CISA KEV Lag Tracker (August 2026): How Long Exploited CVEs Stay Unflagged

Last synced: August 12, 2026 against the official CISA KEV catalog and the National Vulnerability Database. Updated daily.

As of August 2026, the median exploited vulnerability was publicly known for 271 days before CISA flagged it in the KEV catalog — measured across 1665 CVEs with verified publication dates. When CISA adds a CVE to the Known Exploited Vulnerabilities (KEV) catalog, it is official confirmation that attackers are exploiting it in the wild. This tracker measures the lag: how many days each vulnerability was publicly known (published in NVD) before it landed on the KEV list — broken down by vendor. A long lag means defenders had the information but no urgency signal; a lag of zero or less means the vulnerability was already being exploited when it was published.

Headline Numbers

• 1665 CVEs in the KEV catalog (1665 with verified NVD publication dates)
• Median lag from CVE publication to KEV listing: 271 days
• 24% were added to KEV within 7 days of publication — exploited almost immediately
• 47% took more than a year — old, unpatched software still being exploited
• 20% of all KEV entries are associated with known ransomware campaigns

Vendor Leaderboard — Longest Median Lag

Vendors ranked by the median number of days their vulnerabilities were public before CISA confirmed active exploitation. Only vendors with at least 5 KEV entries with verified publication dates are ranked. “0-day rate” is the share of entries added to KEV on or before their NVD publication date — exploited at or before disclosure.

Trend by Year

Median lag and median remediation window (days CISA gives federal agencies to patch, per BOD deadlines) by the year each CVE entered the catalog. The remediation window collapsed from 21 days to 3 under BOD 26-04 — CISA now expects near-immediate patching.

Latest KEV Additions

CVE Data Cards

One page per tracked CVE, with its verified NVD publication date, the lag we measured, the federal patch deadline and how it compares to the rest of its vendor’s record. 4 published so far:

• CVE-2026-18556 — N-able N-central (3 day lag)
• CVE-2026-56155 — Microsoft Active Directory Federation Services (0 day lag)
• CVE-2026-56164 — Microsoft SharePoint Server (0 day lag)
• CVE-2026-45659 — Microsoft SharePoint Server (40 day lag)

Frequently Asked Questions

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities (KEV) catalog is the official list maintained by CISA of CVEs with confirmed exploitation in the wild. When a CVE is added, U.S. federal agencies are required to patch it by a fixed deadline.

What is the median lag between CVE publication and KEV listing?

As of August 2026, the median lag is 271 days, measured across 1665 KEV entries with verified NVD publication dates. That is how long the average exploited vulnerability was publicly known before CISA confirmed active exploitation.

How many KEV vulnerabilities are exploited as zero-days?

24% of KEV entries were added within 7 days of their NVD publication date, meaning they were being exploited essentially at or before public disclosure.

How often is this KEV lag data updated?

Daily. Our automated tracking framework syncs the official CISA KEV JSON feed every day and enriches each new entry with its NVD publication date. No numbers are estimated or taken from third-party sources.

Can I cite this dataset?

Yes — the dataset is free to use and cite under CC BY 4.0 with attribution to CVEDaily (cvedaily.io/kev/).

Methodology

Our automated tracking framework syncs the official CISA KEV catalog JSON feed daily and records every new entry with the date it was added. For each CVE we retrieve the original publication date from the NVD API and compute the lag in calendar days. A negative lag means CISA listed the vulnerability before NVD finished publishing it — typically zero-days exploited before disclosure. We do not estimate or reconstruct dates from third-party sources: every number on this page comes directly from CISA and NVD records. Entries whose CVE is not yet in NVD are counted in the catalog total but excluded from lag statistics until NVD publishes them.

This dataset is free to cite with attribution to CVEDaily (CC BY 4.0).