Vulnerability Statistics 2026: Exploited CVEs, Zero-Days & Time to Exploit

In 2025 the world disclosed a record 48,185 software vulnerabilities, attackers weaponized 90 zero-days, and the median time to exploit a new flaw fell to under five days. The problem for most businesses is not a shortage of patches. It is that the average critical, internet-facing vulnerability still takes more than 70 days to fix, and attackers only need one.

What’s in This Report

1Vulnerability Disclosure Hit a Record in 2025

The raw number of catalogued vulnerabilities keeps setting records. The CVE Program, the global system that assigns a unique identifier to every publicly known flaw, published 48,185 new CVEs in 2025. That is a 20.6% increase over 2024 and the largest annual total ever recorded, averaging roughly 131 new vulnerabilities every single day.

It is tempting to read that curve as pure bad news, and the growth is real: more software, more dependencies, and more researchers all push the count up. But the total number of disclosed vulnerabilities is a poor measure of risk on its own. Most CVEs are never weaponized. The vulnerabilities that hurt businesses are the small subset that attackers actually pick up and use, which is exactly what the exploitation data measures.

Source: CVE Program metrics (cve.org) | NIST National Vulnerability Database

Turning that firehose of disclosures into a short, ranked list of what to fix first is the core of vulnerability management, and it is one of the first strategic decisions a business has to get right.

Get a Virtual CIO Assessment

2Which Vulnerabilities Attackers Actually Exploit

Two of the most respected data sets in the industry, Verizon’s Data Breach Investigations Report and Mandiant’s M-Trends, both point to the same conclusion for 2025: exploiting a known vulnerability has become one of the primary ways attackers get in. Verizon found that vulnerability exploitation was the initial access vector in 20% of breaches, a 34% year-over-year increase, making it the second most common entry point behind stolen credentials.

Mandiant’s frontline view is the sharpest. Across its 2024 investigations, exploits were the most common initial infection vector at 33%, with stolen credentials second at 16% and prior compromise through access brokers at 8%. Exploits and stolen credentials alone account for 49% of intrusions, tracing back to either an unpatched vulnerability or a compromised credential, the two problems a disciplined security program is built to close.

Counting how many vulnerabilities are exploited is its own discipline. VulnCheck, which maintains one of the most comprehensive exploited-vulnerability data sets, recorded 884 vulnerabilities with first-time exploitation evidence in 2025, a 15% increase over the prior year. CISA’s public Known Exploited Vulnerabilities catalog, the authoritative U.S. government list of flaws confirmed to be exploited, added 245 entries in 2025 and has grown to more than 1,400 vulnerabilities overall. Both lists exist for one reason: to tell defenders which of the tens of thousands of CVEs are worth acting on first.

Source: Verizon 2025 Data Breach Investigations Report | Mandiant M-Trends 2025 | CISA Known Exploited Vulnerabilities catalog

Closing the exploit and credential gap is the core of day-to-day security operations, from monitoring to rapid remediation.

Explore CNiC Cybersecurity Services

3Zero-Days: 90 Exploited, Enterprise in the Crosshairs

A zero-day is a vulnerability that attackers exploit before the vendor has a patch available, which leaves defenders with no fix to apply at the moment of attack. Google’s Threat Intelligence Group, which publishes the most rigorous public zero-day tracking, counted 90 zero-day vulnerabilities exploited in the wild in 2025. That is up roughly 15% from 78 in 2024, though still below the record of about 100 tracked in 2023.

The headline is not the count, it is the shift in target. For years, zero-day exploitation concentrated on consumer technology: browsers and phones. In 2025 that inverted. Nearly half of all zero-days aimed at enterprise-grade software and security appliances, and browser zero-days fell to just eight. Attackers have learned that a single flaw in a firewall, VPN gateway, or management console can unlock an entire network, and those devices often sit unpatched at the edge with little monitoring.

Attribution is getting clearer, too. Of the 90 zero-days, GTIG could directly attribute 42, and found that 18 were used by commercial surveillance vendors, the private companies that sell spyware and exploits to governments. For a typical business, the practical takeaway is defensive posture: you cannot patch a zero-day on day zero, so layered monitoring and rapid detection are what limit the damage while a fix is developed.

Source: Google Threat Intelligence Group 2025 Zero-Day Review

Continuous monitoring is what turns an unpatchable zero-day into a contained incident instead of a breach.

See How Managed IT Covers the Gaps

4Time to Exploit vs Time to Remediate

This is the statistic that matters most, because it explains why disclosure counts and patch counts miss the point. Two clocks start the moment a vulnerability becomes public: how long attackers take to exploit it, and how long defenders take to fix it. In 2026 those two clocks are moving in opposite directions.

On the attacker side, the median time to exploit a new vulnerability has collapsed to under five days, down from around 32 days just a few years ago. VulnCheck found that 28.96% of the vulnerabilities newly exploited in 2025 showed exploitation evidence on or before the day their CVE was published, meaning exploitation frequently arrives at the same moment defenders first learn a flaw exists.

On the defender side, remediation still moves at the pace of quarterly maintenance. Edgescan’s 2025 analysis put the median time to remediate a critical application or API vulnerability at 74.3 days, and a critical network vulnerability at 54.8 days. More than 20% of the internet-facing vulnerabilities Edgescan discovered were high or critical severity, and the pace varies sharply by industry, from a 63-day average for software firms to 104 days for construction.

Source: Edgescan 2025 Vulnerability Statistics Report | VulnCheck State of Exploitation 2025

Closing a 70-day exposure window is a management-and-infrastructure problem before it is a tooling problem.

Get Proactive Patch & Infrastructure Management

5Edge Devices, VPNs, and the Attack Surface

If there is one place the 2025 data says businesses are losing, it is at the network edge. Verizon found that 22% of all vulnerability-exploitation breaches targeted edge infrastructure, meaning firewalls, VPN concentrators, and remote-access gateways, an eightfold increase over the prior year. These devices are attractive precisely because they are exposed to the internet by design, run privileged software, and are often forgotten once installed.

The remediation numbers are the sobering part. Only 54% of the vulnerable edge devices Verizon observed were fully patched during the reporting window, and even those took a median of 32 days. That means roughly half of exposed, exploitable edge devices stayed vulnerable, while attackers moved in a matter of days. This is the mechanism behind many of the 2025 zero-days: an internet-facing appliance with a fresh flaw, no patch yet, and no one watching it.

You cannot defend an attack surface you have not mapped. The practical starting point is knowing every internet-facing asset you own, a discipline covered in our guide to attack surface management, and closing the gaps that third-party software introduces, which we break down in the supply chain attack statistics for 2026.

Source: Verizon 2025 Data Breach Investigations Report

Keeping edge devices, firewalls, and the wider network patched and monitored is core network infrastructure work.

Secure Your Network Edge

6What This Means for Small and Midsize Businesses

Small and midsize businesses often assume vulnerability data is an enterprise problem. The 2025 numbers say the opposite. Exploitation is now automated and indiscriminate: once a flaw is public, mass scanning finds every exposed instance within days, and a small business firewall is exactly as reachable as a large one. Ransomware groups have industrialized this, and 20.5% of the vulnerabilities in CISA’s Known Exploited catalog are tied to ransomware operations.

The good news buried in this data is that the top causes are the fixable ones. Exploited vulnerabilities and stolen credentials account for 49% of intrusions on Mandiant’s frontline, and both respond to fundamentals: know your assets, prioritize by exploitation evidence, patch internet-facing systems fast, enforce multifactor authentication, and monitor for the activity that follows a breach. None of that requires an enterprise budget. It requires a process that runs continuously instead of once a quarter.

A practical priority order for SMBs. The table below turns 48,000 disclosures into a short, ranked work queue a managed provider can actually keep current. Work it top to bottom.

Source: Mandiant M-Trends 2025 | CISA Known Exploited Vulnerabilities catalog

For most small and midsize businesses, continuous vulnerability and patch management is more reliable and less costly delivered as a managed service than staffed in-house.

Talk to CNiC About Managed Vulnerability Management

Summary Table: Every Stat at a Glance

Frequently Asked Questions

Methodology and Sources