Exploit lag
How long was each flaw public before CISA confirmed it was being exploited?
Of the 61 vulnerabilities CISA added to its Known Exploited Vulnerabilities (KEV) catalog in the last 45 days, the longest gap between first publication and confirmed active exploitation was 4,161 days (CVE-2015-3306, published May 18, 2015, added to KEV October 8, 2026). The shortest was -1 days (CVE-2026-85706 — CISA's own KEV addition date landed before NVD's own publication date, see the note below). Every row below pairs a CVE’s own first-publication date on NIST’s National Vulnerability Database against the date CISA added that same CVE to its KEV catalog — not a severity score, but a measure of how long a flaw sat publicly disclosed before CISA had evidence it was being actively exploited.
Built by Daily CISO from CISA’s own KEV JSON feed and the NVD CVE API, each CVE’s own record. Not an official CISA or NIST page. 19 of 61 entries show a lag of zero days or less — NVD and CISA sometimes publish their own record of the same CVE a day apart, in either order, since the two organizations maintain independent records; a zero-or-negative lag here means the two dates were the same day or NVD’s own record trails CISA’s by a day, not that exploitation preceded disclosure. 6 of 61 entries were public for over a year before this KEV addition. Snapshot taken October 15, 2026.
CVE-2015-3306: ProFTPD Improper Access Control Vulnerability
4,161 days
ProFTPD · ProFTPD
Published May 18, 2015 · added to KEV October 8, 2026 · due October 11, 2026
CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability
4,089 days
ISC · BIND
Published July 29, 2015 · added to KEV October 8, 2026 · due October 11, 2026
CVE-2016-3081: Apache Struts Command Injection Vulnerability
3,817 days
Apache · Struts
Published April 26, 2016 · added to KEV October 8, 2026 · due October 11, 2026
CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability
2,081 days
ONLYOFFICE · Docs
Published January 26, 2021 · added to KEV October 8, 2026 · due October 11, 2026
CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability
1,268 days
Strapi · Strapi
Published April 19, 2023 · added to KEV October 8, 2026 · due October 11, 2026
CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
378 days
Linux · Kernel
Published September 5, 2025 · added to KEV September 18, 2026 · due September 21, 2026
CVE-2025-39964: Linux Kernel Race Condition Vulnerability
340 days
Linux · Kernel
Published October 13, 2025 · added to KEV September 18, 2026 · due September 21, 2026
CVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
239 days
Fortinet · Multiple Products
Published January 13, 2026 · added to KEV September 9, 2026 · due September 12, 2026
CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
189 days
Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Published March 4, 2026 · added to KEV September 9, 2026 · due September 12, 2026
CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
99 days
Kludex · Starlette
Published May 26, 2026 · added to KEV September 2, 2026 · due September 16, 2026
CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
97 days
Zyxel · GS1900 Series Switches
Published June 16, 2026 · added to KEV September 21, 2026 · due September 24, 2026
CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
85 days
Linux · Kernel
Published June 25, 2026 · added to KEV September 18, 2026 · due September 21, 2026
CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability
68 days
Kestra · Kestra OSS
Published June 26, 2026 · added to KEV September 2, 2026 · due September 5, 2026
CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability
56 days
BerriAI · LiteLLM
Published July 8, 2026 · added to KEV September 2, 2026 · due September 16, 2026
CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability
49 days
WSO2 · Multiple Products
Published August 6, 2026 · added to KEV September 24, 2026 · due September 27, 2026
CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability
47 days
Sangoma · Switchvox
Published July 17, 2026 · added to KEV September 2, 2026 · due September 5, 2026
CVE-2026-42016: JFrog Artifactory Incorrect Authorization Vulnerability
46 days
JFrog · Artifactory
Published July 27, 2026 · added to KEV September 11, 2026 · due September 25, 2026
CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability
45 days
Microsoft · SharePoint
Published August 11, 2026 · added to KEV September 25, 2026 · due September 28, 2026
CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
44 days
Adobe · Commerce and Magento
Published August 11, 2026 · added to KEV September 24, 2026 · due September 27, 2026
CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability
30 days
JFrog · Artifactory
Published August 12, 2026 · added to KEV September 11, 2026 · due September 25, 2026
CVE-2026-19490: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
21 days
Citrix · NetScaler
Published August 19, 2026 · added to KEV September 9, 2026 · due September 12, 2026
CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
20 days
MikroTik · RouterOS
Published September 5, 2026 · added to KEV September 25, 2026 · due September 28, 2026
CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Vulnerability
13 days
Check Point · Multiple Products
Published September 9, 2026 · added to KEV September 22, 2026 · due September 25, 2026
CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
10 days
Atlassian · Multiple Products
Published October 5, 2026 · added to KEV October 15, 2026 · due October 18, 2026
CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability
10 days
Ahsay · AhsayCBS
Published October 4, 2026 · added to KEV October 14, 2026 · due October 17, 2026
CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability
10 days
Ahsay · AhsayCBS
Published October 4, 2026 · added to KEV October 14, 2026 · due October 17, 2026
CVE-2026-86060: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
5 days
MikroTik · RouterOS
Published September 5, 2026 · added to KEV September 10, 2026 · due September 13, 2026
CVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
5 days
MikroTik · RouterOS
Published September 5, 2026 · added to KEV September 10, 2026 · due September 13, 2026
CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability
5 days
JFrog · Artifactory
Published August 28, 2026 · added to KEV September 2, 2026 · due September 5, 2026
CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability
3 days
WordPress · Core
Published September 22, 2026 · added to KEV September 25, 2026 · due September 28, 2026
CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
3 days
ConnectWise · ScreenConnect
Published September 8, 2026 · added to KEV September 11, 2026 · due September 14, 2026
CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Vulnerability
3 days
PaperCut · NG/MF
Published August 28, 2026 · added to KEV August 31, 2026 · due September 14, 2026
CVE-2026-81578: PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
3 days
PaperCut · NG/MF
Published August 28, 2026 · added to KEV August 31, 2026 · due September 14, 2026
CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability
2 days
Zammad GmbH · Zammad
Published September 30, 2026 · added to KEV October 2, 2026 · due October 5, 2026
CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability
2 days
Zammad GmbH · Zammad
Published September 30, 2026 · added to KEV October 2, 2026 · due October 5, 2026
CVE-2026-86218: N-able N-central Static Code Injection Vulnerability
2 days
N-able · N-central
Published September 6, 2026 · added to KEV September 8, 2026 · due September 11, 2026
CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability
1 day
Apple · Multiple Products
Published September 28, 2026 · added to KEV September 29, 2026 · due October 13, 2026
CVE-2026-58704: Google Pixel Improper Authorization Vulnerability
1 day
Google · Pixel
Published September 15, 2026 · added to KEV September 16, 2026 · due September 19, 2026
CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
1 day
Adobe · Commerce and Magento
Published September 7, 2026 · added to KEV September 8, 2026 · due September 11, 2026
CVE-2026-85046: Google Chromium V8 Type Confusion Vulnerability
1 day
Google · Chromium V8
Published September 3, 2026 · added to KEV September 4, 2026 · due September 18, 2026
CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
1 day
SonicWall · SMA1000 Appliances
Published September 1, 2026 · added to KEV September 2, 2026 · due September 5, 2026
CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
1 day
SonicWall · SMA1000 Appliances
Published September 1, 2026 · added to KEV September 2, 2026 · due September 5, 2026
CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
0 days
Cisco · Secure Email Gateway
Published October 14, 2026 · added to KEV October 14, 2026 · due October 17, 2026
CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
0 days
Palo Alto Networks · PAN-OS
Published October 14, 2026 · added to KEV October 14, 2026 · due October 17, 2026
CVE-2026-96951: Microsoft Windows Command Injection Vulnerability
0 days
Microsoft · Windows
Published October 13, 2026 · added to KEV October 13, 2026 · due October 16, 2026
CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
0 days
Ivanti · Connect Secure
Published October 13, 2026 · added to KEV October 13, 2026 · due October 16, 2026
CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
0 days
Citrix · NetScaler
Published October 4, 2026 · added to KEV October 4, 2026 · due October 7, 2026
CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability
0 days
Fortinet · FortiMail
Published October 1, 2026 · added to KEV October 1, 2026 · due October 4, 2026
CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
0 days
Cisco · Catalyst SD-WAN Manager
Published September 30, 2026 · added to KEV September 30, 2026 · due October 3, 2026
CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
0 days
Citrix · NetScaler
Published September 27, 2026 · added to KEV September 27, 2026 · due September 30, 2026
CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability
0 days
Citrix · NetScaler
Published September 27, 2026 · added to KEV September 27, 2026 · due September 30, 2026
CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
0 days
F5 · BIG-IP APM
Published September 22, 2026 · added to KEV September 22, 2026 · due September 25, 2026
CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
0 days
Arista · VeloCloud Orchestrator
Published September 22, 2026 · added to KEV September 22, 2026 · due September 25, 2026
CVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability
0 days
Check Point · Multiple Products
Published September 22, 2026 · added to KEV September 22, 2026 · due September 25, 2026
CVE-2026-76460: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
0 days
Cisco · Identity Services Engine
Published September 16, 2026 · added to KEV September 16, 2026 · due September 19, 2026
CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability
0 days
Cisco · Secure Email Gateway
Published September 14, 2026 · added to KEV September 14, 2026 · due September 17, 2026
CVE-2026-87491: Google Chromium V8 Out of Bounds Write Vulnerability
0 days
Google · Chromium V8
Published September 9, 2026 · added to KEV September 9, 2026 · due September 23, 2026
CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability
0 days
Microsoft · Windows
Published September 8, 2026 · added to KEV September 8, 2026 · due September 22, 2026
CVE-2026-81963: Microsoft Windows Link Following Vulnerability
0 days
Microsoft · Windows
Published September 8, 2026 · added to KEV September 8, 2026 · due September 22, 2026
CVE-2026-87886: Acronis Backup Incorrect Default Permissions Vulnerability
-1 days
Acronis · Backup
Published September 17, 2026 · added to KEV September 16, 2026 · due September 19, 2026
CVE-2026-85706: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
-1 days
GitLab · Community Edition and Enterprise Edition
Published September 12, 2026 · added to KEV September 11, 2026 · due September 14, 2026