Known exploited flaws take a median 87 days to patch, Moody's says
Original title: Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds
Flaws without known exploitation take 107 days at the median, using February 2026 Bitsight data.
A Moody's report published October 19 says known exploited vulnerabilities have a median remediation time of 87 days, leaving half unpatched three months after disclosure. Vulnerabilities with no known exploitation evidence take a median of 107 days. The figures use February 2026 Bitsight data on flaws disclosed over the prior two years. The report also says AI is speeding vulnerability discovery and that fully autonomous attack limits may be temporary.
Unconfirmed: Moody's says AI advances since the February data may have changed exploit and remediation times.
- Microsoft set security-update records across three consecutive 2026 Patch Tuesdays.
- Cited OpenAI and Anthropic containment failures were in testing, not attacker campaigns.
- Moody's says no comparable public threat-actor campaign has been documented.
- The UK AI Security Institute estimates a four-to-seven-month open-weight capability gap.
- Vendors
- Microsoft
- Countries
- United Kingdom
From the original article
2 min read at infosecurity-magazine.com
Known exploited vulnerabilities take a median time of 87 days to be patched, according to a new Moody’s report
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.