from CISA’s published data feed (version 2026.10.14); the list of web-relevant CWEs is ScanTitan’s selection, shown in full in the KEV section. The DBIR figures come from the full 2026 report (pattern page 54, regional chapter page 100) and the executive summary. Charts in the DBIR were read directly where the text did not give the value.

• Used: OWASP, MITRE, CISA, Verizon, IBM, Google Cloud (Mandiant), and vendor primary reports from Akamai, Cloudflare and Edgescan, labeled vendor-only.
• Excluded: secondary summaries, vendor marketing pages, and figures that could not be traced to a primary source, including claimed victim totals for MOVEit, the 80% share of incidents attributed to web applications, and several fix-time figures behind registration forms.
• Refresh: Reviewed every 90 days. KEV counts change monthly; OWASP, MITRE, Verizon and IBM update on their annual cycles.

How to cite this research. ScanTitan, “Web Application Attack Statistics 2026: Vulnerabilities, Attacks & Breaches,” 15 October 2026. For single figures, cite the primary source listed beside each number; cite the KEV class counts to this page with the catalog version date.

Primary Sources

• OWASP Top 10:2025 and its introduction and data summary
• OWASP category pages: A01, A02, A03, A04, A05, A06, A07, A08, A09, A10
• MITRE 2025 CWE Top 25 and methodology
• CISA Known Exploited Vulnerabilities catalog data feed
• CISA advisory AA23-158A, MOVEit Transfer
• Verizon 2026 Data Breach Investigations Report
• Verizon 2026 DBIR Executive Summary
• IBM Cost of a Data Breach Report 2026
• IBM 2026 X-Force Threat Intelligence Index release and IBM Think summary
• Google Cloud, M-Trends 2026
• Akamai, State of Apps and API Security 2025 press release and blog summary
• Akamai, Apps, APIs and DDoS 2026 report
• Cloudflare Radar 2025 Year in Review
• Edgescan 2026 Vulnerability Statistics Report summary

Frequently Asked Questions