Part 2: An In-Depth Look at the Latest Vulnerability Threat Landscape (Attackers’ Edition) | Qualys
Summary: Qualys reports that for CVEs disclosed in 2023, the average gap from NVD publication to inclusion in CISA's Known Exploited Vulnerabilities catalog was just eight days, with some vulnerabilities exploited almost instantly. The post also cites CVE-2017-11882, a six-year-old Microsoft Office memory corruption flaw exploited by more than 400 malware samples and 50 threat actors, with exploitation evidence as recent as July 16, 2023.
What's compelling: An eight-day average from disclosure to confirmed exploitation leaves defenders almost no window to act manually, and a six-year-old flaw still drawing 400-plus malware families shows that unpatched legacy vulnerabilities remain live targets.
Read the original at Qualys Blog ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026