How Fast Do CVEs Actually Become Working Exploits? The Data Behind Patch Timelines
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
Patch SLAs set without exploitation data are guesses. The 30-day default patch cycle predates the modern vulnerability exploitation environment by over a decade. In 2025, 72 hours is closer to the window organizations have to patch critical network-accessible vulnerabilities on internet-facing infrastructure before mass exploitation begins.
The MTTE data below is drawn from Rapid7, Tenable, and Google Project Zero research. The goal is not to cause panic: only 5% of published CVEs are ever exploited. The goal is to calibrate the urgency correctly for the 5% that are, before they become incidents.
MTTE by Vulnerability Class
The exploitation timeline is not uniform. Vulnerability class and access vector are the strongest predictors of how fast a CVE becomes an active weapon.
Perimeter device vulnerabilities (firewalls, VPNs, load balancers, network management interfaces): Median MTTE: 4.76 days from public disclosure to active exploitation. In several 2025 incidents, exploitation began within 24 hours of CISA's KEV catalog entry: meaning mass scanning and exploitation were already underway before most security teams had processed the alert.
Why so fast: These devices are network-accessible without authentication (by design), permanently exposed to the internet, easily discoverable via Shodan and Censys mass scanning, and commonly unmonitored because they are 'the security device.' Vulnerabilities in Fortinet, Palo Alto, Ivanti, Cisco, and Check Point devices consistently reach mass exploitation within a week of disclosure.
Web application vulnerabilities (CMSes, frameworks, API gateways): Median MTTE: 15-25 days when a proof-of-concept is published, 45-90 days when no PoC exists. The availability of public proof-of-concept code is the primary accelerant. The Joomla JCE CVE-2026-48907 exploitation went from PoC publication to 2.5 million scannable targets being probed within 18 days.
Enterprise application vulnerabilities (databases, ERP, SIEM): Median MTTE: 20-45 days for unauthenticated vulnerabilities, 60-120 days for authenticated vulnerabilities. The Splunk CVE-2026-20253 unauthenticated RCE reached active exploitation in approximately 30 days. Authentication requirements slow attackers because they need credential access first: but not indefinitely.
Local privilege escalation (Windows, Linux kernel): Median MTTE: 30-90 days, and only when attackers already have initial access. LPE vulnerabilities are not weaponized in isolation: they are used in post-exploitation chains after initial access is established via phishing or perimeter device compromise.
Zero-day vulnerabilities (exploited before public disclosure): MTTE is negative: exploitation precedes disclosure. Nation-state groups, particularly China (APT41, Volt Typhoon) and Iran (APT34, CyberAv3ngers), routinely exploit vulnerabilities for weeks or months before public disclosure. After disclosure, remaining unpatched instances are rapidly exploited by lower-sophistication actors who use the now-public technical details.
The PoC Publication Accelerant
Proof-of-concept exploit code publication is the single strongest predictor of imminent mass exploitation. A CVE with no public PoC requires significant reverse engineering skill to weaponize: accessible only to nation-state actors and sophisticated criminal groups. A CVE with a working PoC on GitHub is accessible to any threat actor with basic technical skills within hours of publication.
Rapid7's 2025 data showed that for vulnerabilities with publicly available PoC code:
- 50% were exploited in the wild within 14 days of the PoC being published
- 80% were exploited within 28 days
For vulnerabilities with no public PoC:
- Exploitation is primarily by the nation-state or criminal group that developed the exploit privately
- Mass exploitation rarely occurs until a PoC is eventually published (often by security researchers or after CISA advisory publication)
Practical implication: When a PoC is published for a vulnerability affecting your internet-facing systems, your patch window is now measured in days, not weeks. Monitor NVD, GitHub, and ExploitDB for PoC publication alongside CISA KEV catalog updates.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Turning MTTE Data Into Patch SLAs
These SLAs are based on MTTE data, not arbitrary policy. Build your vulnerability management SLA around them.
Tier 1 (patch within 24-48 hours):
- Any vulnerability in the CISA KEV catalog on an internet-exposed asset
- Any critical vulnerability on a perimeter device (firewall, VPN, load balancer) with a public PoC
- Any zero-day with confirmed active exploitation regardless of asset type
Rationale: MTTE for perimeter device CVEs with PoC is under 5 days. A 24-48 hour SLA requires emergency change management processes.
Tier 2 (patch within 7 days):
- Critical unauthenticated vulnerability on any internet-facing service with no PoC yet (PoC publication could accelerate this to Tier 1 at any time)
- High severity vulnerability on a perimeter device with PoC
- Any CISA KEV entry on an internal business-critical system
Tier 3 (patch within 30 days):
- High severity vulnerability on internet-facing web applications with no PoC and no KEV entry
- Critical vulnerability on internal systems with limited exposure
Tier 4 (next maintenance window):
- Medium and low severity vulnerabilities with no KEV entry, no PoC, and no evidence of active exploitation
- High severity vulnerabilities on internal assets with no internet exposure, no KEV entry
Document the SLA basis. When your change management board asks why a patch requires emergency deployment at 2 AM, 'the median exploitation window for this vulnerability class is 4.76 days and we are at day 3' is a more defensible answer than 'it is CVSS 9.8.'
What CISA KEV Catalog Additions Mean for Your Window
When CISA adds a CVE to the Known Exploited Vulnerabilities catalog, it confirms that active exploitation is already underway. By definition, the MTTE has elapsed. You are no longer racing to patch before exploitation: you are patching to stop ongoing attacks and clean up any pre-patch compromise.
The implication for organizations that use CISA KEV as their primary patch trigger: the KEV entry is the worst possible moment to begin your patch process. If you are waiting for CISA to confirm exploitation before starting remediation, you are starting after mass exploitation has already begun.
KEV-based patching is the right response to confirmed exploitation: it is not the right primary trigger for critical vulnerability remediation on internet-exposed infrastructure. The correct primary trigger is CVE disclosure combined with asset exposure assessment, with KEV as the confirmation that escalates urgency for any unpatched systems.
For organizations that cannot achieve Tier 1 or Tier 2 SLAs for perimeter devices due to operational constraints, document compensating controls: network segmentation that limits exploitability, WAF rules that block the exploitation pattern, temporary disabling of the vulnerable feature. Compensating controls with documented risk acceptance are a more defensible position than unmitigated exposure with no documented acknowledgment of the risk.
The bottom line
The 30-day default patch cycle is not calibrated to the modern exploitation environment. Perimeter device vulnerabilities are exploited within 5 days of disclosure; PoC publication accelerates that window to days for any vulnerability class. Build SLAs around MTTE data: 24-48 hours for KEV-listed or PoC-available critical perimeter vulnerabilities, 7 days for other critical internet-facing issues, 30 days for high-severity non-exploited vulnerabilities. Document the data basis for each tier so emergency patch requests have quantitative justification.
Frequently asked questions
How long does it take for a CVE to be exploited in the wild?
For perimeter device vulnerabilities (firewalls, VPNs), the median time from disclosure to active exploitation was 4.76 days in 2025. For web application vulnerabilities with a public proof-of-concept, 80% are exploited within 28 days of PoC publication. For local privilege escalation vulnerabilities, exploitation takes 30-90 days and requires attackers to already have initial access.
How fast should I patch a CISA KEV vulnerability?
CISA KEV entries confirm that active exploitation is already underway: your patch window has already elapsed. Patch immediately, within 24-48 hours for internet-exposed assets. Simultaneously check for pre-patch compromise using the forensic verification steps appropriate to the affected product, since patching does not remove attacker-installed persistence.
What is the average time from CVE disclosure to ransomware exploitation?
The average time from CVE public disclosure to ransomware group exploitation has compressed significantly. Coveware and Mandiant data shows ransomware groups exploiting newly disclosed vulnerabilities in 5 to 7 days on average, with some critical vulnerabilities in VPN appliances and firewall products being weaponized within 24 to 48 hours of PoC publication. Organizations relying on 30-day patch windows for critical vulnerabilities are operating outside the window of protection for their most exposed assets.
Which vulnerability types are exploited fastest after disclosure?
Authentication bypass vulnerabilities in internet-facing products are exploited fastest: these allow unauthenticated remote code execution without requiring a victim to take any action. VPN appliances (Citrix, Fortinet, Ivanti, Palo Alto Networks), remote desktop gateways, and email security products are the most frequently targeted categories in the 1 to 7 day window after disclosure. File upload vulnerabilities and SQL injection in web applications typically take longer to weaponize at scale because they require product-specific tooling.
How does EPSS relate to mean time to exploit?
EPSS (Exploit Prediction Scoring System) estimates the probability that a CVE will be exploited in the wild within the next 30 days, based on threat intelligence, publication activity, and historical exploitation patterns. A CVE with EPSS above 0.5 (50% probability) should be treated with the same urgency as a CISA KEV entry regardless of its CVSS score. EPSS is updated daily and is a more operationally useful prioritization input than CVSS because it incorporates real-world exploitation likelihood rather than theoretical severity.
How do I justify emergency patching outside the normal change management window to non-technical leadership?
Non-technical leaders respond better to business risk framing than to CVSS scores or technical vulnerability descriptions. The most effective emergency patch justification answers three questions in plain language: what can an attacker do if we do not patch, how long do we have before they are likely to try, and what does patching disrupt compared to what a breach would cost? For a critical perimeter device vulnerability with a public exploit and a 5-day median exploitation window, the framing is: an attacker who exploits this vulnerability before we patch gains the ability to access our internal network without any credentials. The data shows attackers begin attempting this within 5 days of public disclosure, and we are currently at day 2. Applying the patch requires a 2-hour maintenance window tonight. A successful exploit would require an incident response engagement averaging $200,000 plus potential regulatory notification costs and business disruption. The patch takes 2 hours; a breach takes weeks. That framing makes the urgency concrete without requiring leadership to understand what a CVE is. Prepare this justification as a one-paragraph written summary that can be approved over email or phone, not as a detailed technical document requiring a meeting. Emergency patches that require a 3-day approval process in a 5-day exploitation window are not actually emergency patches.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.