Weaponization SpeedStanding
Weaponization speed: the median new-KEV CVE was 0 days from disclosure to exploited
Updated 13 October 2026 · Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 0 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
Why it matters
Time-to-exploitation is the number that should set your patch SLA. If the median flaw is weaponized in weeks, a 30-day patch cycle is already behind the attackers.
What to do
- Security leaders. Compare your patch SLA to this median; if you patch slower than flaws are weaponized, you are structurally behind.
- Lean IT orgs. Treat KEV-listed CVEs as same-week work; the median one was already exploited within this window.
- MSPs. Use the weaponization median to justify a tighter, billable emergency-patch cadence to clients.
Our take
Weaponization speed, not CVE volume, is the honest measure of how much time defenders actually have.
Earlier issues
Past states of this signal, most recent first.
13 October 2026 Weaponization speed: the median new-KEV CVE was 3817 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 3817 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
04 October 2026 Weaponization speed: the median new-KEV CVE was 1 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 1 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
28 September 2026 Weaponization speed: the median new-KEV CVE was 16 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 16 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
21 September 2026 Weaponization speed: the median new-KEV CVE was 43 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 43 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
14 September 2026 Weaponization speed: the median new-KEV CVE was 5 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 5 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
08 September 2026 Weaponization speed: the median new-KEV CVE was 4 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 4 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
31 August 2026 Weaponization speed: the median new-KEV CVE was 1312 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 1312 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
24 August 2026 Weaponization speed: the median new-KEV CVE was 12 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 12 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
17 August 2026 Weaponization speed: the median new-KEV CVE was 0 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 0 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
11 August 2026 Weaponization speed: the median new-KEV CVE was 13 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 13 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
03 August 2026 Weaponization speed: the median new-KEV CVE was 0 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 0 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.
27 July 2026 Weaponization speed: the median new-KEV CVE was 4 days from disclosure to exploited
Timeframe: Weekly, last 52 weeks (KEV additions)
Of the vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog most recently, the median gap from CVE publication to KEV listing is 4 days. The chart tracks that weekly over the past year: how quickly disclosed flaws are turned into confirmed, in-the-wild exploitation.