How long before a vulnerability is exploited
CISA KEV additions in the last 30 days
Observation window: Sep 1, 2026 – Oct 1, 2026
Vulnerabilities
43Median days from NVD publication to KEV addition
20Products represented in recent additions
- Citrix / NetScaler3
- JFrog / Artifactory3
- Linux / Kernel3
- MikroTik / RouterOS3
- Check Point / Multiple Products2
- Google / Chromium V82
- Microsoft / Windows2
- SonicWall / SMA1000 Appliances2
- Acronis / Backup1
- Adobe / Commerce and Magento1
Scope and limits
Methodology: one record per CVE stored by CyberWorldOps, selected by CISA KEV addition date in the displayed rolling window. Product names are those supplied by CISA. The delay uses NVD publication and KEV addition dates; it does not measure the start of exploitation or time to patch. Missing dates and negative intervals are excluded from the median. This sample is not a ranking of product safety.
Valid date pairs: 31 · Missing publication dates: 0 · KEV additions before NVD publication: 12
CISA KEV · NVD18.3% of exploited vulnerabilities were already under attack before the world knew they existed. Not an estimate: a count across 3238 cases where we hold both dates.
From disclosure to first exploitation
- before disclosure59418.3%
- same day53416.5%
- within 7 days1745.4%
- within 30 days2056.3%
- within a year77824%
- over a year95329.4%
Newly recorded exploitation, by month
Explore the data
| Month | new cases | confirmed by sensors |
|---|---|---|
| October 25 | 105 | 59 |
| November 25 | 68 | 49 |
| December 25 | 58 | 35 |
| January 26 | 73 | 42 |
| February 26 | 86 | 35 |
| March 26 | 83 | 35 |
| April 26 | 102 | 54 |
| May 26 | 87 | 17 |
| June 26 | 76 | 24 |
| July 26 | 75 | 20 |
| August 26 | 116 | 34 |
| September 26 | 151 | 64 |
Who gets hit
The vendors appearing most often in the exploited catalogue.
- Microsoft441
- Cisco123
- Apple107
- Adobe92
- Google78
- Apache67
- Oracle60
- Linux55
- D-Link53
- Fortinet42
How to read these numbers
- The exploitation date is when the entry was recorded, not when the attack began. It is an upper bound: the flaw was already being exploited by that date, possibly earlier.
- The population selects itself. These are all vulnerabilities known to be exploited, so these numbers say nothing about vulnerabilities in general.
- The monthly counts cover the last 730 days. Before that threshold the data is incomplete by construction, not because attacks were rarer.
Exploitation data: VulnCheck KEV and the CISA KEV catalogue. Publication dates: NVD.
Citing this data
Updated
You may reuse these figures with attribution. Suggested wording:
CyberWorldOps, «How long before a vulnerability is exploited», Oct 1, 2026. https://cyberworldops.eu/en/cve/analysis
Published under CC BY 4.0: free to reuse, including commercially, with attribution to CyberWorldOps.
Actively exploited vulnerabilities · Exploited, not yet in the CISA catalogue