How long before a vulnerability is exploited
CISA KEV additions in the last 30 days
Observation window: Oct 16, 2026 – Nov 15, 2026
Vulnerabilities
33Median days from NVD publication to KEV addition
7Products represented in recent additions
- Plex / Media Server4
- Ivanti / Connect Secure2
- PHP Group / PHP2
- Adobe / Commerce and Magento1
- Apple / Multiple Products1
- Arista / VeloCloud Orchestrator1
- Barracuda Networks / Barracuda Email Security Gateway (ESG)1
- Barracuda Networks / Multiple Products1
- Broadcom / VMware ESX1
- Check Point / Multiple Products1
Scope and limits
Methodology: one record per CVE stored by CyberWorldOps, selected by CISA KEV addition date in the displayed rolling window. Product names are those supplied by CISA. The delay uses NVD publication and KEV addition dates; it does not measure the start of exploitation or time to patch. Missing dates and negative intervals are excluded from the median. This sample is not a ranking of product safety.
Valid date pairs: 29 · Missing publication dates: 0 · KEV additions before NVD publication: 4
CISA KEV · NVD17.7% of exploited vulnerabilities were already under attack before the world knew they existed. Not an estimate: a count across 3536 cases where we hold both dates.
From disclosure to first exploitation
- before disclosure62717.7%
- same day58916.7%
- within 7 days2015.7%
- within 30 days2396.8%
- within a year89625.3%
- over a year98427.8%
Newly recorded exploitation, by month
Explore the data
| Month | new cases | confirmed by sensors |
|---|---|---|
| December 25 | 58 | 35 |
| January 26 | 74 | 43 |
| February 26 | 86 | 38 |
| March 26 | 83 | 36 |
| April 26 | 103 | 54 |
| May 26 | 87 | 19 |
| June 26 | 78 | 25 |
| July 26 | 77 | 21 |
| August 26 | 116 | 40 |
| September 26 | 164 | 74 |
| October 26 | 331 | 63 |
| November 26 · In progress | 172 | 46 |
Who gets hit
The vendors appearing most often in the exploited catalogue.
- Microsoft446
- Cisco126
- Apple108
- Adobe93
- Google80
- Apache80
- Oracle62
- Linux56
- D-Link56
- Fortinet45
How to read these numbers
- The exploitation date is when the entry was recorded, not when the attack began. It is an upper bound: the flaw was already being exploited by that date, possibly earlier.
- The population selects itself. These are all vulnerabilities known to be exploited, so these numbers say nothing about vulnerabilities in general.
- The monthly counts cover the last 730 days. Before that threshold the data is incomplete by construction, not because attacks were rarer.
Exploitation data: VulnCheck KEV and the CISA KEV catalogue. Publication dates: NVD.
Citing this data
Updated
You may reuse these figures with attribution. Suggested wording:
CyberWorldOps, «How long before a vulnerability is exploited», Nov 15, 2026. https://cyberworldops.eu/en/cve/analysis
Published under CC BY 4.0: free to reuse, including commercially, with attribution to CyberWorldOps.
Actively exploited vulnerabilities · Exploited, not yet in the CISA catalogue