Skip to content
Cybersecurity Vulnerabilities: Exploitation Patterns and KEV Insights

Cybersecurity Vulnerabilities: Exploitation Patterns and KEV Insights

First seen 3 Nov 2026, 20:51 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 22:46 UTC
  • •Only 1.48% of CVEs published since 2018 have been exploited in the wild.
  • •Microsoft vulnerabilities have the highest exploitation rates, with a median gap of 31 days.
  • •VulnCheck tracks over 2,500 exploited vulnerabilities, offering broader coverage than CISA.

The cybersecurity landscape reveals that out of 253,912 CVEs published from January 2018 to July 2026, only 3,769 (1.48%) have been confirmed exploited in the wild. Microsoft has consistently been the most targeted vendor, with n-day exploitation counts leading for nine years. Attackers exploit vulnerabilities in Cisco products within a median of 11 days, while Oracle and others see median gaps of 225-235 days. VulnCheck's KEV catalog tracks over 2,500 vulnerabilities, providing broader coverage than CISA. This catalog helps organizations prioritize and remediate vulnerabilities more effectively, with alerts issued 27 days earlier on average than CISA's updates. The current focus is on improving vulnerability management and response times for known exploited vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 6h ago How this analysis works

Timeline

2026-11-03
VulnCheck KEV catalog updated
VulnCheck announced it tracks over 2,500 actively exploited vulnerabilities, surpassing CISA's catalog.
VulnCheck
2026-11-03
Vulnpocalypse Report released
The report analyzed 253,912 CVEs, revealing only 3,769 have been exploited in the wild.
Root Evidence

More articles in this cluster (2)

Following this threat?

Track Cisco in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

What percentage of CVEs are exploited?
Only 1.48% of the CVEs published from January 2018 to July 2026 have been confirmed exploited.
How quickly are Cisco vulnerabilities exploited?
Cisco vulnerabilities have a median exploitation gap of 11 days after patch availability.
What does VulnCheck offer for vulnerability management?
VulnCheck provides a real-time catalog of known exploited vulnerabilities, helping organizations prioritize remediation.