Last synced: September 28, 2026 against the official CISA KEV catalog and the National Vulnerability Database. Updated daily.

As of September 2026, the median exploited vulnerability was publicly known for 245 days before CISA flagged it in the KEV catalog — measured across 1728 CVEs with verified publication dates. When CISA adds a CVE to the Known Exploited Vulnerabilities (KEV) catalog, it is official confirmation that attackers are exploiting it in the wild. This tracker measures the lag: how many days each vulnerability was publicly known (published in NVD) before it landed on the KEV list — broken down by vendor. A long lag means defenders had the information but no urgency signal; a lag of zero or less means the vulnerability was already being exploited when it was published.

Headline Numbers

Vendor Leaderboard — Longest Median Lag

Vendors ranked by the median number of days their vulnerabilities were public before CISA confirmed active exploitation. Only vendors with at least 5 KEV entries with verified publication dates are ranked. “0-day rate” is the share of entries added to KEV on or before their NVD publication date — exploited at or before disclosure.

#VendorKEV entriesMedian lag (days)0-day rateRansomware
1Red Hat939150%3
2GNU526820%0
3Adobe8225714%10
4NETGEAR818420%0
5SAP1415750%2
6Oracle4614640%13
7Exim513640%1
8Jenkins611510%1
9Cisco99113416%6
10Drupal511280%2
11DrayTek510560%0
12Mozilla13103515%1
13D-Link269260%2
14Samsung156160%0
15TP-Link66140%0
16QNAP115739%9
17Linux315510%2
18Sophos754614%1
19IBM85450%2
20Microsoft38953123%104
21Apache404693%7
22Roundcube113080%0
23WordPress62120%0
24SonicWall1919716%10
25GitLab519420%1

Trend by Year

Median lag and median remediation window (days CISA gives federal agencies to patch, per BOD deadlines) by the year each CVE entered the catalog. The remediation window collapsed from 21 days to 3 under BOD 26-04 — CISA now expects near-immediate patching.

Year addedEntriesMedian lag (days)Median patch window (days)
20262441510
20252452621
20241862221
20231871221
2022555143621
2021311446181

Latest KEV Additions

“EPSS (eve)” is the percentile the EPSS forecast assigned to each CVE on the day before CISA confirmed exploitation — the last prediction available to a defender at the time. Values in the top decile are shown in bold. A dash means EPSS had no score for that CVE that day.

CVEVendor / ProductAdded to KEVLag (days)EPSS (eve)Patch deadlineRansomware
CVE-2026-88771Citrix NetScalerSeptember 27, 20260—September 30, 2026No
CVE-2026-88772Citrix NetScalerSeptember 27, 20260—September 30, 2026No
CVE-2026-65660Microsoft SharePointSeptember 25, 20264566.6%September 28, 2026No
CVE-2026-67279MikroTik RouterOSSeptember 25, 20262051.5%September 28, 2026No
CVE-2026-87902WordPress CoreSeptember 25, 2026386.3%September 28, 2026No
CVE-2026-5430WSO2 Multiple ProductsSeptember 24, 20264925.4%September 27, 2026No
CVE-2026-71362Adobe Commerce and MagentoSeptember 24, 20264497.8%September 27, 2026No
CVE-2026-85102Check Point Multiple ProductsSeptember 22, 20261326.2%September 25, 2026No
CVE-2026-93616Check Point Multiple ProductsSeptember 22, 20260—September 25, 2026No
CVE-2026-93952Arista VeloCloud OrchestratorSeptember 22, 20260—September 25, 2026No
CVE-2026-94127F5 BIG-IP APMSeptember 22, 20260—September 25, 2026No
CVE-2026-7273Zyxel GS1900 Series SwitchesSeptember 21, 20269724.7%September 24, 2026No
CVE-2025-39682Linux KernelSeptember 18, 202637842.0%September 21, 2026No
CVE-2025-39964Linux KernelSeptember 18, 202634025.4%September 21, 2026No
CVE-2026-53266Linux KernelSeptember 18, 2026852.2%September 21, 2026No

CVE Data Cards

One page per tracked CVE, with its verified NVD publication date, the lag we measured, the federal patch deadline and how it compares to the rest of its vendor’s record. 29 published so far:

Frequently Asked Questions

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities (KEV) catalog is the official list maintained by CISA of CVEs with confirmed exploitation in the wild. When a CVE is added, U.S. federal agencies are required to patch it by a fixed deadline.

What is the median lag between CVE publication and KEV listing?

As of September 2026, the median lag is 245 days, measured across 1728 KEV entries with verified NVD publication dates. That is how long the average exploited vulnerability was publicly known before CISA confirmed active exploitation.

How many KEV vulnerabilities are exploited as zero-days?

24% of KEV entries were added within 7 days of their NVD publication date, meaning they were being exploited essentially at or before public disclosure.

Did EPSS predict the vulnerabilities in the KEV catalog?

Not consistently. We measured the EPSS forecast from the day before each KEV listing across 1419 entries: 57.2% of the vulnerabilities CISA later confirmed as actively exploited were not in the top 10% of EPSS risk on the eve of that confirmation. The full breakdown, including the current watchlist of high-EPSS CVEs not yet in the KEV catalog, is at cvedaily.io/epss/.

How often is this KEV lag data updated?

Daily. Our automated tracking framework syncs the official CISA KEV JSON feed every day and enriches each new entry with its NVD publication date. No numbers are estimated or taken from third-party sources.

Can I cite this dataset?

Yes — the dataset is free to use and cite under CC BY 4.0 with attribution to CVEDaily (cvedaily.io/kev/).

Methodology

Our automated tracking framework syncs the official CISA KEV catalog JSON feed daily and records every new entry with the date it was added. For each CVE we retrieve the original publication date from the NVD API and compute the lag in calendar days. A negative lag means CISA listed the vulnerability before NVD finished publishing it — typically zero-days exploited before disclosure. We do not estimate or reconstruct dates from third-party sources: every number on this page comes directly from CISA and NVD records. Entries whose CVE is not yet in NVD are counted in the catalog total but excluded from lag statistics until NVD publishes them.

This dataset is free to cite with attribution to CVEDaily (CC BY 4.0).