Time-to-exploit analytics
How fast vulnerabilities go from publication to confirmed exploitation (CISA KEV), public proof-of-concept and press coverage · last 365 days of KEV additions
KEV additions · 365d
278
Median days publish → KEV
13.2p25 <1 · p75 133
Exploited within 7 days
42%of KEV entries
Median days publish → first news
54.8in our feeds
Median days publish → PoC seen
8.0as tracked here
Known ransomware use
32KEV entries
Recent KEV additions · publication → exploitation gapdays; 0 = same day or exploited before NVD publicationAll →
| CVE | Affected | Published | KEV | → KEV | → news | → PoC | Articles | Risk |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-76461 | Cisco Secure Email Gateway | <1 | <1 | <1 | 15 | 9.82% PoC ×2 | ||
| CVE-2026-42018 | JFrog Artifactory | 29.2 | 29.0 | — | 11 | 7.5<1% | ||
| CVE-2026-42016 | JFrog Artifactory | 45.2 | 44.9 | — | 11 | 8.8<1% | ||
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition | <1 | <1 | <1 | 19 | 10.012% PoC ×9 | ||
| CVE-2026-84869 | ConnectWise ScreenConnect | 2.2 | 1.0 | — | 6 | 9.9<1% | ||
| CVE-2026-86060 | MikroTik RouterOS | 4.2 | <1 | 4.3 | 13 | 9.21% PoC ×2 | ||
| CVE-2026-67277 | MikroTik RouterOS | 4.2 | 1.2 | — | 9 | 8.8<1% PoC | ||
| CVE-2025-25249 | Fortinet Multiple Products | 238 | 238 | — | 10 | 9.82% PoC | ||
| CVE-2026-87491 | Google Chromium V8 | <1 | <1 | — | 29 | 8.8<1% | ||
| CVE-2026-19490 | Citrix NetScaler | 20.4 | <1 | 22.1 | 11 | 9.36% PoC | ||
| CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 188 | 147 | — | 28 | 10.076% PoC ×2 | ||
| CVE-2026-81963 | Microsoft Windows | <1 | <1 | — | 26 | 7.8<1% | ||
| CVE-2026-86218 | N-able N-central | 1.9 | <1 | 6.3 | 14 | 10.0<1% PoC | ||
| CVE-2026-75650 | Adobe Commerce and Magento | <1 | <1 | <1 | 28 | 10.02% PoC | ||
| CVE-2026-85880 | Microsoft Windows | <1 | <1 | — | 41 | 7.8<1% | ||
| CVE-2026-85046 | Google Chromium V8 | <1 | <1 | 3.4 | 34 | 8.81% PoC ×5 | ||
| CVE-2026-83548 | SonicWall SMA1000 Appliances | <1 | <1 | — | 14 | 10.05% | ||
| CVE-2026-48710 | Kludex Starlette | 98.1 | 98.6 | — | 5 | 6.536% PoC ×3 | ||
| CVE-2026-83549 | SonicWall SMA1000 Appliances | <1 | <1 | — | 14 | 7.89% | ||
| CVE-2026-59822 | BerriAI LiteLLM | 55.2 | 55.7 | — | 6 | 8.8<1% | ||
| CVE-2026-49869 | Kestra Kestra OSS | 67.1 | 67.6 | — | 2 | 10.02% PoC | ||
| CVE-2026-82329 | JFrog Artifactory | 4.2 | 4.0 | 9.7 | 18 | 9.88% PoC ×2 | ||
| CVE-2026-9586 | Sangoma Switchvox | 46.3 | 45.7 | — | 7 | 9.312% PoC | ||
| CVE-2026-82078 | PaperCut NG/MF | 2.3 | <1 | — | 26 | 9.42% | ||
| CVE-2026-81578 | PaperCut NG/MF | 2.3 | <1 | — | 26 | 8.82% | ||
| CVE-2023-49105 | ownCloud ownCloud | 1009 | 1010 | — | 6 | 9.843% | ||
| CVE-2026-53362 | Linux Kernel | 53.5 | 54.0 | — | 4 | 7.8<1% | ||
| CVE-2026-66384 | JFrog Artifactory | 14.3 | 14.8 | — | 3 | 5.3<1% | ||
| CVE-2019-1068 | Microsoft SQL Server | 2598 | 2599 | — | 6 | 8.853% | ||
| CVE-2022-0995 | Linux Kernel | 1614 | 1615 | — | 4 | 7.810% PoC ×2 |
CVEs published per day · 30 daysNVD + GitHub advisories
Table view
| Day | CVSS < 9 | CVSS ≥ 9 |
|---|---|---|
| 2026-08-17 | 277 | 65 |
| 2026-08-18 | 1,204 | 221 |
| 2026-08-19 | 575 | 107 |
| 2026-08-20 | 401 | 82 |
| 2026-08-21 | 253 | 41 |
| 2026-08-22 | 205 | 37 |
| 2026-08-23 | 40 | 6 |
| 2026-08-24 | 277 | 42 |
| 2026-08-25 | 676 | 97 |
| 2026-08-26 | 318 | 84 |
| 2026-08-27 | 460 | 68 |
| 2026-08-28 | 505 | 79 |
| 2026-08-29 | 52 | 13 |
| 2026-08-30 | 95 | 5 |
| 2026-08-31 | 282 | 81 |
| 2026-09-01 | 392 | 62 |
| 2026-09-02 | 323 | 29 |
| 2026-09-03 | 312 | 41 |
| 2026-09-04 | 498 | 57 |
| 2026-09-05 | 126 | 19 |
| 2026-09-06 | 79 | 11 |
| 2026-09-07 | 239 | 16 |
| 2026-09-08 | 1,478 | 93 |
| 2026-09-09 | 608 | 64 |
| 2026-09-10 | 322 | 62 |
| 2026-09-11 | 601 | 110 |
| 2026-09-12 | 78 | 13 |
| 2026-09-13 | 128 | 3 |
| 2026-09-14 | 730 | 54 |
| 2026-09-15 | 589 | 46 |
How long until exploitation?KEV entries · 365 days
- same day78
- 1–7 days40
- 8–30 days42
- 31–90 days36
- 91–365 days39
- > 1 year43
Gap between NVD publication and CISA KEV listing. “Same day” includes flaws exploited as zero-days before publication.
Vendors in KEV · 365 daysAll →
| Vendor | KEV | Median days | Ransomware |
|---|---|---|---|
| Microsoft | 48 | <1 | 5 |
| Cisco | 20 | <1 | 2 |
| Fortinet | 10 | 21.3 | 0 |
| Apple | 10 | 108 | 0 |
| 10 | <1 | 0 | |
| Adobe | 7 | 25.4 | 0 |
| Oracle | 7 | 30.2 | 3 |
| Synacor | 6 | 140 | 0 |
| Linux | 6 | 1551 | 0 |
| Ivanti | 5 | 1.3 | 0 |
| SonicWall | 5 | <1 | 2 |
| Broadcom | 4 | 24.4 | 1 |
| JFrog | 4 | 21.8 | 0 |
| SolarWinds | 4 | 10.2 | 1 |
“PoC seen” is when this dashboard first saw a public exploit reference (GitHub repos, NVD exploit tags); it starts from the day the tracker went live, so early values are conservative. “First news” is the earliest article in our feeds mentioning the CVE.