InfoSec Signals™
Sign InStart Free
CSV export is a subscriber feature

Updated under an hour ago ()

Chapter 10 of 14295 confirmed exploited in the last 12 months

Exploitation is speeding up

How soon after disclosure are vulnerabilities exploited now, and how fast does a program have to patch?

CISA confirmed 295 vulnerabilities exploited in the 12 months to Oct 2026. 38% of them were confirmed exploited by the day they were published (22% the year before), and half within 4 days of publication (29 days the year before).

What this means for you

55% of the vulnerabilities confirmed exploited in the last 12 months were confirmed within 7 days of publication, up from 41% the year before, and 65% within 30 days. A patch window measured in weeks is behind the attackers for most of them: set an emergency window in days for internet-facing systems and anything on CISA's list.

Do this next

Set an emergency patch window from the data

This chapter's program actions come with a subscription

295
Confirmed exploited, last 12 months
249 in the 12 months before
38%
By disclosure day
22% the year before
4
Median days to confirmation
29 days the year before
55%
Within 7 days
41% the year before

a. The volume

Confirmed exploitations per month

Every CVE CISA confirmed exploited, by the month it was confirmed, for the last 36 months. Click a month to open its CVEs.

Confirmed exploitations per month, last 36 months

CISA confirmed 295 vulnerabilities exploited in the last 12 months, more than the 249 in the 12 months before.

Sources: ; ;

Table view
Nov 2023225
Dec 2023100
Jan 2024215
Feb 2024115
Mar 202491
Apr 2024105
May 2024143
Jun 2024112
Jul 2024132
Aug 2024206
Sep 2024244
Oct 2024174
Nov 2024215
Dec 2024171
Jan 2025146
Feb 2025283
Mar 2025319
Apr 2025163
May 2025246
Jun 2025215
Jul 2025202
Aug 2025175
Sep 2025156
Oct 2025302
Nov 2025125
Dec 2025208
Jan 20262110
Feb 20263110
Mar 2026238
Apr 2026236
May 20262514
Jun 2026218
Jul 20262513
Aug 2026289
Sep 20263814
Oct 2026 (partial)177
How this is calculated

Every CVE CISA confirms exploited (listed in its Known Exploited Vulnerabilities catalog or assessed "active" in its Vulnrichment data), counted in the month or quarter CISA confirmed it, as a US Eastern date. Days to confirmed exploitation is that date minus the CVE's publication date; zero or less ("by disclosure day") is the closest public measure of a zero-day. A quarter's shares and median are shown from 5 CVEs with a publication date; the median is a day count that occurs. The last 12 months run to Oct 19, 2026; the 12 months before are compared with them. The current month and quarter are partial. A confirmation counts in the quarter it was made even when the CVE is years old, so a quarter's median also reflects old flaws CISA confirmed then.

Subscriber feature · $5 a month or $50 a year

Read the rest of Chapter 10: Exploitation is speeding up

The findings, every chart with drill-down to the reports behind it, and what to do about it, recalculated for any state, entity type or year range you choose. Unlock all 14 chapters with a subscription.
  • How soon after disclosure exploitation is confirmed, by quarter
  • What this means for your emergency patch window
  • What this means for your program: 4 key points
  • 4 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Set an emergency patch window from the data”
  • Exam angle for 5 CISSP, CISM and CISA domains, with a study prompt
Start freeOr subscribe for $5 a month

Included with an ExamPrep subscription or as a DueCare site administrator. How linking works

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.