The defender's window is closing.
How long defenders get between a vulnerability's public disclosure and its first reported exploitation in the wild.
Median window by CVE publication yearHover or tap a year
Recent years look faster than they really are. Older CVEs have had years to collect late exploitation reports; recent ones have not yet. Measured over the same 90 days after publication, the median has been about zero days every year since 2021. What has grown is volume: roughly 130 CVEs a year were exploited within a week of disclosure in 2021–22, versus about 350 in 2024–25.
By year
| Year | Exploited CVEs | Median window (days) | Exploited within 7 days | No window: exploited on/before disclosure |
|---|---|---|---|---|
| 2021 | 480 | 193.5 | 29% | 26% |
| 2022 | 467 | 322 | 27% | 26% |
| 2023 | 554 | 94 | 42% | 35% |
| 2024 | 709 | 4 | 52% | 46% |
| 2025 | 677 | 8 | 50% | 45% |
| 2026* | 557 | 1 | 61% | 48% |
* Partial year, through 3 Oct 2026. Window = first exploitation report recorded by VulnCheck KEV minus CVE.org publication date. Reported dates can trail actual attacks. VulnCheck KEV coverage grew after its 2023 launch. These figures do not show what causes any change.