q42 · askamerica

Once a software vulnerability becomes public, how long before attackers are actually using it?

Answer

Days, not weeks — and increasingly, the same day.

From the published literature (Mandiant/Google Cloud Threat Intelligence Time-to-Exploit series, VulnCheck's State of Exploitation series): the disclosure-to-exploitation window has shrunk steadily. Mandiant's median time-to-exploit fell from roughly 32 days (2018–2019 cohort) to about 21 days (2021–2022). In their 2023 cohort of 138 vulnerabilities confirmed exploited in the wild, about 70% (97 of 138) were already zero-days — exploitation began at or before public disclosure/patch availability — and the remaining n-day cases were typically exploited within one to a few weeks of disclosure. VulnCheck's tracking corroborates the same trend: a rising share of newly disclosed CVEs show confirmed exploitation within 24–48 hours.

Our own computed figure from this corpus (not just relayed): we joined CISA's KEV catalog (cyber_vuln.kev_catalog) to NVD's canonical CVE registry (cyber_vuln.vulnerabilities) on cve_id, computing date_added (CISA confirmed active exploitation) minus published (NVD's public disclosure date).

Data coverage caveat: this server snapshot has cyber_vuln.vulnerabilities loaded only for calendar year 2026 (26,159 CVEs; confirmed via data_coverage). The join therefore returns only 64 matched CVE pairs, all added to KEV between January and August 2026 — a small, single-year, recent-activity sample, not the multi-year population Mandiant's studies span.
Within that sample: median = 5 days, mean = 21.4 days (right-skewed — five CVEs took 93–179 days), and 20 of 64 (31%) were added to KEV the same day NVD published them.
That 31% same-day share lines up directionally with the literature's zero-day-dominant pattern, and the 5-day median sits inside the 1–7 day band industry trackers now cite as typical for network-facing/high-value software.
Definitional caveat: CISA's date_added marks when exploitation was confirmed and catalogued, not necessarily the moment first attacker use occurred — true first-exploitation dates run at or before this, so 5 days is a plausible, but not strict, lower bound.

Bottom line: for a vulnerability that does get weaponized, assume attacker use begins within about a week of public disclosure — often the same day for high-value, network-facing software — and the trend over the last several years has been toward faster exploitation, not slower.

Published report

Full report (narrative, dashboard, sourcing) was published via publish_report: "Attackers commonly exploit a vulnerability within about a week of public disclosure, often the same day" (local link: http://127.0.0.1:56149/a/f6a1c21813cdcfc1e42ef85e556c7eec.html — loopback, viewable only on the machine that ran this session)

Images in this folder

publish_report-023-0.png — the full published report/dashboard image (median/mean/same-day stat tiles + histogram)
render_chart-021-0.png — standalone bar chart: distribution of days from NVD publication to CISA KEV listing (n=64)

Sources

Mandiant/Google Cloud Threat Intelligence, "Time-to-Exploit Trends 2021-2022"
Mandiant/Google Cloud Threat Intelligence, "How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends"
VulnCheck, "State of Exploitation" series
CISA Known Exploited Vulnerabilities (KEV) catalog — cyber_vuln.kev_catalog
NVD CVE 2.0 canonical vulnerability records — cyber_vuln.vulnerabilities (2026 snapshot only in this server)