Exploit lag
How long was each flaw public before CISA confirmed it was being exploited?
Of the 48 vulnerabilities CISA added to its Known Exploited Vulnerabilities (KEV) catalog in the last 45 days, the longest gap between first publication and confirmed active exploitation was 4,161 days (CVE-2015-3306, published May 18, 2015, added to KEV October 8, 2026). The shortest was -4 days (CVE-2026-118527 — CISA's own KEV addition date landed before NVD's own publication date, see the note below). Every row below pairs a CVE’s own first-publication date on NIST’s National Vulnerability Database against the date CISA added that same CVE to its KEV catalog — not a severity score, but a measure of how long a flaw sat publicly disclosed before CISA had evidence it was being actively exploited.
Updated
Built by Daily CISO from CISA’s own KEV JSON feed and the NVD CVE API, each CVE’s own record. Not an official CISA or NIST page. 11 of 48 entries show a lag of zero days or less — NVD and CISA sometimes publish their own record of the same CVE a day apart, in either order, since the two organizations maintain independent records; a zero-or-negative lag here means the two dates were the same day or NVD’s own record trails CISA’s by a day, not that exploitation preceded disclosure. 6 of 48 entries were public for over a year before this KEV addition. Snapshot taken November 7, 2026. The whole catalog, counted daily, is on the KEV tracker. For the guides and glossary terms behind these numbers, see the patch and vulnerability management hub.
CVE-2015-3306: ProFTPD Improper Access Control Vulnerability
4,161 days
ProFTPD · ProFTPD
Published May 18, 2015 · added to KEV October 8, 2026 · due October 11, 2026
CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability
4,089 days
ISC · BIND
Published July 29, 2015 · added to KEV October 8, 2026 · due October 11, 2026
CVE-2016-3081: Apache Struts Command Injection Vulnerability
3,817 days
Apache · Struts
Published April 26, 2016 · added to KEV October 8, 2026 · due October 11, 2026
CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability
2,081 days
ONLYOFFICE · Docs
Published January 26, 2021 · added to KEV October 8, 2026 · due October 11, 2026
CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability
1,268 days
Strapi · Strapi
Published April 19, 2023 · added to KEV October 8, 2026 · due October 11, 2026
CVE-2024-27834: Apple Multiple Products Improper Authentication Vulnerability
904 days
Apple · Multiple Products
Published May 14, 2024 · added to KEV November 4, 2026 · due November 18, 2026
CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability
185 days
Fortinet · Multiple Products
Published April 14, 2026 · added to KEV October 16, 2026 · due October 19, 2026
CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
158 days
Linux · Kernel
Published May 23, 2026 · added to KEV October 28, 2026 · due October 31, 2026
CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
105 days
Adobe · Commerce and Magento
Published July 14, 2026 · added to KEV October 27, 2026 · due November 10, 2026
CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability
90 days
Broadcom · VMware ESX
Published July 30, 2026 · added to KEV October 28, 2026 · due November 11, 2026
CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability
49 days
WSO2 · Multiple Products
Published August 6, 2026 · added to KEV September 24, 2026 · due September 27, 2026
CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability
45 days
Microsoft · SharePoint
Published August 11, 2026 · added to KEV September 25, 2026 · due September 28, 2026
CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
44 days
Adobe · Commerce and Magento
Published August 11, 2026 · added to KEV September 24, 2026 · due September 27, 2026
CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability
27 days
Plex · Media Server
Published September 23, 2026 · added to KEV October 20, 2026 · due October 23, 2026
CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
27 days
Plex · Media Server
Published September 23, 2026 · added to KEV October 20, 2026 · due November 3, 2026
CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
27 days
Plex · Media Server
Published September 23, 2026 · added to KEV October 20, 2026 · due October 23, 2026
CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
27 days
Plex · Media Server
Published September 23, 2026 · added to KEV October 20, 2026 · due November 3, 2026
CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
20 days
MikroTik · RouterOS
Published September 5, 2026 · added to KEV September 25, 2026 · due September 28, 2026
CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
16 days
GitLab · Community Edition and Enterprise Edition
Published October 13, 2026 · added to KEV October 29, 2026 · due November 1, 2026
CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
15 days
Ivanti · Connect Secure
Published October 15, 2026 · added to KEV October 30, 2026 · due November 2, 2026
CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
10 days
Atlassian · Multiple Products
Published October 5, 2026 · added to KEV October 15, 2026 · due October 18, 2026
CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability
10 days
Ahsay · AhsayCBS
Published October 4, 2026 · added to KEV October 14, 2026 · due October 17, 2026
CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability
10 days
Ahsay · AhsayCBS
Published October 4, 2026 · added to KEV October 14, 2026 · due October 17, 2026
CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
9 days
Collabora · Collabora Online – Built-in CODE Server
Published October 14, 2026 · added to KEV October 23, 2026 · due October 26, 2026
CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
6 days
EG Secure Solutions · SiteGuard Server Edition
Published October 14, 2026 · added to KEV October 20, 2026 · due October 23, 2026
CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability
5 days
Google · Brotli
Published October 22, 2026 · added to KEV October 27, 2026 · due November 10, 2026
CVE-2026-109619: PHP Stale Internal Request-State Vulnerability
5 days
PHP Group · PHP
Published October 21, 2026 · added to KEV October 26, 2026 · due October 29, 2026
CVE-2026-109618: PHP Memory Corruption Vulnerability
5 days
PHP Group · PHP
Published October 21, 2026 · added to KEV October 26, 2026 · due October 29, 2026
CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability
5 days
Siemens · Software Center
Published October 15, 2026 · added to KEV October 20, 2026 · due November 3, 2026
CVE-2026-119977: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
3 days
WordPress · WordPress Core
Published October 31, 2026 · added to KEV November 3, 2026 · due November 6, 2026
CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability
3 days
WordPress · Core
Published September 22, 2026 · added to KEV September 25, 2026 · due September 28, 2026
CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability
2 days
Zammad GmbH · Zammad
Published September 30, 2026 · added to KEV October 2, 2026 · due October 5, 2026
CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability
2 days
Zammad GmbH · Zammad
Published September 30, 2026 · added to KEV October 2, 2026 · due October 5, 2026
CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
1 day
Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software
Published October 28, 2026 · added to KEV October 29, 2026 · due November 1, 2026
CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability
1 day
Arista · VeloCloud Orchestrator
Published October 22, 2026 · added to KEV October 23, 2026 · due October 26, 2026
CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
1 day
BeyondTrust · Remote Support
Published October 15, 2026 · added to KEV October 16, 2026 · due October 19, 2026
CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability
1 day
Apple · Multiple Products
Published September 28, 2026 · added to KEV September 29, 2026 · due October 13, 2026
CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
0 days
SonicWall · SonicOS SSLVPN
Published November 6, 2026 · added to KEV November 6, 2026 · due November 20, 2026
CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
0 days
Cisco · Secure Email Gateway
Published October 14, 2026 · added to KEV October 14, 2026 · due October 17, 2026
CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
0 days
Palo Alto Networks · PAN-OS
Published October 14, 2026 · added to KEV October 14, 2026 · due October 17, 2026
CVE-2026-96951: Microsoft Windows Command Injection Vulnerability
0 days
Microsoft · Windows
Published October 13, 2026 · added to KEV October 13, 2026 · due October 16, 2026
CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
0 days
Ivanti · Connect Secure
Published October 13, 2026 · added to KEV October 13, 2026 · due October 16, 2026
CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
0 days
Citrix · NetScaler
Published October 4, 2026 · added to KEV October 4, 2026 · due October 7, 2026
CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability
0 days
Fortinet · FortiMail
Published October 1, 2026 · added to KEV October 1, 2026 · due October 4, 2026
CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
0 days
Cisco · Catalyst SD-WAN Manager
Published September 30, 2026 · added to KEV September 30, 2026 · due October 3, 2026
CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
0 days
Citrix · NetScaler
Published September 27, 2026 · added to KEV September 27, 2026 · due September 30, 2026
CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability
0 days
Citrix · NetScaler
Published September 27, 2026 · added to KEV September 27, 2026 · due September 30, 2026
CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
-4 days
Ivanti · Connect Secure
Published November 3, 2026 · added to KEV October 30, 2026 · due November 13, 2026