Noise Letter May 2026

Summary: The 2026 Verizon DBIR reports that exploitation of vulnerabilities is now the top initial access vector, accounting for 31% of breaches (up 55% year over year), with a median time to full remediation of 43 days, almost two weeks slower than last year. GreyNoise says its sensors saw eight activity surges compressing from 39 days to 2 days before Cisco published CVE-2026-20127 (CVSS 10.0, zero-day), a countdown pattern it observed across 33 CVEs with a median lead time of 11 days before public disclosure.
Bottom line: Attackers are active roughly 43 days before the median organization finishes remediating, and GreyNoise's observed median lead time of 11 days before public disclosure means the warning window is shorter than the patch cycle.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-20127
Related: CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Feb 25, 2026
Threat Advisory: Pulse Secure Connect Coverage Cyber Risks ·
Print Nightmare: Here’s what you need to know and Talos’ coverage Cyber Risks ·