diff --git a/changes/27580-vuln-counts b/changes/27580-vuln-counts
new file mode 100644
index 0000000000..92907e78bf
--- /dev/null
+++ b/changes/27580-vuln-counts
@@ -0,0 +1 @@
+* Fixed cases where the vulnerabilities list endpoint would count the same CVE multiple times for the `count` field returned with a result set
diff --git a/server/datastore/mysql/vulnerabilities.go b/server/datastore/mysql/vulnerabilities.go
index 2dab5e127b..d2b0af7168 100644
--- a/server/datastore/mysql/vulnerabilities.go
+++ b/server/datastore/mysql/vulnerabilities.go
@@ -309,11 +309,11 @@ func (ds *Datastore) ListVulnerabilities(ctx context.Context, opt fleet.VulnList
 func (ds *Datastore) CountVulnerabilities(ctx context.Context, opt fleet.VulnListOptions) (uint, error) {
 	selectStmt := `
 		SELECT
-			COUNT(*)
+			COUNT(DISTINCT combined.cve)
 		FROM (
-			SELECT cve, created_at, source FROM software_cve
+			SELECT cve FROM software_cve
 			UNION
-			SELECT cve, created_at, source FROM operating_system_vulnerabilities
+			SELECT cve FROM operating_system_vulnerabilities
 		) AS combined
 		INNER JOIN vulnerability_host_counts vhc ON vhc.cve = combined.cve
 		LEFT JOIN cve_meta cm ON cm.cve = combined.cve
diff --git a/server/datastore/mysql/vulnerabilities_test.go b/server/datastore/mysql/vulnerabilities_test.go
index 7d08837e29..1a8bf52cd0 100644
--- a/server/datastore/mysql/vulnerabilities_test.go
+++ b/server/datastore/mysql/vulnerabilities_test.go
@@ -1140,6 +1140,10 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 			CVE:               "CVE-2020-1235",
 			ResolvedInVersion: ptr.String("1.0.1"),
 		},
+		{
+			SoftwareID: 2,
+			CVE:        "CVE-2020-1235", // overlaps software ID 1
+		},
 		{
 			SoftwareID: 2,
 			CVE:        "CVE-2020-1236",
@@ -1148,6 +1152,10 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 			SoftwareID: 2,
 			CVE:        "CVE-2020-1237",
 		},
+		{
+			SoftwareID: 2,
+			CVE:        "CVE-2020-1238", // overlaps between software and OS
+		},
 	}
 
 	osVulns := []fleet.OSVulnerability{
@@ -1374,7 +1382,7 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 
 	// Insert Software Vuln
 	for _, vuln := range softwareVulns {
-		_, err = ds.InsertSoftwareVulnerability(context.Background(), vuln, fleet.NVDSource)
+		_, err = ds.InsertSoftwareVulnerability(context.Background(), vuln, fleet.CustomSource)
 		require.NoError(t, err)
 	}