Record WatchRecord

Vulnerabilities are being weaponized faster than we have ever measured

03 August 2026 · Timeframe: Weekly, last 52 weeks

The median time from a vulnerability's disclosure to its appearance on CISA's exploited list has fallen to 5 days, the shortest since we began tracking it (prior low: 6). The window between disclosure and exploitation is closing.

Why it matters

The gap between disclosure and exploitation is your patch runway. A record-short median means the assumption that you have weeks to patch is failing, and confirmed-exploited-first triage stops being optional.

What to do

• Security leaders. Shorten your mandatory-patch SLA for KEV items; the runway between disclosure and exploitation is at a record low.
• Lean IT orgs. Patch exploited vulnerabilities the day they list, not on the next cycle; the gap is closing.
• MSPs. Move KEV patching to an expedited same-week window across clients; the weaponization curve has steepened.

Our take

Resilience assumes exploitation is fast and getting faster. A record-short disclosure-to-exploitation window is the data behind why patch speed, not patch completeness, is the survival metric.