Vulnerability and Exploitation Statistics Guide: CVE Volumes, Exploited Flaws and Patch Times

Vulnerability volumes keep rising while the window between disclosure and exploitation has shrunk to days or less, and most organisations still measure themselves against the wrong numbers. This page brings together vulnerability and exploitation statistics from primary publishers only: the CVE Program, NIST's National Vulnerability Database (NVD), CISA's Known Exploited Vulnerabilities (KEV) catalog, Google Threat Intelligence Group and Mandiant, the Verizon 2026 Data Breach Investigations Report (DBIR) and FIRST's Exploit Prediction Scoring System (EPSS). Every figure carries its source and as-of date in the same sentence or table row, and KEV counts are computed directly from CISA's catalog. It is for vulnerability management leads, security architects and CISOs who need defensible numbers for remediation SLAs, prioritisation policy and board reporting. Last reviewed: October 2026.

Key takeaways

• Exploitation is the top way in. The Verizon 2026 DBIR finds 31% of breaches began with exploitation of a vulnerability, ahead of credential abuse at 13%, and Mandiant's M-Trends 2026 reports exploits as the top initial infection vector for the sixth year running at 32% of intrusions.
• Attackers now move before the patch. M-Trends 2026 estimates the mean time to exploit at minus 7 days for 2025, meaning exploitation often begins before a patch is released, down from 63 days in 2018 to 2019 in Mandiant's earlier time-to-exploit research.
• Only a small share of CVEs is ever exploited. CISA's KEV catalog held 1,754 entries at version 2026.10.21, against roughly 20,000 to 29,000 new CVE Records a year in the CVE Program's own counts for 2021 to 2023.
• Remediation is getting slower, not faster. The 2026 DBIR finds only 26% of KEV-listed vulnerabilities were fully remediated in 2025 (38% the year before), with median full resolution rising to 43 days from 32.
• Enrichment cannot keep up. NIST reports CVE submissions grew 263% from 2020 to 2025 and that, despite enriching nearly 42,000 CVEs in 2025, the NVD backlog is still growing, so CVSS scores from NVD will be missing for many new CVEs.

Headline statistics

Statistics by theme

CVE volumes and NVD enrichment

Source for every row: CVE Program, 25th Anniversary Report, October 2024. The same report counts just over 400 CVE Numbering Authorities (408 to 411 depending on the table) in 40 countries. The CVE Program's live metrics page did not render readable figures when we checked, so full-year 2024 and 2025 counts are not quoted here.

• Submission growth: NIST's NVD programme page states, in its 15 April 2026 update, that CVE submissions grew 263% from 2020 to 2025 and that Q1 2026 submissions were nearly one-third higher than Q1 2025. Its 19 March 2025 update recorded a 32% rise in submissions in 2024.
• Enrichment: NIST says the NVD enriched nearly 42,000 CVEs in 2025, 45% more than in any prior year, but this was not enough to keep pace. NVD began building a significant backlog of unenriched CVEs in early 2024.
• Triage changes: on 15 April 2026 NIST moved backlogged CVEs published before 1 March 2026 to a "Not Scheduled" category and labels unprioritised new CVEs "Lowest Priority". KEV-listed CVEs are excluded from the backlog, with a goal of enrichment within one business day.

Exploited vulnerabilities: the CISA KEV catalog

The figures below were computed by NHI Mgmt Group directly from CISA's KEV catalog JSON, version 2026.10.21 released 21 October 2026. They count when CISA added each entry, which is not the same as when exploitation began.

• Weakness types: the most common CWE mappings in the same KEV version are CWE-20 Improper Input Validation (119 entries), CWE-78 OS Command Injection (112), CWE-787 Out-of-bounds Write (105), CWE-416 Use After Free (93), CWE-22 Path Traversal (82) and CWE-502 Deserialisation of Untrusted Data (71). Entries can carry more than one CWE.
• Ransomware concentration: SonicWall has 13 known-ransomware entries in the catalog, alongside Fortinet, Oracle and Ivanti, which reflects how often ransomware crews use edge and file-transfer products for entry.
• Vendor counts reflect footprint: Microsoft's lead partly reflects the size of its install base and product range, so vendor totals are not a product quality ranking.

Zero-days and time to exploit

• Zero-day share: Mandiant's 2023 time-to-exploit analysis covered 138 vulnerabilities disclosed in 2023 and exploited in the wild, of which 97 (about 70%) were exploited as zero-days and 41 as n-days. The n-day to zero-day ratio moved from 38:62 in 2021 to 2022 to 30:70 in 2023.
• N-day speed: of the 41 n-days in that 2023 analysis, 12% were exploited within a day of disclosure, 29% within a week and 56% within a month.
• Zero-day counts: Google Threat Intelligence Group's 2025 Zero-Days in Review (published 5 March 2026) tracked 90 zero-days exploited in 2025, against 78 in 2024 and a record 100 in 2023.
• Enterprise targets: the same GTIG review counts 43 zero-days (48%) in enterprise technologies, a new high, including 21 in security and networking products and 14 in edge devices, which GTIG says is likely an undercount. Operating systems accounted for 39 (44%) and mobile for 15.
• Who exploits zero-days: GTIG attributed more 2025 zero-days to commercial surveillance vendors than to state-sponsored espionage groups for the first time, with at least 10 linked to PRC-nexus espionage groups and 9 to financially motivated groups. Memory corruption accounted for about 35% of exploited vulnerabilities.
• Dwell time: M-Trends 2026 puts global median dwell time in 2025 at 14 days, up from 11.

Exploitation in breaches and remediation speed

• Initial access: the Verizon 2026 DBIR Executive Summary reports exploitation at 31% of breaches, overtaking credential abuse (13%) as the leading vector, in a dataset of more than 31,000 incidents and 22,000 confirmed breaches.
• Patch completion: the same report finds only 26% of critical vulnerabilities, defined as those in the CISA KEV catalog, were fully remediated in 2025, down from 38%, and the median time to full resolution rose to 43 days from 32.
• Exploits as a vector in incident response: M-Trends 2026, based on more than 500,000 hours of Mandiant investigations in 2025, lists exploits at 32%, voice phishing at 11%, prior compromise at 10% and email phishing at 6%.

Put together, a 43-day median to fully fix KEV flaws against a mean time to exploit below zero means most organisations are exposed for weeks on exactly the vulnerabilities attackers are known to use. The Ivanti Connect Secure Exploitation 2024 case shows the extreme: exploitation began in early December 2023 and patches arrived on 31 January 2024.

Prioritisation: what EPSS adds

FIRST describes EPSS as a daily estimate of the probability of exploitation activity being observed over the next 30 days, published for every CVE as a probability from 0 to 1 with a percentile. FIRST's model page illustrates the trade-off with data as of 1 October 2023 and exploitation observed during October 2023:

Source: FIRST, The EPSS Model page. FIRST notes the 10% threshold is an illustrative example, not a recommendation. The point is that severity (CVSS) and likelihood (EPSS, KEV) answer different questions. See the Vulnerability Prioritisation Guide and CVSS v4 Guide.

What the numbers mean for defenders

• Patch KEV first and fast: with exploitation often preceding the patch, internet-facing KEV entries need SLAs in days, not the 43-day median the DBIR observes. See the Remediation SLAs and Vulnerability Exceptions Guide.
• Plan for no patch: a negative time to exploit means mitigations, isolation and compromise assessment must be ready before a fix exists. See the Zero-Day Exploitation Playbook.
• Prioritise edge and security products: GTIG's enterprise zero-days and KEV's ransomware entries cluster in VPNs, firewalls and file-transfer systems. Keep a current inventory of every internet-facing appliance.
• Do not rely on NVD alone: with the enrichment backlog, use CNA-provided scores, vendor advisories, KEV and EPSS instead of waiting for NVD CVSS. See the Risk-Based Vulnerability Management Guide.
• Patching is not the end: where an edge device was exploited, rotate the secrets it held and revoke sessions. The CitrixBleed 2023 page shows session tokens stolen before patching staying valid afterwards.

Where identity fits

Edge appliances store service account credentials, API keys and certificates, and exploitation frequently turns into credential theft. Treat those machine credentials as part of the vulnerability response. See the Non-Human Identity and Secrets Statistics Guide.

Framework mapping

Common failure patterns when using vulnerability statistics

• Reading CVE growth as risk growth: more CVEs reflects more CNAs and more reporting as well as more flaws; the exploited share is what matters.
• Treating KEV "date added" as exploitation date: CISA adds entries when it has reliable evidence, often after exploitation started, and the 2021 to 2022 counts include backfill.
• Comparing time-to-exploit figures across methods: Mandiant's 5 days for 2023 excludes outliers (47 days with them), and the minus 7 days for 2025 is a mean estimate. Quote the method with the number.
• Using CVSS as likelihood: FIRST's example shows fixing everything CVSS 7.0 and above means fixing 57.4% of CVEs to reach 82.2% coverage at under 4% efficiency.
• Quoting roundup pages: many circulated "percentage of CVEs exploited" numbers have no primary source. If you cannot find the figure on the publisher's page, leave it out.

Methodology notes and caveats

Metrics to track in your own programme

• KEV exposure: count of open KEV-listed vulnerabilities on internet-facing assets, and age of the oldest.
• KEV remediation time: median days to full remediation (benchmark against the DBIR 43 days).
• KEV completion rate: share of KEV entries in scope fully remediated within SLA (benchmark against 26%).
• EPSS-weighted backlog: open vulnerabilities above your chosen EPSS threshold.
• Asset coverage: share of internet-facing appliances in the scanning and patching inventory.

Practitioner checklist

• Cite every figure with publisher, report and as-of date, and state the method for time-to-exploit numbers.
• Subscribe to KEV updates and ingest the JSON feed into your vulnerability tooling.
• Set remediation SLAs in days for internet-facing KEV entries, separate from CVSS-based SLAs.
• Add EPSS scores alongside CVSS in your prioritisation logic.
• Keep a complete inventory of VPNs, firewalls, gateways and file-transfer systems.
• Prepare mitigations and isolation steps for edge devices before a patch exists.
• Rotate credentials and revoke sessions held by any exploited appliance.
• Do not wait for NVD enrichment: use CNA and vendor scores when NVD has none.
• Report KEV exposure and remediation time to leadership monthly.
• Recheck these figures after each new DBIR, M-Trends and GTIG release.

Standards and references

• CISA: Known Exploited Vulnerabilities Catalog
• NIST: National Vulnerability Database programme updates
• CVE Program: 25th Anniversary Report
• FIRST: The EPSS Model
• Google Threat Intelligence Group: Look What You Made Us Patch, 2025 Zero-Days in Review
• Mandiant: M-Trends 2026
• Mandiant: How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends
• Verizon: 2026 Data Breach Investigations Report Executive Summary

Related NHI Mgmt Group resources: Vulnerability Management Guide · Patch Management Guide · Zero-Day and Exploited Vulnerabilities Guide · Supply Chain Attack Statistics Guide · Cybersecurity Statistics Guide