Summary of the Fourth International Workshop on Software Vulnerability Management (SVM 2026)

Software vulnerabilities can cause severe operational and financial damage to individuals and organizations in the event of cyber attacks. For example, the Log4J vulnerability can make millions of systems worldwide open to cyber attacks and potentially cause billions of dollars of damage. Software Vulnerability Management (SVM) is a critical process during software development to ensure software security and prevent these dangerous cyber attacks. SVM typically contains various phases such as detection, assessment, prioritization, fixing/patching, and reporting/disclosure. In the last 10 years, there has been an unprecedented rise in the size and complexity of software systems. For instance, the codebase of Google services contains more than two billion lines of code. This in turn requires new technologies, tools, and practices for SVM to ensure the security of such systems. The 4th International Workshop on Software Vulnerability Management (SVM 2026), co-located with ICSE 2026 in Rio de Janeiro, Brazil, provided a venue that brought together academics, industry, and government practitioners to present and discuss the state-of-the-art and state-of-the-practice of SVM to support both current and emerging software technologies and infrastructures. The workshop featured one invited talk and six paper presentations covering vulnerability management for cyber-physical systems, enhancements to static analysis for vulnerability detection and cryptographic API misuse, the use of Large Language Models (LLMs) for secure coding and vulnerability analysis, as well as human factors in the reintroduction of vulnerabilities.