Time to exploit is how long attackers take to exploit a vulnerability after it becomes known. Mandiant's average fell from 63 days in 2018 to an estimated minus 7 days in 2025, so exploitation now usually starts before a patch exists. In our own analysis of CISA's catalog, half of 2026's new vulnerabilities were confirmed exploited within 4 days of their CVE being published.
What is time to exploit?
Time to exploit (TTE) is the gap between a vulnerability becoming known and attackers exploiting it. A positive number means defenders had some warning. A negative number means attackers got there first.
Different researchers start the clock at different points, so their numbers aren't directly comparable:
| Who measures it | Clock starts at | Clock stops at |
|---|---|---|
| Mandiant / GTIG | Patch release | First observed exploitation |
| VulnCheck | CVE publication | First evidence of exploitation |
| Cylent (this page) | CVE publication on cve.org | CISA adding it to the KEV catalog |
Our metric measures how much public warning a defender gets before the US government confirms a bug is under attack. Exploitation often started earlier than CISA's date, so read it as an upper bound.
How fast are vulnerabilities exploited in 2026?
Faster than patches ship. Mandiant has tracked the average time to exploit since 2018:
Average time to exploit, 2018–2025
Days from patch release to exploitation. Below zero, attackers were first.
| Period | Average time to exploit |
|---|---|
| 2018–2019 | 63 days |
| 2020 – early 2021 | 44 days |
| 2021–2022 | 32 days |
| 2023 | 5 days (47 including 15 outliers) |
| 2024 | −1 day |
| 2025 | −7 days (estimated mean) |
In Mandiant's words, a negative number "indicates that exploitation of a vulnerability, on average, occurred before a patch was released." The same report found that exploits were the most common way attackers got in for the sixth year in a row, at 32% of intrusions.
Cylent analysis: how fast does CISA confirm exploitation in 2026?
For most new vulnerabilities, within days. We took CISA's Known Exploited Vulnerabilities (KEV) catalog as of October 30, 2026 and matched every 2026 addition to its publication date on cve.org.
Volume is up. CISA added 282 vulnerabilities to KEV between January 1 and October 30, 2026, compared with 214 in the same period of 2025, a 32% increase. September 2026 had 43 additions, the most in any month of the past two years.
Most are new bugs. 195 of the 282 (69%) carry a 2026 CVE ID. For those 2026 vulnerabilities:
How fast 2026 CVEs were confirmed exploited
Share of 2026 CVEs added to CISA KEV within each window after publication (n = 194).
| Time from CVE publication to CISA KEV | Share of 2026 CVEs |
|---|---|
| Same day or earlier | 27% |
| Within 1 day | 40% |
| Within 7 days | 60% |
| Within 30 days | 81% |
| Median | 4 days |
The same-day cases are mostly appliances. Of the 53 vulnerabilities added on or before their CVE publication date, about half came from network and security appliance vendors: Cisco, Citrix NetScaler, Ivanti Connect Secure, Palo Alto PAN-OS, Fortinet, Check Point, F5, Arista and SonicWall. Most of the rest were Microsoft vulnerabilities that were already exploited when the patch shipped.
Old bugs still count. 32 of this year's additions (11%) are CVEs from 2022 or earlier. A vulnerability doesn't stop being dangerous because it's old.
The deadlines got shorter. Under CISA's new directive, BOD 26-04, 150 of the 282 additions came with a three-day remediation deadline for federal agencies.
Methodology. CISA KEV JSON feed, catalog version 2026.10.30. CVE publication dates from the cve.org API (cveMetadata.datePublished), collected November 2, 2026; 281 of 282 matched. Days are calendar days in UTC. KEV's date added marks when CISA confirmed exploitation, not when it began. Download the dataset (CSV), free to reuse with attribution.
What do VulnCheck and Google see?
The same direction, measured differently.
- VulnCheck (first half of 2026): 495 vulnerabilities showed first-time exploitation evidence. 23.43% were exploited on or before the day their CVE was published, down from 28.93% in 2025. The median time from CVE publication to reaching KEV status fell from 120 days in 2025 to 80 days. Roughly 200 CVEs reached KEV within 31 days of publication, in line with 2024 and 2025.
- Google Threat Intelligence Group (January–August 2026): the number of vulnerabilities exploited per month rose from an average of 10.5 in 2025 to 18. Zero-days went from 8 a month to 11, with 22 in August alone. Monthly vulnerability disclosures doubled, from 5,045 in January to 10,740 in August, yet only 0.23% of all vulnerabilities disclosed in 2026 were seen exploited.
So the volume of disclosed bugs is exploding, the share that gets exploited is tiny, and the ones that do get exploited get hit fast. That's the whole problem in one sentence: you can't patch everything, and the few that matter don't wait.
Is AI making exploitation faster?
Probably for known bugs, and the evidence is still early. Google's analysis says growth in exploitation in 2026 has been "concentrated in the rapid weaponization of n-days," vulnerabilities that already have a patch. It suggests attackers may be using LLMs to analyze patch differences, advisories and proof-of-concept code to build exploits quickly.
That matches what we see from the offensive side. A model can diff a patched version against an unpatched one, find the fixed bug and write a working exploit, often in minutes. If you're running last month's version and think you're fine because there's no public exploit, you may not have that cushion anymore.
VulnCheck adds an important counterweight: its data doesn't show that AI-discovered vulnerabilities are more likely to be exploited than ones found by people. The speed-up is in weaponizing what's already public.
The sharpest example we've written about this year is Metabase (CVE-2026-72898, CVSS 10.0). Attacks against Metabase Cloud were seen on August 3, 2026. The advisory and patches came out on August 6. Exploitation came three days before anyone could patch.
You can't patch everything, and the few that matter don't wait.
What should security teams do with these numbers?
Stop planning around a patch window. It's gone for the vulnerabilities that matter. What you control is what's exposed, and how fast you can answer three questions when a critical CVE drops:
- Is it exposed? Not "do we run it," but does it answer from the internet, including on a vendor's SaaS or a forgotten subdomain?
- Is it exploited? Check KEV, vendor advisories and threat intel. CVSS alone doesn't tell you.
- Is it exploitable here? Version, configuration, reachability. Prove it, don't assume it.
This week:
- Inventory every internet-facing appliance (VPNs, firewalls, gateways, email security). They lead the same-day list.
- Set a 24-hour target for answering "are we exposed?" after a critical CVE, and drill it.
- Subscribe to KEV updates and treat a KEV addition on an exposed asset as an incident, not a ticket.
- Reduce what's exposed. Every management interface that doesn't need to face the internet is one less race to lose.
- Test from the outside continuously, so you know what's exposed before the CVE drops, not after. (What continuous external testing looks like.)
FAQ
What is time to exploit?
The time between a vulnerability becoming known (usually its patch release or CVE publication) and attackers exploiting it. Mandiant measures from patch release; VulnCheck measures from CVE publication.
What is the average time to exploit in 2026?
Mandiant's latest estimate is minus 7 days for 2025, meaning exploitation typically started a week before a patch was available. In Cylent's analysis of CISA's 2026 data, the median 2026 CVE was confirmed exploited 4 days after publication.
What does a negative time to exploit mean?
That attackers were exploiting the vulnerability, on average, before the vendor released a patch.
How fast does CISA add vulnerabilities to the KEV catalog?
For vulnerabilities with 2026 CVE IDs, a median of 4 days after publication in our analysis, with 27% added the same day or earlier. Across all CVEs, VulnCheck measured a median of 80 days to reach KEV status in the first half of 2026.
Is AI making exploitation faster?
Google's threat intelligence group attributes most of 2026's growth in exploitation to rapid weaponization of already-patched vulnerabilities and suggests AI-assisted patch analysis may be a factor. VulnCheck found no evidence that AI-discovered vulnerabilities are more likely to be exploited.
Update log
- November 2026: first edition. KEV data through catalog version 2026.10.30. Next update: December 1, 2026.
Sources
- Mandiant, M-Trends 2026 (March 23, 2026) and the full report
- Mandiant, How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends (October 15, 2024)
- VulnCheck, State of Exploitation 2026 and State of Exploitation 1H-2026
- Google Threat Intelligence Group, Vulnerability Discovery and Exploitation Trends in the AI Era (September 30, 2026)
- CISA, Known Exploited Vulnerabilities Catalog and BOD 26-04
- CVE Program, cve.org publication records
- Metabase security advisory for CVE-2026-72898 (August 6, 2026)