How long before a vulnerability is exploited
CISA KEV additions in the last 30 days
Observation window: Sep 11, 2026 – Oct 11, 2026
Vulnerabilities
30Median days from NVD publication to KEV addition
48Products represented in recent additions
- Citrix / NetScaler3
- Linux / Kernel3
- Check Point / Multiple Products2
- Zammad GmbH / Zammad2
- Acronis / Backup1
- Adobe / Commerce and Magento 1
- Apache / Struts1
- Apple / Multiple Products1
- Arista / VeloCloud Orchestrator1
- Cisco / Catalyst SD-WAN Manager1
Scope and limits
Methodology: one record per CVE stored by CyberWorldOps, selected by CISA KEV addition date in the displayed rolling window. Product names are those supplied by CISA. The delay uses NVD publication and KEV addition dates; it does not measure the start of exploitation or time to patch. Missing dates and negative intervals are excluded from the median. This sample is not a ranking of product safety.
Valid date pairs: 19 · Missing publication dates: 0 · KEV additions before NVD publication: 11
CISA KEV · NVD18.3% of exploited vulnerabilities were already under attack before the world knew they existed. Not an estimate: a count across 3279 cases where we hold both dates.
From disclosure to first exploitation
- before disclosure59918.3%
- same day54716.7%
- within 7 days1805.5%
- within 30 days2106.4%
- within a year78423.9%
- over a year95929.2%
Newly recorded exploitation, by month
Explore the data
| Month | new cases | confirmed by sensors |
|---|---|---|
| November 25 | 68 | 49 |
| December 25 | 58 | 35 |
| January 26 | 73 | 42 |
| February 26 | 86 | 36 |
| March 26 | 83 | 36 |
| April 26 | 102 | 54 |
| May 26 | 87 | 17 |
| June 26 | 76 | 24 |
| July 26 | 75 | 20 |
| August 26 | 116 | 35 |
| September 26 | 160 | 65 |
| October 26 · In progress | 31 | 5 |
Who gets hit
The vendors appearing most often in the exploited catalogue.
- Microsoft441
- Cisco123
- Apple107
- Adobe92
- Google78
- Apache68
- Oracle61
- D-Link55
- Linux55
- Fortinet43
How to read these numbers
- The exploitation date is when the entry was recorded, not when the attack began. It is an upper bound: the flaw was already being exploited by that date, possibly earlier.
- The population selects itself. These are all vulnerabilities known to be exploited, so these numbers say nothing about vulnerabilities in general.
- The monthly counts cover the last 730 days. Before that threshold the data is incomplete by construction, not because attacks were rarer.
Exploitation data: VulnCheck KEV and the CISA KEV catalogue. Publication dates: NVD.
Citing this data
Updated
You may reuse these figures with attribution. Suggested wording:
CyberWorldOps, «How long before a vulnerability is exploited», Oct 11, 2026. https://cyberworldops.eu/en/cve/analysis
Published under CC BY 4.0: free to reuse, including commercially, with attribution to CyberWorldOps.
Actively exploited vulnerabilities · Exploited, not yet in the CISA catalogue