The gap between a CVE being published and being known-exploited

How long vulnerabilities take to reach the KEV catalog after publication — a distribution, not an average.

0100200300days0–282846–1,1281,692–1,9742,538–2,8203,384–3,6664,230–4,5125,076–5,3585,922–6,204

Source: CISA / NVD · retrieved 17 Sep 2026 · Public domain (US Government)

Download CSV

The gap between a CVE being published and being known-exploited — Cyberstrategy